Role and permission guide for fees, payments, and school accounting

1. List financial roles

Start with finance, admissions, registrar, leadership, family, learner, bank, payment provider, accounting, IT, support, auditor, privacy, security, records, and accessibility roles. Add temporary, substitute, and external roles where relevant.

For each role, state whether it may view, create, approve, issue, receive, allocate, refund, adjust, write off, reconcile, export, correct, archive, administer, or investigate.

2. Match access to purpose

Limit access by role, account, campus, fee item, payer relationship, transaction, report, or temporary assignment when the workflow requires it. A person who sees a balance may not need refund or rule-changing authority.

Test family and payer access, shared devices, payment links, notifications, exports, support tools, APIs, files, backups, and restored copies. Check access removal after a person changes role or relationship.

3. Separate approval from action

Document who requests, reviews, approves, executes, reconciles, communicates, and audits a discount, bursary, refund, credit, write-off, changed payer, correction, or fee schedule change.

Record evidence, threshold, effective date, affected account, report treatment, notification, audit event, rollback, and owner. Avoid a permission model where one user can create and conceal a material change.

4. Handle exceptions safely

Rehearse part payment, overpayment, failed payment, duplicate, chargeback, refund, sibling account, changed payer, bursary, discount, instalment, currency, transfer, withdrawal, correction, gateway failure, and outage.

For each, define the temporary route, permitted access, evidence, expiry, reconciliation, communication, escalation, and recovery. Do not ask users to work around a denied permission by sharing credentials.

5. Govern the lifecycle

The U.S. Department of Education data governance checklist covers quality, access, security, lifecycle, sharing, disposal, and monitoring. Use those categories for joiner, mover, leaver, privileged access, exports, retention, disposal, incidents, and review.

GOV.UK school guidance is a public reference for accountable data handling, not universal legal advice. Apply qualified local privacy, finance, security, records, accessibility, safeguarding, and legal review.

6. Test and monitor

Use a representative permission matrix and scenario pack. Record expected access, observed access, data exposed, action permitted, audit event, support response, and limitation.

At 30, 60, and 90 days, review inappropriate access, failed approvals, untracked corrections, support demand, staff effort, reconciliation, statement questions, and the original outcome. Remove, repair, narrow, or expand access from evidence.

Turn the guidance into an accountable financial decision

Apply this guidance to one bounded part of role and permission guide for school fee management software. Define the authoritative account, invoice, payment, allocation, receipt, balance, ledger, statement, or report record; accountable owner; permitted users; correction route; evidence; and review date.

Test an ordinary transaction and meaningful exceptions such as part payment, overpayment, failed payment, duplicate payment, chargeback, refund, sibling account, changed payer, bursary, discount, instalment, currency, transfer, withdrawal, correction, access failure, integration failure, or outage.

Keep supplier capability, school responsibility, finance policy, professional judgement, local requirements, legal advice, and measured outcome separate. If evidence is incomplete, narrow the claim and pilot the smallest safe change.

Review at 30, 60, and 90 days. Check reconciliation, allocation accuracy, payment timeliness, statement clarity, corrections, access exceptions, staff effort, support demand, reporting confidence, and the original outcome.

Before approval, ask a reviewer who was not involved in the design to challenge the strongest assumption. Replace broad language with the exact evidence, population, date, and limitation the school can verify.

Document what was tested and what was not. A successful payment demonstration with one account does not establish readiness for multiple campuses, currencies, policies, payment providers, accounting treatments, refunds, or changed fee schedules.

Keep evidence beside the decision record so a later reviewer can distinguish observed behaviour from an assumption, estimate, supplier statement, or policy requirement. Name the next test where evidence remains incomplete.

Revisit the boundary when the school adds a campus, fee item, payer type, currency, payment method, gateway, accounting integration, role, reporting period, policy, or retention rule. A small change can alter access, calculation, reconciliation, communication, or support demand.

Set the next review date and owner. A dependable fees and payments operation is maintained through clear definitions, controlled change, reconciliation, professional accountability, and visible evidence rather than a one-time setup.

Make the handoff readable to finance, admissions, registrar, leader, payer, auditor, IT, support, privacy, security, records, and accessibility reviewers. State what passed, what remains manual, which records are authoritative, and who owns unresolved conflicts.

Keep approved fee definitions beside calculations, approvals, training, support routes, retention, incident handling, change history, and exit requirements. New rules or payment methods can change the risk even when field names remain the same.