The empty cell was read as an instruction.

Somebody at the City of Austin was updating job descriptions in a spreadsheet. On one row, a field that was not required got left blank. The spreadsheet went up into Workday, the city’s payroll system, the way such spreadsheets go up every month.

The blank field happened to be the one that marks an employee exempt or non-exempt. Workday replaced the existing value with the blank. With the marker gone, the system had no consistent way to apply overtime, so it treated each week of the two-week period on its own terms and paid accordingly.

On March 13, 675 employees got their checks. Some were close to double. The total overrun was about $1.4 million, spread across a little under 4 percent of the city’s 17,000 workers.

The city caught it the day before the money landed and emailed everyone that the checks would be wrong and the money would have to come back. On March 26, HR told employees the recovery would run through payroll deductions over four pay periods, with a check option for anyone over $5,000. On April 6, shortly before 5 p.m., employees got a repayment agreement to sign by April 10, with language about resolving the dispute and avoiding a contested lawsuit.

Ten percent of them, 67 people, did not sign by the deadline. Some had asked how much would come out of each check and what it did to their taxes, and could not get an answer in time. “They’re asking me to sign a legally binding agreement, so I want to make sure it’s right,” one employee told Austin Current.

Carol Guthrie, business manager for AFSCME Local 1624, put the city’s handling of it plainly: “This was handled very poorly. Very poorly.”

The mechanism is worth slowing down on. Nobody deleted anything. Nobody typed a wrong number. A person looked at a cell they were not required to fill, left it alone, and understood that decision the way any of us would understand it: I am not changing this field. The system read the same cell and understood it as an authoritative value. Empty. Overwrite what is there.

Two readings of the same blank, opposite in meaning, and the second one was the one that could move money.

Your shop has this. The spreadsheet you export from one system, clean up, and re-import into another. The customer list you pull from the CRM, hand to somebody to update phone numbers, and load back. The price file you send the distributor. The inventory count you upload after a physical. Every one of those is a routine you have run enough times that you no longer think of it as a write to a database, which is exactly what it is.

Ask what your import does with a column that isn’t there, or a cell that’s empty. Some systems skip nulls and leave the existing value alone. Some take the null as the new truth. The behavior is a setting, usually buried, and almost nobody checks it until a batch of records goes quiet.

The cheap version of the test is to do it on purpose. Pick one record you know well. Blank out a field in the file, leave the rest as is, run the import into a sandbox or on a slow afternoon when you can watch, then open the record and see what survived. That is fifteen minutes, and it tells you which of the two readings your system holds.

The second control is the one Austin’s story argues for hardest, because the import worked exactly as designed and the pay was still wrong. Before the run goes final, look at the output rather than the input. Any employee whose pay moved more than some percentage from last period, any record whose classification changed with no paperwork behind it, any line that doesn’t match what it was. A short exception list, read by a person, catches the thing the file will never flag, because the file has no opinion about whether the result is sane.

Notice, too, where the cost of a silent overwrite lands. The city’s money went out and had to be pulled back from the paychecks of people who did nothing wrong, over four pay periods, under a signature deadline, with a mention of lawsuits. The clerical error took a moment. The recovery took months and cost the city something harder to book than $1.4 million.

So: which of your routine updates, the bulk import, the re-upload, the synced spreadsheet, silently overwrites the fields you left blank, and have you ever confirmed the system reads an empty cell as leave alone rather than erase?

← More observations