HR Audit

What an HR audit covers

Most HR audits fall into one of four types, and it helps to decide which one you are running before you start pulling files:

• Compliance audit. Are we meeting legal requirements? Form I-9, FLSA classification and overtime, required posters and notices, leave administration, record retention, EEO reporting, state-specific rules.
• Best-practice audit. Do our practices match what well-run HR teams do? Onboarding, performance reviews, documentation of discipline, interview structure.
• Function-specific audit. A deep look at one area, such as payroll, benefits, recruiting or training records.
• Strategic audit. Does HR support the business plan? Headcount, skills, succession, HR staffing and technology.

In practice, a compliance audit is where most organizations start, because the findings carry real cost. A single audit usually checks a sample rather than every record: for example 25 to 50 personnel files per site, chosen across departments, tenure bands and employment types. The glossary entry on HR compliance covers the wider set of obligations an audit tests against.

How to run an HR compliance audit

1. Set scope. Name the locations, entities, employee groups and time period. A multi-state employer needs the state rules for each location in the checklist.
2. Build the checklist. List each requirement and the evidence that proves it, such as "signed Form I-9 completed within 3 business days of start, Section 2 by employer".
3. Pick the sample and gather documents. Personnel files, I-9s (stored separately), timesheets, payroll registers, job descriptions, policies, handbook acknowledgments, training records, leave files, applicant records.
4. Interview managers and HR staff. Many problems sit in how things are done, not in the documents. Ask how overtime gets approved or how a leave request is handled.
5. Rate findings by risk. High: exposure to fines, back pay or lawsuits (misclassified employees, missing I-9s). Medium: process gaps. Low: housekeeping.
6. Fix and re-test. Assign owners and dates, then re-check a fresh sample three to six months later.

Many employers run the audit under the direction of employment counsel so that findings may be covered by attorney-client privilege. Whether that protection applies depends on how the audit is set up, so ask counsel before you begin, not after you find a problem.

Findings that come up again and again

• Form I-9 errors. Missing Section 2 signatures, late completion, expired documents not reverified, and I-9s kept inside the personnel file instead of separately. See the glossary entry on Form I-9 for the rules, and use the I-9 checklist when you correct them. Paperwork violations carry civil fines per form.
• Misclassification. Salaried employees treated as exempt who fail the duties test, and contractors who look like employees.
• Off-the-clock work. Hourly staff answering messages after shift, pre-shift system logins, automatic meal deductions when no break was taken.
• Personnel files with the wrong contents. Medical information that belongs in a separate confidential file under the ADA, or missing signed acknowledgments. A personnel file should hold employment records only; our employee file checklist lists what goes where.
• Outdated policies. Handbooks that predate state paid sick leave, pay transparency or new leave laws.
• Inconsistent discipline. Similar conduct handled differently by different managers, which is often the starting point for a discrimination claim.

HR audits for high-volume and multi-site employers

When you hire thousands of hourly workers a year across many sites, the risk shifts from individual files to process. A missed I-9 step at one site, repeated for every new hire for a year, becomes hundreds of violations. Audit the process first: how a new hire's paperwork is collected, who completes Section 2, how remote hires are verified, how timekeeping handles early clock-ins.

Sample by site and by month of hire, because errors cluster around peak hiring periods when temporary coordinators are filling in. Contact centers and staffing firms should also audit records for workers placed through agencies, since joint-employer exposure can make their compliance gaps yours.

How often to audit

A common pattern is a full compliance audit every one to two years, with smaller targeted audits each quarter on the highest-risk area, such as I-9s or overtime. Run an extra audit after an acquisition, a new state of operation, a big hiring ramp, a change of HRIS or payroll provider, or a government inquiry. Rules vary by state and country, so update the checklist each time rather than reusing last year's version.