Glossary

Immutability (Tamper Resistance)

Immutability (tamper resistance) means that once a record is entered, it cannot be altered in a manner that conceals or erases the original entry. Any subsequent amendments must be recorded with a fully traceable audit trail.

What Is Required

Under UK statutory standards—including the Companies Act 2006 (sections 386–388), HMRC electronic record-keeping frameworks (such as Making Tax Digital), and statutory payroll requirements—records must remain reliable, accurate, and verifiable. The fundamental principle requires that an entry must not be altered or overwritten in such a way that its original content is obscured or lost.

This standard applies not only to core general ledgers but also to all upstream feeder systems, including operational time tracking, attendance logs, and project billing software used to substantiate payroll, National Minimum Wage (NMW) compliance, Working Time Regulations (WTR 1998) limits, and client invoicing.

Traceability Rather Than a Prohibition of Amendments

Statutory compliance does not prohibit genuine corrections or retroactive adjustments. Instead, it mandates complete transparency: every alteration must preserve the original historical entry while capturing an immutable audit log containing:

  • The exact date and timestamp of the amendment.
  • The unique identity of the user who made the change.
  • The previous and newly updated values.
  • The operational or legal reason for the correction.

A dedicated digital time tracking platform that maintains an immutable, append-only audit trail—recording edits as distinct event logs while keeping the initial entry intact—fully satisfies statutory requirements under HMRC, Employment Tribunal, and regulatory scrutiny.

Why Spreadsheets Regularly Fail Compliance

Standard spreadsheets (such as Microsoft Excel or Google Sheets) allow historical cells to be overwritten retroactively without producing an automatic, tamper-evident audit log.

While businesses sometimes attempt to achieve compliance using strict folder permissions, file versioning, or manual change logs, these arrangements are operationally fragile and rarely withstand rigorous scrutiny during HMRC wage investigations, National Minimum Wage audits, or employment dispute tribunals. Where working hours, holiday pay calculations, or overtime records are contested, unlogged spreadsheets are routinely challenged or dismissed as insufficient proof of compliance.

Technical and Operational Implementation

To guarantee full compliance and tamper resistance, an organisation's time tracking and HR systems must incorporate:

  • Individual User Authentication: Distinct credentials and role-based permissions for every individual recording, approving, or amending data.
  • Append-Only Audit Trail: Automated, tamper-proof logging of all record creations, edits, and deletions that cannot be manipulated by administrative users.
  • Database-Level Integrity: Security controls and encryption preventing direct, unlogged modifications to the underlying database tables.
  • Period Locks & Timesheet Approval Workflows: A formal period-close process after which historical timesheets are locked against ordinary edits and can only be amended via documented, auditable adjustment entries.
Updated on
Back to the glossary

Related terms

Glossary

Statutory Retention Period

The statutory retention period is the minimum time frame for which employment, tax, and accounting records must be preserved under UK law. In HR and payroll, these statutory periods range from two years for working time records to six years for National Minimum Wage compliance, PAYE records, and financial accounts.

Glossary

Process Documentation (Electronic Record-Keeping)

Process documentation describes how an organisation records, processes, secures, and retains digital data subject to statutory record-keeping rules. It demonstrates compliance to HMRC, auditors, and regulators for all IT and payroll systems.

Glossary

Data Access (Tax & PAYE Audit)

Data access refers to the statutory powers of HMRC to inspect and obtain tax-relevant digital records during a tax or compliance check under Schedule 36 to the Finance Act 2008 and Making Tax Digital (MTD) regulations.

Related guides

Guide

HR Statutory Retention Periods – 2, 3, and 6 Years in the UK

Statutory retention periods in HR: 2 years for working time limits, 3 years for PAYE & tax, 6 years for payroll, NMW, and accounting records — UK GDPR data erasure rules.

8 min readGuide

Data Processing Agreement (DPA) – When You Need One

Data Processing Agreements under Article 28 UK GDPR: Distinguishing controller and processor roles, mandatory clauses, sub-processors, and international data transfers.

7 min readGuide

Preparing for an HR and Payroll Compliance Audit – What the Inspector Wants to See

HR external audits in the UK: HMRC PAYE compliance reviews, National Minimum Wage inspections, The Pensions Regulator audits, working time records, key risk areas, and preparation strategies.

9 min read