Timesheet locking: how to prevent historical data tampering
Timesheets serve two purposes: operational management (who worked on what this week) and historical record (what happened over the past year for audits, billing disputes, and compliance). These purposes have different requirements. Operational data needs flexibility for corrections. Historical records need immutability.
Timesheet locking in BetterFlow addresses this by creating a clear boundary: once timesheets are approved and a period is locked, the data becomes immutable. At BetterQA, we implemented this after discovering that well-intentioned corrections to old timesheets were causing audit discrepancies.
Why historical timesheet changes are problematic
Consider this sequence of events:
- January 15: Employee logs 8 hours to Project Alpha
- January 31: Manager approves January timesheets
- February 15: Invoice sent to client based on January hours
- March 1: Employee realizes they miscategorized 2 hours; changes Project Alpha to Project Beta
- March 15: Annual audit compares invoices to timesheet data; discrepancy found
The March correction was made in good faith, but it created a mismatch between the invoice (based on January data) and the current timesheet record. Without an audit trail, no one can explain the discrepancy.
How timesheet locking works
BetterFlow implements locking at two levels:
Approval-based locking: Once a manager approves a timesheet, the employee cannot modify it without manager override. This prevents casual corrections after approval.
Period-based locking: Administrators can lock entire time periods (weekly, monthly, quarterly). Once locked, no changes are possible without explicit unlock, which itself is logged.
Audit trail for all changes
Every timesheet modification is logged with:
- Who made the change
- When the change was made
- What the previous value was
- What the new value is
- Why the change was made (if unlock was required)
This audit trail satisfies most compliance requirements (SOX, GDPR record-keeping, SOC 2) because auditors can see both the current state and the full history of modifications.
Lock periods and business cycles
Different organizations have different locking needs:
Weekly lock: Common for agencies that bill weekly or have weekly payroll. Timesheets lock every Monday for the previous week.
Monthly lock: Typical for project-based organizations that invoice monthly. Timesheets lock on the 5th of each month for the previous month (allowing a few days for corrections).
Quarterly lock: Used by organizations with quarterly reporting requirements. Monthly data remains editable until quarter-end.
Override workflows
Sometimes legitimate corrections are needed after locking. BetterFlow supports controlled overrides:
- Admin unlock: An administrator can unlock a period temporarily, make corrections, and re-lock
- Correction entries: Instead of modifying original entries, add adjustment entries that offset the original
- Audit notes: Any unlock requires a written justification that becomes part of the audit trail
The correction entry approach is often preferable because it preserves the original data while recording the adjustment. Auditors can see exactly what happened: "Original entry: 8 hours Project Alpha. Correction entry: -2 hours Project Alpha, +2 hours Project Beta. Reason: Miscategorization discovered during project review."
Integration with billing systems
Timesheet locking is most valuable when integrated with billing. The recommended workflow:
- End of billing period: Manager approves timesheets
- Day 3: Administrator reviews and locks the period
- Day 5: Billing system exports locked timesheet data
- Invoices generated from locked data
Because billing only uses locked data, invoices will always match the immutable historical record.
About BetterFlow
Built by BetterQA, a software testing company. BetterFlow provides timesheet locking and audit trails that satisfy enterprise compliance requirements while remaining simple for daily use.
Sources & References
- SOC 2 - Trust Service Criteria
- GDPR - Data Integrity Requirements
- ISO 27001 - Information Security Controls
Published by BetterQA, an ISO 27001 and ISO 9001 certified company with 8+ years of experience in software quality assurance. According to research by McKinsey, data-driven project management improves team productivity by up to 25%. Last updated on .
- Built by BetterQA, founded in 2018 in Cluj-Napoca, Romania
- ISO 27001 certified security and GDPR compliant
- Trusted by teams across 15+ countries
- 30-day free trial with no credit card required
