Blog / Operations in practice

The hire-to-retire process, and where it breaks

Hire, move, leave: every change starts in the HRIS and has to reach every other system. Where the hire-to-retire process breaks, and what to fix first.

Rich Waldron avatar

Rich Waldron

Co-founder and CEO

A new engineer starts on Monday. The offer was signed three weeks ago, but someone typed it into the HRIS on Friday, so IT got the ticket the same afternoon. The laptop arrives Wednesday. Payroll misses the first run. Eight months later she moves to the product team and keeps her production database access. Two years later she leaves, and her CRM login still works in June.

None of these is a big failure. Each one is a change that started in HR and didn’t reach every system that needed it. That is what the hire-to-retire process is: every change in someone’s working life, carried from the HRIS to identity, devices, payroll, finance and every app they use.

This post walks through the eight stages of the employee lifecycle, where each one breaks, and what to fix first.

The eight stages, and where each one breaks

  1. Offer to hire record. The signed offer becomes the worker record in the HRIS. It breaks when the offer is retyped days later, and everything after it starts late. Why new hires get typed in twice.
  2. Accounts and access before day one. Identity, email and the apps the role needs are ready on the start date. It breaks when the first morning goes on IT tickets for logins. IT onboarding: access before day one.
  3. Equipment. A laptop is ordered, set up and delivered before the start date. It breaks when the laptop arrives after the person does. The guide to building a device lifecycle sync covers it.
  4. Payroll and benefits. Pay, tax and benefits reach payroll before the first pay run. It breaks when a new hire misses the run and gets paid by hand. Working with the ADP Workforce Now APIs covers one payroll system in detail.
  5. Org chart and approvals. Manager, team and cost center flow to every system that routes approvals. It breaks when expense approvals still go to a manager who left. The guide to building an org hierarchy sync covers it.
  6. Training and compliance. Required courses are assigned by role, and completions go back to the HRIS. It breaks when the auditor asks who finished security training and nobody can say. The guide to building a training completion sync covers it.
  7. Role changes and transfers. A move adds what the new role needs and removes what the old one had. It breaks when the removal never happens. Why movers keep their old access.
  8. Offboarding. On the leave date, access goes everywhere, work is handed over and the laptop comes back. It breaks when someone who left in March can still log in. Why access outlives the employee.

Why the process breaks between HR and IT

The HRIS is right, and nothing else hears about it. HR records the hire, the move and the leaving date correctly. Every other system finds out from a ticket, an email or a spreadsheet, if it finds out at all.

Joiners get a process, movers don’t. Onboarding and offboarding have checklists. A transfer is usually an HR update and a few access requests, so access piles up with every move.

Access is copied instead of defined. New starters get “the same as Sam”, including everything Sam picked up over five years.

Nobody checks the result. A request to remove access that failed looks the same as one that worked. Without a regular comparison between the HRIS and each system, leavers with live accounts stay invisible until an audit.

What to fix first

  1. Trigger everything from the HRIS. Hires, moves and leavers start their work when the HRIS records them, not when someone files a ticket.
  2. Define access by role, as data. Keep a profile of what each role gets, and stop copying colleagues.
  3. Treat a move as a leaver and a joiner. Remove the old role’s access on a set date, and add the new role’s.
  4. Run offboarding on the leave date, everywhere. Including apps outside single sign-on, and with a faster path for a hostile departure.
  5. Reconcile every week. Compare who the HRIS says works here with who has access to each system, and report the difference to an owner.

What it saves

Automating routine user provisioning on Tray.ai saves Auctane’s IT team about 50 hours a month. For how an AI agent fits on top, answering HR questions and submitting requests, read AI agents for HR.

Access requests between hiring and leaving belong to IT as much as HR. IT service desk automation covers that side.