What is a sub cert?

A sub cert is a type of ROS digital certificate that you can create which will be linked to your original (Admin) ROS certificate. The admin cert will control the sub cert and you have the ability to limit the content available to the sub cert user.

For example, you may want the sub cert user to only be able to view one tax type, or to only be able to file returns but not make payments etc. In this instance we want to limit the sub cert user to only have access to our additional PAYE registration number.

Why do we want to create a sub cert for our additional PAYE registration?

Under the old PAYE system, Directors of a company would typically only submit their yearly salary to Revenue on the annual P35 form. This information would typically not be included in the payroll system and would not be available to other staff.

With the introduction of PAYE Modernisation, employers will be required to submit weekly or monthly payroll uploads for all employees (including all Directors) to Revenue, so the Directors will need to include their salary information on the payroll software. In this new system, the digital cert attaching to an employer registration will have access to all the payroll information for that registration irrespective of employee grouping.

To keep this information confidential, an additional PAYE registration and ROS sub cert can be used. The Directors can have a separate payroll run, and by filing and paying with Revenue using the additional PAYE registration this information will not be accessible by staff.

Another instance where you might want to use a sub cert is if your business has multiple locations or branches. Each payroll can be kept separate, using a separate PAYE registration and ROS sub cert for each branch or location etc.

Setting up a ROS sub cert

To set up a sub cert, first log in to ROS and go to the Admin Services tab at the top of the screen:

Next, click on the Add New option to add a new sub cert: 

The following sections need to be completed:

 

• Surname – Surname of the sub cert user
   
• First Name – First name of the sub cert user
   
• ID Ref – Name of the sub cert
   
• Email – Email address of the sub cert user

Once completed, you will see the message below:

The sub user will now receive an email to the address you have included. This will give them instructions on how to retrieve their sub cert and install it on their computer.

The system password can be found in the Admin Services tab by clicking on the lock symbol under System Password. This password needs to be given to the sub cert user so that they can link the cert to your admin cert.

You will also need to give them the ID Ref of the sub cert that you included earlier. In this case the ID Ref is “TestSubCert”.

Once the user follows the straightforward steps from the email from Revenue, and you provide them with the sub cert ID Ref and System Password, they should now be able to set up their sub cert.

As a default, the sub cert will have limited access and functionality. This is all controlled by the Admin cert. If you go to the Admin Services tab (which is not accessible for sub cert users) you can control what permissions each sub cert user has.

Select the sub cert you want to control and click on the Revise button to view permissions.

You will see the options to allow a sub cert to view only, prepare returns only and prepare and file returns. This can be changed for each individual tax type.

For the purpose of allowing the sub cert to only be able to see the additional PAYE registration, or the original registration only, click on the Restrictions button on right.

The restrictions option allows the admin user to restrict certain tax registrations from a sub user.

For example, here we have two PAYE registration numbers, one is used for the Directors’ payroll (Sample registration 1) and the other is used for the staff payroll (Sample registration 2).

We only want the sub user to be able to see the staff payroll and returns, so we restrict Sample registration 1 from the sub cert user. 

Once you select which tax number you want to restrict and click Confirm, the sub user will not be able to view any information under this PAYE registration. This can be changed by the admin at any time, and different sub certs can have different permissions. The sub cert is now set up to be used.

For additional information regarding saving and reloading ROS digital certificates, please click here.