Modern time and attendance, moving beyond the clock on the wall.

Biometric terminals solve the buddy punching problem completely. You cannot clock in with someone else's face or fingerprint. For organisations where buddy punching is a genuine concern, particularly manufacturing, logistics, healthcare, and food production, biometrics is often the obvious choice.

Modern facial recognition terminals are also entirely touchless, which matters in environments where hygiene is a priority. No shared surfaces, no PINs passed between colleagues. Scan and move on.

The most common concern people raise about biometrics is privacy, and it is a reasonable one. We address it properly in chapter 4, but the short version is this: compliant biometric systems do not store photographs or fingerprint images. They store an encrypted mathematical template derived from the biometric data, and the original is discarded immediately. You cannot reconstruct a fingerprint from what is kept on the system.

For general office environments, or where biometrics are not appropriate for operational or policy reasons, card and fob-based clocking is a solid, well-understood option. It is quick, familiar, and easy to manage.

The main limitation is that cards can be shared, so if buddy punching is a significant concern in your environment you will want to think carefully about whether this is sufficient on its own. PIN-only systems carry the same risk. They are simple and cheap, but a PIN is just a number, and numbers get shared.

For field-based workforces, engineers, care workers, delivery teams, construction crews, a fixed terminal obviously does not work. Modern T&A platforms offer mobile clocking via a smartphone app, which sounds simple enough. The implementation detail that really matters here is geofencing.

Geofencing means the app will only allow a clocking when the employee is physically within a defined geographic boundary: the site perimeter, the building postcode, the job location. Without it, remote clocking is barely more reliable than an honour system. With it, you have a genuine record of who was where and when.

Geolocation tagging goes a step further. It does not restrict clocking to a set zone, but it does record the GPS coordinates at the time of clocking, giving you a verifiable location record alongside the timestamp. Useful for organisations with multiple sites or variable work locations where the perimeter changes by job rather than by venue.

The Working Time Regulations 1998 set out the legal framework for working hours in the UK. The four provisions most organisations need to track are listed below. The exact application depends on contract type, opt-outs, and sector-specific exemptions, so your legal team should confirm how each applies to your specific workforce.

In theory, tracking all of this manually is possible. In practice, for most organisations with more than a handful of employees, it is the kind of thing that gets done imperfectly. The gap only becomes apparent when there is a grievance, an audit, or an employment tribunal.

A modern platform tracks all of this automatically, and alerts managers in advance when limits are being approached, giving you the chance to adjust scheduling before a violation occurs rather than discovering it retrospectively. In practice, that means fewer surprises at grievance stage, in audits, or in tribunal bundles, because the system has been enforcing the rules all along.

The most common reason organisations hesitate over biometric T&A is GDPR, and it is an understandable concern. Biometric data is classified as special category data under UK GDPR, and that does carry additional obligations.

But there is a widespread misconception about what compliant systems actually store. Properly designed biometric platforms use a Privacy by Design approach: the system captures the biometric data, converts it into an encrypted mathematical template, and discards the original. No photograph. No fingerprint image. Just a numerical representation that can only be used for comparison and cannot be reversed to recreate the original biometric.

Think of it less as storing a fingerprint and more as storing a coded lock that only knows whether a key matches, not what the key looks like.

You still have obligations around consent, data subject rights, and storage limitations, and any reputable supplier should be able to provide documentation to support your Data Protection Impact Assessment. But the idea that using biometrics means storing sensitive personal images is simply not how modern systems work.

Most T&A implementations track time at the employee level: who was in, when, and for how long. Job costing takes that a step further and tracks time at the task, project, or cost-centre level, so you can understand not just that someone worked eight hours, but how those eight hours were actually spent.

For manufacturing and service businesses, this is genuinely transformative. You can see which production lines, machines, or client projects are consuming more labour than anticipated, identify exactly where productive time is being lost, and cost jobs accurately enough to see where your margin is going, and where you have an opportunity to recover it.

It requires a bit more setup. Employees need to clock against specific jobs or cost centres rather than just clocking in and out. For the right organisations, the management information it generates is worth considerably more than the system itself.

This one matters for any organisation operating in an environment where fire or emergency evacuation is a genuine risk, which is to say almost every organisation.

Traditional roll calls at assembly points are slow, prone to error, and rely on someone having an up-to-date list. When it is a drill, that is fine. When it is a real fire at 2pm on a Wednesday with contractors on site, temporary staff on shift, and a visitor in reception, it is a serious problem.

Emergency mustering integrates your time and attendance system with fire panels and RFID tracking to generate a real-time, accurate headcount at assembly points, instantly identifying who is accounted for and who is not. Three statuses are applied automatically as people arrive at muster zones:

It is faster, more accurate, and removes the single points of failure (the missing clipboard, the absent fire marshal) that make paper-based roll calls unreliable. Because the system is already tracking who is on site, the muster check is essentially instant once people start arriving at the assembly point.

For organisations in scope of the Terrorism (Protection of Premises) Act 2024, electronic mustering is increasingly part of the compliance posture rather than just a safety upgrade. The audit trail it produces is the kind of evidence that regulators expect to see.

The T&A market has a structural problem that catches buyers out regularly. On one side, you have software companies that are genuinely good at the rules engine, the reporting, and the integrations, but have limited knowledge of hardware, and when something physical fails they are pointing fingers at the hardware supplier. On the other side, you have hardware resellers who can supply and fit a terminal but have no real depth in the software layer, and when the rules engine does not do what you need it to do, they are pointing fingers at the software vendor.

If you end up in that gap, between a software company and a hardware reseller with each blaming the other, your problems are very hard to resolve quickly. Ask any prospective supplier directly: who is responsible if a terminal fails and the software stops receiving data? What is the resolution process? If the answer involves a third party, that is a risk worth understanding before you sign anything.

A supplier who looks like a fully integrated operation can still be subcontracting the physical install to third parties, and that matters more than most buyers realise. Subcontractors often have no relationship with the software, no familiarity with the specific configuration required, and no incentive to get the handover right. Problems found during commissioning end up in a queue somewhere between two organisations, neither of which feels fully responsible.

The questions to ask here are simple but revealing. Do your engineers install and commission all your own projects? Are they employed by you directly? Who do we call if there is a problem with the physical installation six months after go-live, and is that person the one who will turn up?

Implementation is a one-off event. Support is forever. A system that works beautifully on day one but requires a support ticket and a two-day wait every time you need to update a pay rule is going to frustrate your team and erode confidence in the platform over time.

Ask to speak to existing customers, specifically about support response times. Ask how system updates are handled and communicated. Ask whether your account will have a named contact or go into a general helpdesk queue. Ask which pay-rule changes your team can make themselves, and which require vendor intervention. These conversations tell you considerably more about what working with a supplier looks like than any product demo ever will.