HR Compliance Audit: A Step-by-Step Checklist for Small Businesses
Table of Contents
An HR compliance audit is a structured check of whether your hiring, pay, leave, policies and records meet the employment laws that apply to your business. For a small business, it is less about building an audit department and more about working through a clear list once a year, and again whenever something changes, such as passing a headcount threshold or hiring in a new state.
This guide gives you that list. It covers which US federal laws apply at your headcount, a five-step audit process, a checklist across eight areas, how long to keep key records, and how to prioritise what you find. There is a short note for UK employers near the end, and a free printable version of the checklist you can download.
This article is general information, not legal advice. Employment law changes and varies by state and country. Check the linked official sources and speak to an employment lawyer or HR adviser about your specific situation.
What is an HR compliance audit?
An HR compliance audit (also called an HR audit or human resources audit) is a review of your people practices and records against legal requirements. It answers three questions:
- Which laws apply to us? This depends mainly on headcount, location and whether you have government contracts.
- Are we doing what those laws require? For example, completing Form I-9 for every hire, paying overtime correctly, and offering leave where required.
- Can we prove it? Most compliance problems surface when an employer cannot produce the right record, so the audit checks documents as well as practices.
A compliance audit is narrower than a "best-practice" HR review. It does not judge whether your culture or benefits are competitive; it checks whether you meet your legal obligations and keep the evidence.
Compliance gaps can be expensive. In fiscal year 2025, the US Department of Labor's Wage and Hour Division recovered more than $259 million in back wages for 176,957 workers. Many wage and hour problems, such as misclassified employees or unpaid overtime, are the kind of issue a routine audit is designed to catch early.
When to run an HR compliance audit
There is no single federal rule that sets how often a small business must audit its HR practices. Common practice is to do a full review once a year and a targeted review whenever one of these triggers happens:
- You cross a headcount threshold. Several federal laws start applying at 15, 20, 50 and 100 employees (see the table below). State thresholds are often lower.
- You hire in a new state or country. Minimum wage, paid leave, final pay and posting rules differ by location.
- You hire your first employee, or switch from contractors to employees. Classification and onboarding paperwork need to be right from day one.
- You receive a complaint, claim or agency inquiry. A wage claim, discrimination charge or OSHA inquiry is a signal to review the whole area, not just the single case.
- You acquire a business or merge teams. You inherit the other company's records and practices, including any gaps.
- You change payroll provider, HR system or handbook. Migrations are a good time to check that records are complete and policies are current.
- Annual review. Many small businesses pick a fixed month, such as before benefits renewal or at year end, so the audit becomes routine.
Which federal laws apply at your headcount
This table summarises common federal thresholds for private employers. Each law counts employees in its own way (for example, over a number of weeks or as an average for the prior year), so use the linked official page to confirm how your business is counted. State and local laws may apply at lower headcounts.
Law or requirement | Applies to private employers with | What it covers | Official source |
|---|---|---|---|
Fair Labor Standards Act (FLSA) | Most employers, regardless of size | Minimum wage, overtime, recordkeeping, youth employment | |
Form I-9 employment eligibility | Every employer that hires | Verifying identity and work authorisation of each new hire | |
Equal Pay Act | 1 or more employees | Equal pay for equal work regardless of sex | |
OSHA serious-injury reporting | All employers, including those exempt from routine recordkeeping | Reporting fatalities, in-patient hospitalisations, amputations and eye losses | |
OSHA injury and illness records (300 log) | More than 10 employees at any time in the last calendar year (some low-hazard industries are partially exempt) | Recording work-related injuries and illnesses | |
Title VII, ADA, GINA | 15 or more employees | Discrimination based on race, colour, religion, sex (including pregnancy), national origin, disability and genetic information | |
Age Discrimination in Employment Act (ADEA) | 20 or more employees | Discrimination against workers aged 40 and over | |
COBRA continuation coverage | 20 or more employees in the prior year (with a group health plan) | Offering continued health coverage after qualifying events | |
Family and Medical Leave Act (FMLA) | 50 or more employees in 20 or more workweeks in the current or previous calendar year | Up to 12 weeks of job-protected leave for eligible employees | |
ACA employer shared responsibility | 50 or more full-time employees, including full-time equivalents, on average in the prior year | Offering affordable health coverage and related IRS reporting | |
EEO-1 Component 1 report | 100 or more employees (50 or more for certain federal contractors) | Annual workforce demographic report to the EEOC | |
WARN Act | 100 or more employees | At least 60 calendar days' written notice of qualifying plant closings and mass layoffs |
Two practical notes. First, FMLA coverage and FMLA eligibility are different: even at a covered employer, an employee generally needs 12 months of service, 1,250 hours in the past 12 months and to work at a location with 50 or more employees within 75 miles (DOL WHD). Second, if you are close to a threshold, record your headcount each month so you can see when a new law starts to apply.
How to run an HR compliance audit in 5 steps
1. Set the scope
Decide whether this is a full audit or a targeted one (for example, wage and hour only). List your locations, headcount by location, and employee types (full-time, part-time, seasonal, contractors). Use the headcount table above to list the laws that apply.
2. Gather documents and data
Pull together what an investigator would ask for: the employee handbook and policies, job descriptions, offer letters, Form I-9s, payroll registers, timesheets, leave records, benefits documents, training records, required posters, and any complaints or incident reports from the past year.
3. Work through the checklist
Go area by area using the checklist below. For each item, mark it as compliant, not compliant, or not applicable, and note the evidence you looked at. Sampling is fine for a small business: for example, check every I-9 if you have 20 employees, or a sample of files if you have 100.
4. Record and prioritise findings
Write each gap down with the law it relates to, the people affected, and a suggested fix. Then rank findings by legal exposure (see "How to prioritise findings" below).
5. Fix, document and schedule the next review
Assign an owner and a due date to each fix. Keep a short audit report that shows what you checked, what you found and what you changed. Set the date of the next review, and add any trigger events to your calendar.
Who should do it? In a small business, the audit is usually run by whoever owns HR, often the founder, an office manager or an HR generalist, with an employment lawyer or external HR consultant reviewing high-risk findings. If you want the findings to be covered by legal privilege, ask an attorney to direct the audit.
The HR compliance audit checklist
Work through each area below. Download the free printable HR compliance audit checklist (PDF) if you prefer to tick items off on paper.
1. Hiring and Form I-9
- ☐ Job ads and descriptions avoid language that excludes protected groups (for example, age or gender preferences)
- ☐ Interview questions are job-related and do not ask about protected characteristics
- ☐ Background and credit checks follow the required consent and notice steps
- ☐ Offer letters state pay, pay frequency, classification and at-will status where applicable
- ☐ A Form I-9 is completed for every employee hired, with Section 1 by the employee's first day and Section 2 within the required time
- ☐ I-9s are stored separately from personnel files and are kept for the required period
- ☐ New-hire reporting to your state is done on time
2. Classification and wage-hour
- ☐ Each worker is correctly classified as an employee or independent contractor
- ☐ Each employee is correctly classified as exempt or non-exempt, based on duties and salary, not job title
- ☐ Non-exempt employees are paid at least the federal, state or local minimum wage, whichever is highest
- ☐ Overtime is paid at 1.5 times the regular rate for hours over 40 in a workweek (and under any state daily overtime rules)
- ☐ Bonuses and commissions are included in the regular rate where required
- ☐ Meal and rest break rules for your state are followed
- ☐ Time records are accurate, and off-the-clock work is not allowed
3. Payroll and tax records
- ☐ Payroll registers show hours, rates, gross pay, deductions and net pay for each pay period
- ☐ Employees are paid on time and on the schedule your state requires
- ☐ Federal, state and local taxes are withheld and deposited on time
- ☐ Form W-4 and state withholding forms are on file for each employee
- ☐ Year-end forms (W-2, 1099-NEC) are issued and filed by the deadlines
- ☐ Deductions from pay are authorised and do not take pay below minimum wage
- ☐ Final pay is issued within your state's deadline
For a deeper payroll review, see our payroll audit guide.
4. Leave and benefits
- ☐ You know which leave laws apply (FMLA at 50+ employees, plus any state or local paid sick or family leave)
- ☐ Leave policies are written down and match the law in each location
- ☐ Leave requests, approvals and balances are recorded
- ☐ Required notices (for example, FMLA eligibility and rights notices) are given on time
- ☐ Employees on protected leave are reinstated as required
- ☐ COBRA notices are sent if you have 20+ employees and a group health plan
- ☐ If you are an applicable large employer under the ACA, coverage offers and IRS reporting are in place
- ☐ Benefits eligibility rules are applied consistently
5. Policies and handbook
- ☐ The employee handbook has been reviewed in the last 12 months
- ☐ Handbook policies match current federal, state and local law in each location
- ☐ Each employee has signed an acknowledgement of the current handbook
- ☐ Required federal and state workplace posters are displayed, and shared digitally for remote staff where allowed
- ☐ Discipline and termination procedures are written and applied consistently
- ☐ Remote work, expense reimbursement and equipment policies are documented
6. Anti-discrimination and harassment
- ☐ A written anti-discrimination and anti-harassment policy exists, with more than one way to report a concern
- ☐ Managers and staff have received harassment-prevention training where your state requires it
- ☐ Complaints are investigated promptly, documented and closed with a written outcome
- ☐ There is a clear anti-retaliation policy
- ☐ Reasonable accommodation requests (disability, pregnancy, religion) are handled and documented
- ☐ Pay is reviewed for unexplained differences between employees doing equal work
- ☐ Hiring, promotion and termination decisions are documented with job-related reasons
7. Health and safety
- ☐ Workplace hazards have been identified and addressed
- ☐ Required safety training is delivered and recorded
- ☐ If you had more than 10 employees during the last calendar year and are not in an exempt industry, OSHA 300, 300A and 301 records are kept
- ☐ The OSHA 300A summary is posted each year when required
- ☐ Serious injuries are reported to OSHA within the required time
- ☐ Workers' compensation coverage is in place in every state where you have employees
- ☐ Emergency procedures and first aid arrangements are documented
8. Records and privacy
- ☐ Each employee has a complete personnel file (offer letter, job description, reviews, discipline, training)
- ☐ Medical records are kept separately and confidentially from personnel files
- ☐ Records are kept for at least the federal retention periods (see table below) and any longer state periods
- ☐ Access to employee data is limited to people who need it
- ☐ Sensitive data (Social Security numbers, bank details, medical information) is stored securely
- ☐ Old records are destroyed securely when retention periods end and no claim is pending
- ☐ Former employees' records are retained, not deleted, when they leave
For more on keeping files organised, see our guide to employee record management systems.
Federal record retention periods
These are minimum federal periods for common HR records. States may require longer periods, and records connected to a charge, lawsuit or investigation should be kept until it is fully resolved.
Record | Minimum federal retention | Official source |
|---|---|---|
Form I-9 | 3 years after the date of hire, or 1 year after employment ends, whichever is later | |
FLSA payroll records | At least 3 years | |
FLSA wage computation records (time cards, wage rate tables, work schedules) | 2 years | |
Personnel and employment records (EEOC) | 1 year; for an involuntary termination, 1 year from the date of termination | |
Payroll records under the ADEA | 3 years | |
OSHA 300 log, 300A summary, 301 incident reports | 5 years following the end of the calendar year the records cover | |
Employment tax records | At least 4 years after filing the fourth-quarter return for the year |
A simple approach many small businesses use is to keep each record for the longest period that applies to it, and to note the "destroy after" date when the record is created.
How to prioritise findings
An audit usually produces more fixes than you can do at once. Ranking them by legal exposure keeps the work manageable.
Priority | What it looks like | Examples | When to act |
|---|---|---|---|
High | Ongoing legal violation, money owed to employees, or a problem that grows each pay period | Misclassified non-exempt staff, unpaid overtime, missing I-9s, pay below minimum wage, no harassment complaint process | Immediately; consider getting legal advice before correcting back pay |
Medium | Gap that creates risk but no current violation or loss | Outdated handbook, missing signed acknowledgements, inconsistent leave records, posters out of date | Within the next quarter |
Low | Process or documentation improvement | Inconsistent file naming, informal approval steps, missing destroy-after dates | Next scheduled review |
Fix the root cause, not just the instance. If one employee was misclassified, check every employee in the same role.
A short note for UK employers
The checklist structure above works in the UK too, but the laws are different. Areas to check include:
- Right to work. You must check that a job applicant is allowed to work in the UK before you employ them, and keep copies of documents for the length of employment and two years after it ends (GOV.UK: Check a job applicant's right to work).
- Working time. Workers cannot work more than 48 hours a week on average unless they opt out (GOV.UK: Maximum weekly working hours).
- Payslips. Employees and workers must receive a payslip on or before payday (GOV.UK: Payslips).
- Payroll records. Keep PAYE records for 3 years from the end of the tax year they relate to (GOV.UK: PAYE record keeping).
How HR software helps with an HR compliance audit
Software does not make a business compliant on its own, but it makes the "can we prove it?" part of an audit much easier. The most useful things are a single place for employee records, consistent leave and time data, and payroll history you can pull for any period.
Here is what Payrun covers today, based on its pricing and features pages:
- Employee profiles and files. Store personal and employment details for each employee, and upload contracts, IDs and certificates to their file.
- Leave management. Leave requests and approvals, a leave calendar, holidays and off days, and standard or custom leave policies.
- Attendance and timesheets. Time tracking, attendance approval, and timesheets that record hours worked before payroll is processed.
- Payroll (Pro and Ultimate plans). Calculates salaries and deductions, generates payroll, and gives employees access to payslips.
What Payrun does not do: it does not file payroll taxes for you, so tax deposits and filings still need to be handled by you, your accountant or a tax filing service. It also does not provide legal advice or replace a review by an employment lawyer.
If you are comparing tools, our guide to HR compliance software covers what to look for. For payroll-specific checks, see the payroll audit guide. For organising personnel files, see employee record management systems, and for leave records, see best leave management software.
Download the free HR compliance audit checklist
The printable HR compliance audit checklist (PDF) includes all eight areas as tick-box lists, the federal headcount table and the record retention table. Print it, work through it with your team, and keep the completed copy with your audit notes.
This guide is general information, not legal advice. Requirements change and vary by state and country, so confirm current rules with the official sources linked above or an employment lawyer.
