Buddy-punch pattern detection.
Identical punch pairs — the same two workers, entering within seconds of each other, day after day. Individually explicable. As a pattern, not.
Zepth Core · Site Operations
Timecards
Payroll input, legal record, and the “burned” half of every productivity number you have.
Last updated
Zepth Core module
Timecards
AI agent built into the module
Punch data from attendanceCost-code and activity allocationException review before approvalJurisdictional overtime rules
+25% / +50%
UAE overtime premiums — 25% on ordinary overtime, 50% for night work between 22:00 and 04:00
UAE Labour Law, Article 19
And in a wage dispute the employer effectively carries the burden of proving the hours. A digital punch record with metadata is not administrative tidiness — it is the evidence.
$145,000
median loss per occupational fraud case, ACROSS ALL INDUSTRIES — running a median of 12 months before detection
ACFE, Report to the Nations 2024
The all-industry figure. Construction is materially worse: the same study puts the median construction loss at $250,000, which we cite on our three-way-matching page. Time theft is the quiet, structural end of this — it rarely produces a case at all.
~75%
of US businesses reportedly affected by buddy punching — one worker clocking in for another
Estimates attributed to the American Payroll Association
Attributed loosely and deliberately: these figures circulate widely through secondary sources and vendor material, and we have not seen the primary study. Treat the order of magnitude, not the decimal.
Weekly
the cadence at which US federal contractors submit certified payroll — as a SWORN statement (form WH-347)
Davis-Bacon Act
Governments already treat timecards as sworn statements. It is a reasonable guess about where the rest of the industry is heading, and a useful benchmark for what disciplined looks like.
Overview
Timecards convert attendance into money and into productivity: hours by worker, by cost code, by activity.
They are three things at once, and the third is the one that gets forgotten. A timecard is a payroll input. It is a legal record — of overtime, of wage entitlement, of certified payroll where that applies. And, allocated to activities, it is the burned half of every productivity measurement the project makes. Get it wrong and you have not merely mispaid someone; you have corrupted the baseline you will bid the next job from.
Time theft is quiet, structural, and it poisons more than payroll
It is rarely dramatic. It is rounding — fifteen minutes at each end, every day. It is buddy punching, where one worker clocks in for another who is not there. It is hours booked to no cost code at all, which is the most convenient place for an hour to go.
The estimates circulate widely: something around two per cent of gross payroll, and a substantial majority of businesses affected by buddy punching. We attribute those loosely on purpose — they come through secondary sources and vendor material, and the order of magnitude is the useful part, not the decimal. But even at the low end, on a thousand-worker Gulf site, two per cent of payroll is a six-figure annual number that nobody has budgeted for and nobody will find.
And here is the part that is genuinely underrated, because it is not about the money at all. Overstated hours corrupt the productivity baseline. Earned-over-burned uses those hours as its denominator — so inflated burn makes your crews look less productive than they are. Which means your disruption claim is understated, because you cannot prove the productivity you actually achieved. And it means your next bid is priced off a norm that is quietly wrong, in the direction that loses you work.
The fraud data provides the frame, and it is worth reading carefully. Across all industries, the median occupational fraud loss is $145,000, running a median of twelve months before anyone detects it. In construction specifically, the median is materially higher — $250,000, a figure we set out on our three-way-matching page. Time theft mostly never becomes a case at all. It just runs.
What a timecard has to do
Allocate to cost codes and activities — or the timecard is only a payroll input. Hours booked against activities turn payroll into productivity data, and productivity data into claim evidence. AACE’s disruption methods need contemporaneous hours, allocated, at the time. Unallocated hours are not a minor untidiness: they are the specific mechanism by which a project loses the ability to prove what its own crews achieved.
Overtime rules are jurisdictional, unforgiving, and the burden of proof runs against you. In the UAE, ordinary overtime carries a 25% premium and night work between 22:00 and 04:00 carries 50%, alongside rest-day rules. And in a wage dispute the employer is effectively the party who must prove the hours. A digital punch record, with metadata, is not administrative neatness — it is the evidence, and its absence is not neutral.
Certified payroll shows where this is going. US federal contractors submit weekly certified payroll on form WH-347 — as a SWORN statement, with penalties for falsity. Whatever one thinks of the paperwork, note what it means: a government has already decided that a timecard is a legal instrument rather than an administrative convenience. That is a reasonable benchmark for what a disciplined process looks like, and a reasonable guess about the direction of travel.
The approval chain fails by habit, not by corruption. Foreman submits, supervisor approves, exceptions get flagged. The failure mode is not a bad actor — it is approval-by-reflex: forty timesheets, Friday afternoon, one click each. That is how ghost hours pass, and they pass with a genuine signature attached. Exceptions have to be surfaced BEFORE the approval, or the approval is a rubber stamp wearing a control’s uniform.
How Zepth runs timecards
Punch data flows from attendance rather than being re-entered, so the gate and the timesheet cannot disagree by accident. Hours allocate to cost codes and activities, which is what makes them productivity data rather than merely payroll.
Exceptions surface before the approval — overtime anomalies, unallocated-hours drift, identical punch pairs that look like buddy punching — so the supervisor is reviewing a short list of things worth looking at rather than clicking through forty screens. And the same hours feed payroll, the WPS file, and the burned side of every productivity dashboard on the project.
The value
Why it matters
Hours are allocated, so the project can prove the productivity its crews actually achieved — in a claim, and in the next bid.
Buddy punching and rounding are visible as patterns rather than absorbed as noise.
Overtime is calculated to the jurisdiction’s rules, with a punch record that carries the burden of proof the employer actually bears.
Exceptions reach the approver, so approval is a decision rather than a reflex.
Capabilities
What you can do
01
Punch data from attendance
Flowing from the gate rather than re-keyed — because a second version of the hours is a second version of the truth.
02
Cost-code and activity allocation
The step that makes hours into productivity data, and productivity data into disruption evidence.
03
Exception review before approval
Overtime anomalies, unallocated drift, identical punch pairs — surfaced first, so the approval is not forty reflexive clicks.
04
Jurisdictional overtime rules
UAE premiums and rest-day rules applied to the punch record, which is the evidence in any wage dispute.
05
Approval chain with a trail
Foreman submits, supervisor approves, and the record shows who approved what and when.
06
Earned-vs-burned feed
Allocated hours are the burned half of the productivity ratio — which is where a timecard stops being paperwork.
The workflow
How it actually runs
- 1
Take the punch data from attendance
Not re-keyed. A timesheet typed from a gate log is a second version of the truth, and second versions diverge.
- 2
Allocate hours to cost codes and activities
This is the step that turns payroll into productivity data — and unallocated hours are how a project loses the ability to prove what its crews actually achieved.
- 3
Review exceptions BEFORE approval
Overtime anomalies, unallocated drift, identical punch pairs. Surface them first, or the approval becomes forty clicks on a Friday afternoon.
- 4
Approve through the chain
Foreman submits, supervisor approves. And the supervisor is looking at a short list of exceptions rather than at everything, which is the only version of this that anyone actually does properly.
- 5
Feed payroll, the WPS file, and productivity
One set of hours, used three times — rather than three sets that will have to be reconciled by someone, later, under pressure.
AI that does the work
How AI changes Timecards management.
Unallocated-hours drift.
The slow rise in hours booked to no activity. It never announces itself, and it is the single clearest signal that the productivity data is quietly becoming worthless.
Overtime anomalies.
Against the jurisdiction’s rules and against the crew’s own history — surfaced before approval, which is the only point at which surfacing it changes anything.
The exception review, drafted.
A short list of the timesheets actually worth a human’s attention, so the supervisor is making a decision rather than clearing a queue.
The engineer’s judgment stays in charge; the AI removes the latency and the blind spots.
Best practices
- Allocate every hour to a cost code. Unallocated hours are not untidiness — they are the specific mechanism by which a project loses the ability to prove what its own crews achieved, and they will cost you a disruption claim and misprice your next bid.
- Surface exceptions before the approval, not after. Approval-by-habit is how ghost hours pass, and they pass with a real signature on them.
- Keep the digital punch record with its metadata. In a wage dispute, the employer effectively carries the burden of proving the hours — and an absent record is not neutral.
- Treat inflated burn as a productivity problem, not just a payroll one. Overstated hours make your crews look worse than they are, which understates your claim and quietly loses you the next tender.
Dashboards & reporting
Hours by worker, cost code and activity — which is the form in which they are evidence rather than merely payroll. Overtime by premium band against the jurisdiction’s rules. Unallocated-hours trend, which is the health check on your entire productivity dataset. Buddy-punch and exception patterns. And the burned side of earned-vs-burned, by trade and by zone, which is where the timecard finally pays for the trouble of collecting it.
Live dashboards
Drill-down & filters
Export to Excel / PDF
FAQ
Common questions
What is buddy punching, and what does it cost?
One worker clocking in for another who is not there. Estimates attributed to the American Payroll Association put time theft at around two per cent of gross payroll and suggest a large majority of businesses are affected — figures that circulate through secondary sources, so treat the order of magnitude rather than the decimal. Even so: two per cent of payroll on a thousand-worker site is a six-figure annual number that nobody budgeted and nobody will find.
Read the full answerHow is overtime calculated in the UAE?
Under Article 19 of the Labour Law, ordinary overtime carries a 25% premium; work between 22:00 and 04:00 carries 50%, alongside rest-day rules. And the practical point that matters more than the arithmetic: in a wage dispute the employer effectively carries the burden of proving the hours worked. The digital punch record is not tidiness. It is the evidence, and its absence is not neutral.
Read the full answerWhat is certified payroll?
Under the US Davis-Bacon Act, federal contractors submit payroll weekly on form WH-347 — as a sworn statement, with penalties for falsity. Whatever you think of the paperwork, notice what it establishes: a government has already decided that a timecard is a legal instrument rather than an administrative convenience. It is a reasonable benchmark for what disciplined looks like.
Read the full answerHow do timecards measure productivity?
They are the “burned” half of it. Earned hours come from installed quantities times your norms; burned hours come from the timecards. The ratio is the productivity measure — and it only works if hours are allocated to activities. Unallocated hours do not merely blur the picture; they inflate the denominator, which makes your crews look less productive than they were, understates your disruption claim, and misprices your next bid.
Read the full answerMust timesheets reconcile with the WPS salary file?
Yes — and with gate attendance. Mismatches between the three can raise a flag with the labour authorities, and the escalation is not a fine but a freeze on new work permits. A company that cannot issue permits cannot mobilise labour. It is a payroll records failure that arrives on the project as a schedule failure, with no construction cause and no construction remedy.
Read the full answerAre biometric punch records valid evidence?
A punch record with a timestamp, a device, and an audit trail is considerably better evidence than a paper sheet signed at the end of the week from memory — which is the realistic alternative. It is not magic, and it does not settle every dispute. But in a jurisdiction where the employer must prove the hours, a contemporaneous digital record is the difference between having an argument and having a document.
Sources
- ACFE — Report to the Nations 2024: median occupational fraud loss ACROSS ALL INDUSTRIES, and median time to detection. The construction-specific median ($250,000) is cited separately on /modules/three-way-matching/ — the two are a comparison, not a contradiction.
- Time-theft and buddy-punching estimates attributed to the American Payroll Association. These circulate through secondary sources and vendor material; we have not seen the primary study, and we attribute them loosely on purpose. The order of magnitude is the usable part.
- UAE Labour Law, Article 19 — overtime premiums, including the night-work band
- US Davis-Bacon Act — weekly certified payroll on form WH-347, submitted as a sworn statement
- AACE International — disruption analysis methods requiring contemporaneous, allocated hours
Related answers
Terms defined here
Zepth is the construction project delivery platform — it runs construction, procurement and asset management on one record, and does the work: reading the drawings, reviewing the submittals, matching the invoices and flagging the risks, with a human sign-off on anything consequential.
See it on your project.
A short, tailored walkthrough on your real workflow — no generic demo.