Most employers don't realize how much liability sits inside their HR function until something goes wrong: a termination without documentation, an accommodation request mishandled, or a complaint that was never investigated. A structured HR compliance audit shows you the gaps before they become legal events.
Key takeaways
- An HR compliance audit reviews your records, pay practices, policies and procedures against current employment law to find exposure before it becomes a claim.
- The 10 areas to audit are personnel files, job descriptions and FLSA classification, HR SOPs, the employee handbook, wage and hour, ADA, FMLA, complaint handling, manager competency, and HR capacity.
- Wage and hour gaps are often the most expensive, because many employment practices liability insurance (EPLI) policies exclude them.
- Audit at least once a year, and again after rapid growth, expansion into a new state, or a change in HR staff.
What is an HR compliance audit?
An HR compliance audit is a structured review of a company's HR practices, including personnel files, job classifications, wage and hour records, ADA and FMLA administration, and complaint handling. Its purpose is to identify legal exposure before it results in a claim, an agency investigation or a lawsuit. A good audit compares what your policies say with what actually happens day to day, because most liability lives in the gap between the two.
HR Compliance Audit at Glance
| Audit area | What to review | Red flag |
|---|---|---|
| 1. Personnel files | I-9s, file structure, where medical records are kept | Medical information inside personnel files |
| 2. Job descriptions | Essential functions, physical requirements, exempt status | Descriptions that don't match the real job |
| 3. HR SOPs | Written workflows for hiring, complaints, leave, discipline | Processes that live only in someone's head |
| 4. Employee handbook | Required policies, notices, state addenda | Policies that managers don't actually follow |
| 5. Wage and hour | Timekeeping, breaks, travel time, overtime math | Off-the-clock work or auto-deducted meal breaks |
| 6. ADA accommodation | Interactive process, documentation, confidentiality | Managers who don't recognize a request |
| 7. FMLA and leave | Eligibility, notices, tracking, ADA coordination | Intermittent leave nobody is tracking |
| 8. Complaints and investigations | Intake, investigation quality, retaliation safeguards | Investigations that are only conversations |
| 9. Managers | Training gaps, documentation, discipline practices | Managers improvising on policy |
| 10. HR capacity | Bandwidth, expertise, support for managers | HR buried in administrative work |
The 10 areas every HR compliance audit should cover
1. Personnel files (your fastest indicator of HR maturity)
A random sample of personnel files tells you more about your HR infrastructure than almost anything else. Look for:
I-9 compliance. Missing, inaccurate or sloppy I-9s signal overworked or undertrained HR. See common I-9 mistakes.
Medical information inside personnel files. This is a clear sign HR is inexperienced with ADA and FMLA confidentiality and record-segregation rules. If HR misses this basic requirement, it is probably struggling with the more technical parts of compliance too.
Inconsistent file structure. If every file looks different, you don't have a standardized hiring or onboarding process, and if hiring is inconsistent, everything else usually is too.
Background check paperwork. Disclosure and authorization forms must meet strict Fair Credit Reporting Act (FCRA) rules.
Strong files are also your first line of defense in a dispute. Learn more about documentation that protects employers from lawsuits.
2. Job descriptions (accuracy and FLSA classification)
Job descriptions should be complete, accurate and aligned with the actual duties of the role. Evaluate whether they:
reflect essential functions accurately
include physical and mental requirements
match the job as it is done today, not an aspirational version of it
support the role's FLSA classification as exempt or non-exempt
Incomplete or outdated job descriptions create wage and hour exposure, ADA risk and performance-management problems. If they don't match reality, your FLSA classifications may not be defensible, which can lead to an agency audit and back overtime pay. See common overtime traps for employers and how job descriptions support organizational planning.
3. Written SOPs (or the absence of them)
If your organization doesn't have written standard operating procedures for HR processes, everyone is improvising, and improvising creates liability. You need SOPs for:
Hiring and onboarding, which keeps personnel files compliant from day one
Complaint handling and investigations, which improves retention and culture and reduces avoidable lawsuits
ADA and FMLA workflows
Disciplinary processes
Documentation standards
No SOPs means no consistency, and no consistency means no defensible decisions. Teams that rely on unwritten knowledge are especially exposed when a key person leaves. See HR risks growing companies ignore.
4. The employee handbook (policy vs. practice)
Your handbook should reflect current law and match what actually happens inside the company. Review:
ADA and accommodation policy
FMLA notice and policy
discrimination, harassment and retaliation policies
whistleblower policy
wage and hour policies
complaint reporting structure
multi-state addenda, if you have employees in more than one state
If your handbook is outdated, incomplete or not followed, every disciplinary action carries extra exposure. Employment law changes constantly, so review your handbook at least every 12 to 18 months. Start with these common employee handbook mistakes, and check that your policies don't conflict with NLRA rules, which apply even to non-union employers.
5. Wage and hour compliance
This is one of the most expensive areas of liability and one of the easiest for plaintiffs to win. Wage and hour claims are excluded from many EPLI policies, so back pay and penalties often come straight out of the employer's pocket. Evaluate:
- timekeeping practices and record storage
- off-the-clock work and why it happens
- meal and rest breaks, including auto-deducted lunch breaks
- travel time, training time, on-call time and after-hours meetings
- overtime calculations, including regular-rate traps with bonuses and shift differentials
- exempt vs. non-exempt classification
- multi-state and multi-site wage laws
Small inconsistencies repeated across a workforce can turn into class actions. If you operate in multiple states, wage and hour compliance needs dedicated attention.
6. ADA and medical accommodation practices
Most ADA liability arises because HR or a manager didn't recognize that an employee's indirect comments triggered the company's obligations, or because the process wasn't documented correctly. Our guide to early ADA triggers explains what to watch for. Review:
manager and supervisor training on ADA compliance
your accommodation request policy
handling of medical documentation
the interactive process
return-to-work decisions
confidentiality
accommodation denials, including undue hardship and direct threat analysis
pregnancy accommodations, which have their own rules
If medical documentation is scattered or stored incorrectly, your ADA process likely has other weak points. Browse our full ADA Compliance Series, or learn how our outsourced ADA compliance service takes this off your plate.
7. FMLA and leave administration
Leave administration looks simple, but it has strict deadlines, notice requirements and procedures that inexperienced HR staff often struggle with. Evaluate:
eligibility determinations
required notices
leave tracking
intermittent leave
communication with employees
coordination with the ADA
If intermittent leave is out of control, your leave system needs a rebuild. Our FMLA compliance framework lays out the structure. CHRO also offers FMLA compliance outsourcing.
8. Complaint handling and investigations
This is one of the highest-risk areas for employers. Managers and HR need to recognize when a complaint is protected activity so the company doesn't retaliate, and HR needs the experience to handle complex harassment and hostile work environment claims. You need to know:
how employees report complaints
whether HR recognizes what counts as a complaint
whether investigations are real investigations, with witness statements, evidence collection, and full statements from the person reporting and the person accused
whether findings are documented thoroughly
whether the company is creating retaliation risk
If your investigations are just conversations, they won't hold up when challenged. Many lawsuits allege that an employer received numerous complaints and did nothing. Learn the basics of workplace retaliation and what to do after receiving an EEOC charge. If your employees deal with the public, customer harassment belongs in this review too.
9. Manager competency and training needs
Managers often create risk without meaning to. Talk to them to understand:
what employee challenges they're facing
where they feel unsupported
which policies they don't understand
where they're improvising
where they avoid conflict
where documentation is missing
how they handle discipline
The answers tell you whether you need more training or new policies. If managers are improvising, you don't have a compliance system; you have unmanaged risk building quietly. See how weak managers cost you money. CHRO provides manager training and executive coaching as part of our Outsourced CHRO program.
10. HR capacity and structural debt
Finally, assess whether HR has:
the bandwidth to manage compliance
the experience to handle complex issues
the structure to support managers
the documentation discipline to defend discipline, terminations and other adverse employment actions
If HR is overwhelmed or undertrained, risk accumulates quietly until it surfaces as an agency investigation, a fine or an employment practices lawsuit. Read signs your business has outgrown its HR function. If you use AI tools in hiring or HR, review them as well.
Through our Outsourced CHRO program, we support your existing HR team with the infrastructure and SOPs to streamline administrative work and the expertise to handle complex compliance issues. Here's what an outsourced HR department actually does.
How to run an HR compliance audit
- Set the scope. Decide which of the 10 areas to cover, which locations and states are included, and who will see the findings.
- Pull a random sample. Review a sample of personnel files, timesheets and leave records, about 20 files for a company of 100 to 200 employees, rather than hand-picked ones.
- Compare policy with practice. Read the handbook and SOPs, then interview managers and HR about what actually happens.
- Rank findings by risk. Fix wage and hour, retaliation, and ADA and FMLA issues first; they carry the largest financial exposure.
- Fix, document and recheck. Correct the gaps, record what changed, and schedule a follow-up review within the year.
HR compliance audit FAQs
What is an HR compliance audit?
An HR compliance audit is a structured review of a company's HR practices, records and procedures to confirm they meet current federal, state and local employment law. It typically covers personnel files, wage and hour practices, job classifications, and ADA and FMLA administration. The goal is to find legal exposure before it surfaces as a claim, agency investigation or lawsuit.
How often should a company conduct an HR compliance audit?
Most employment law and HR compliance professionals recommend a full audit every year, with smaller spot checks when regulations change or the company grows significantly. Companies in multiple states should audit more often, because employment law varies by state and changes regularly.
What triggers the need for an HR compliance audit?
Common triggers include rapid headcount growth, expansion into new states, a change in leadership or HR staff, a recent complaint or termination dispute, and new employment legislation. Many companies also audit before a merger, acquisition or restructuring. Waiting for an incident usually means the audit comes too late to prevent the underlying problem.
What happens if a company fails an HR compliance audit?
A failed audit is not a legal event; it's a warning. The gaps it reveals, if left unaddressed, can lead to wage and hour claims, EEOC or ADA charges, wrongful termination suits or regulatory fines. Because some of these liabilities, like wage and hour class actions, often fall outside EPLI coverage, the cost can land directly on the company.
Can a mid-size company handle an HR compliance audit internally?
It depends on whether the company has HR staff with specific compliance expertise. General HR experience often isn't enough to catch issues in ADA documentation, FLSA classification or multi-state wage law, and internal teams can be too close to daily operations to see them. An outside HR compliance partner can provide a more objective review.
What records should an HR compliance audit review?
At minimum: personnel files, I-9 forms, job descriptions, time and payroll records, leave and accommodation files, complaint and investigation records, the employee handbook, and required workplace postings and notices.
Get an outside view of your HR compliance
A compliance audit isn't about paperwork. It shows whether your HR function can support the level of risk your organization carries, and what needs to be rebuilt before the next employee situation becomes a legal event.
Every gap on this list has a price tag: back pay, fines, settlements or a claim your insurance won't cover. Most mid-size companies don't have a dedicated compliance function to catch these before they escalate. We do. Complete our Workplace Diagnostic Questionnaire to book a free preliminary HR compliance review.
Related reading
Wage and hour
Hiring and records
ADA and FMLA
Can you terminate an employee who just returned from FMLA leave?
ADA and FMLA failure: how a cancer diagnosis exposed an HR breakdown
Complaints, retaliation and terminations
About CHRO, LLC
CHRO, LLC is an attorney-led fractional HR firm based in the Philadelphia suburbs. We help growing companies in Pennsylvania, New Jersey, Delaware, Maryland, New York and nationwide build the HR foundation they need as they cross each employee-count threshold: compliance audits, policies, manager training, employee relations and workplace investigations, without the cost of a full-time HR department.
Can employees legally share their pay with each other? In most cases, yes, and that's true whether or not there's a union. A federal appeals court recently upheld a finding that an employer illegally fired an engineer for organizing a pay-sharing effort among coworkers. Here's what employers can and can't do when employees disclose pay information to each other, and the steps to take next.