Five HR Record-Keeping Mistakes Swiss SMEs Still Make (And How to Fix Them)

Hiring is the easy part. The paperwork that follows — passports, contracts, emergency contacts, training certificates, and the question of whether someone is actually an employee or invoicing through their own company — is where most Swiss SMEs quietly lose time and take on risk they didn't notice. Here are the five mistakes we see most often, why they happen, and what they cost.

Mistake 1: Keeping HR and Payroll as two separate "sources of truth"

It starts innocently. HR keeps a spreadsheet of staff. Payroll keeps its own list because the person doing salary runs doesn't have access to — or trust in — the HR file. Within a year, the two lists disagree: an address was updated in one, a bank detail changed in the other, and nobody remembers which is current.

This duplication happens because most tools treat HR and Payroll as separate products. The fix is structural, not procedural: one shared employee registry that both HR and Payroll draw from, so there is exactly one record per person and no reconciliation work. Changing an address once means it's correct everywhere.

Mistake 2: Treating every worker as the same "employee" type

A growing business rarely has just payroll employees. There are contractors placed by an agency, and freelancers invoicing through their own company. When HR systems only have one box — "employee" — these distinctions get lost in notes fields or forgotten entirely, which becomes a real problem the moment a fiduciary or auditor asks who is actually on payroll versus who is self-employed.

The fix is to record employment type as structured data from day one: employee, contractor with the vendor on record, or freelancer with their own company on record. It takes seconds at onboarding and saves a scramble later when someone needs to answer exactly this question for MWST or social insurance purposes.

Mistake 3: Scanned passports living on a shared drive

Almost every SME has one: a folder called "Personal" or "HR" on the company drive, full of scanned passports, ID cards, and CVs, accessible to anyone with a login. Nobody set it up to be insecure — it just grew that way, one onboarding at a time.

This is the mistake with the highest cost if it goes wrong, because passport and ID data is exactly the kind of personal data that needs real protection. The fix is private, checksummed storage built for this purpose: documents stored with SHA-256 checksums, hardened downloads, and a full audit trail of every upload, download and deletion — so you can always show who accessed what and when, instead of hoping nobody did.

Mistake 4: Manually re-typing skills and certifications from every CV

When a CV lands in an inbox, someone has to read it and manually note down the languages, skills and certifications it mentions — if anyone does it at all. More often, the CV just sits as a PDF, and when you need to know "who on the team speaks Italian" or "who's certified in X," nobody can answer without reopening every file.

AI skills extraction solves this by reading the CV at upload time and turning it into searchable chips on the profile — skills, languages, certifications — automatically. What used to be a dead PDF becomes data you can actually search across your whole team.

Mistake 5: No record of who completed training, or an emergency contact nobody can find

Two smaller but surprisingly common gaps: training records living in a trainer's own spreadsheet rather than the employee's file, and emergency contact details that exist on a paper form filed away somewhere, useless in an actual emergency.

Both are solved by keeping the information attached directly to the staff file rather than in a separate system. Link a staff file to its Flitz login and completed training courses with quiz scores appear automatically. Every file also carries an emergency contact with a one-tap WhatsApp link, so when it matters, the information is one tap away rather than one search away.

Why these mistakes keep happening

None of this is due to carelessness. It happens because HR data naturally wants to live in five different places — a spreadsheet, a shared drive, a payroll tool, a training provider's portal, an emergency contact form — and keeping them in sync is nobody's full-time job. The practical fix isn't a stricter process; it's removing the duplication by design.

That's the idea behind Flitz's HR Management module: one shared registry — the same one Payroll uses — holding each person's staff file, employment type, documents, training records and emergency contact, gated to Owner/Admin roles only so sensitive personnel data never leaks into the whole team's view. It replaces the personnel spreadsheet and the shared drive full of scanned passports with a single, auditable place everyone from HR to your fiduciary can trust.

The takeaway

Each of these mistakes is small on its own. Together, they add up to duplicated work, unclear compliance answers, and real data-security exposure. Fixing them doesn't require a policy document — it requires a system where the correct behaviour is also the easiest one.