• Client invoices should be checked against the applicable contract / work order, approved rates, billing period and supporting timesheet or service evidence, where relevant.
• Material invoice adjustments, credit notes, refunds and unusual payments should be reviewed and approved by an authorized person.
• Company expenses should have a business purpose, supporting documentation and appropriate approval before reimbursement or payment.
• Bank and payment records should be reviewed periodically; unexplained differences should be investigated and escalated.
• Financial records should be retained in accordance with applicable legal, tax, contractual and company requirements.

• Payroll should be prepared from authorized employee / consultant records and verified inputs, including attendance, timesheets, approved changes, deductions and allowances, as applicable.
• Payroll calculations and payment totals should be checked by an appropriate reviewer before disbursement.
• Changes to salary, bank details, allowances or deductions should be supported by documented authorization.
• Payroll information is confidential and access is limited to personnel who require it for their duties.
• Errors, late inputs or payment exceptions should be documented, corrected and escalated where material.

• Candidate CVs, qualifications, experience and relevant role information should be reviewed for consistency and suitability before submission to a client.
• Candidate personal data should be collected, used, shared and retained only for legitimate business purposes, with appropriate notice / consent or other lawful basis where required.

Recruitment activities must not involve forced labour, human trafficking, deceptive recruitment, unlawful worker-paid recruitment fees or coercive retention of identity documents. Recruitment partners should be informed of these expectations where relevant.

• Employment or consultant engagement terms should be documented before commencement, as applicable.
• Onboarding should confirm required documentation, assignment details, client requirements and access arrangements.
• Offboarding should include return of company / client property, closure of relevant access, final payroll / timesheet checks and record updates.

• Deployment should be supported by an agreed role, rate, start date, work location / arrangement and applicable client approval or work order.
• Account Management / Operations should maintain a record of active consultants, assignment dates, client contacts and material assignment changes.
• Timesheets or attendance records should be reviewed and approved in accordance with the client’s process before billing and payroll, where applicable.
• Client feedback, performance concerns, absence, resignation and replacement needs should be documented and escalated to the relevant owner.
• At assignment end, the responsible team should coordinate return of assets and removal of client-system access with the client.

• Executed client agreements, work orders, purchase orders, amendments and relevant correspondence should be stored in an authorized location.
• Contract, PO, work permit and other relevant expiry dates should be recorded and monitored, with advance reminders where practicable.
• Changes to rates, scope, personnel, assignment dates or commercial terms should be documented and approved before implementation where required.
• Management / Administration should monitor relevant company registration, tax, labour, immigration, BOI-related and other statutory requirements applicable to the company and its activities.
• Legal or regulatory questions outside internal competence should be referred to an appropriately qualified adviser.

• Company and client systems should be accessed only by authorized users for approved business purposes.
• Access should be granted according to role and need; access changes and termination should be coordinated promptly when personnel join, change roles or leave.
• Passwords, authentication credentials, devices and access tokens must not be shared or exposed to unauthorized persons.
• Company, client and personal information should be stored and transferred using appropriate approved channels and safeguards.
• Suspected loss, unauthorized access, malware, data disclosure or other security incidents should be reported promptly to Management and the designated IT contact; client notification should follow applicable contractual and legal requirements.

The incident coordinator or Management should assess the incident, take reasonable containment steps, preserve relevant evidence, record the known facts and actions taken, and determine whether client, affected-person or regulator notification is required by applicable law or contract.

• Personal data should be handled in accordance with applicable privacy laws, including Thailand’s PDPA where it applies.

AI and other digital tools may be used only for legitimate business purposes. Confidential client information, personal data, CVs, payroll information, credentials and restricted records must not be entered into public or unauthorized AI tools. AI-generated outputs must be checked by an appropriate person before use, including for accuracy, confidentiality, bias and intellectual-property concerns.

• Purchases and third-party engagements should have a legitimate business purpose and appropriate approval.
• Supplier selection should consider capability, cost, reliability, conflicts of interest and relevant compliance / confidentiality requirements.

For material suppliers or subcontractors, proportionate due diligence should be performed before engagement and periodically where warranted. Checks may include business identity, service capability, conflicts of interest, confidentiality commitments, data-protection and security arrangements, and relevant legal or contractual compliance. The extent of screening should reflect the nature and risk of the services.

• Where a third party may access client or personal information, appropriate confidentiality, data protection and security obligations should be agreed before access is provided.
• Material supplier issues or suspected misconduct should be escalated and corrective action documented.