HR Audit Checklist: What an HR Compliance Audit Covers for a Growing Employer

Most growing companies don't decide to have HR problems. They add people faster than they add process, and the gaps pile up quietly: an offer letter template from three years ago, a few roles paid salary without anyone checking the overtime rules, I-9s in a drawer, a handbook nobody has opened since it was written. An HR audit is a structured look at those practices against the rules that apply to your company, so you can fix the highest-risk gaps first.

This guide walks through the areas a thorough HR compliance audit covers and the federal rules behind each one. It is general information, not legal advice. Federal rules are summarized as of November 2026; state and local laws often add requirements, so confirm the details with the agencies named here or with your employment attorney.

Start with your headcount

Many federal employment laws apply only once an employer reaches a certain size, so an audit begins by counting employees correctly, including part-time staff and, for some laws, employees in every location. For example, the Americans with Disabilities Act and Title VII apply at 15 employees (EEOC), the Age Discrimination in Employment Act at 20 (EEOC), the Family and Medical Leave Act at 50 (Department of Labor), and the Affordable Care Act's employer shared responsibility rules at 50 full-time employees including full-time equivalents (IRS). We cover the full list in federal employment laws by company size.

1. Classification

Start here: classification errors create ongoing wage liability.

• Exempt vs. non-exempt. Under the Fair Labor Standards Act (FLSA), a salaried employee is exempt from overtime only if the job meets the salary level, salary basis and duties tests (DOL Wage and Hour Division). Review every salaried role against all three.
• Employee vs. independent contractor. The IRS uses a common-law test of behavioral control, financial control and the relationship of the parties. The Department of Labor uses its own test under the FLSA, and that test has changed more than once. In 2026 the DOL proposed replacing its 2024 rule, so check the Wage and Hour Division's rulemaking page for the rule in effect when you audit. List everyone you pay on a 1099 and ask whether the work they do looks like employment.

2. Hiring records and Form I-9

• Form I-9. Every employee hired after November 6, 1986 needs a completed Form I-9 (USCIS). Check that Section 1 was done by the first day of work and Section 2 within three business days, that you are using the current edition of the form, and that you keep each form for three years after hire or one year after employment ends, whichever is later.
• Offer letters and applications. Look for at-will language that matches your handbook, questions that should not be asked, and promises you didn't intend to make.

3. Payroll and timekeeping records

The FLSA requires employers to keep payroll records for at least three years and the time cards and wage-rate tables behind them for two years (29 CFR 516.5 and 516.6). An audit checks that non-exempt employees record all hours worked, including pre-shift tasks and after-hours messages, that overtime is calculated on the regular rate (including non-discretionary bonuses), and that deductions from pay are allowed. Indiana employers should also review the state's wage payment rules with the Indiana Department of Labor.

4. Personnel files and record retention

EEOC regulations require employers to keep personnel and employment records, including applications and records about hiring, promotion and termination, for one year from the date the record was made or the action taken, whichever is later (29 CFR 1602.14). Longer periods often apply under other laws and once a charge is filed. Medical information, including accommodation requests and FMLA certifications, must be kept confidential and separate from the general personnel file (EEOC; DOL).

5. Required notices and posters

Federal laws require specific workplace notices, and many states add their own. The Department of Labor's online poster advisor helps identify which federal posters apply. Indiana employers can find state posters through the Indiana Department of Labor; for other Indiana-specific items, see our Indiana HR compliance checklist. For remote employees, check how you deliver notices electronically.

6. Handbook and written policies

Read the handbook as an employee would, then as an agency would. Does it describe the leave, pay and discipline practices you actually follow? Does it include an anti-harassment policy with more than one way to report a complaint? Whether an employer had a working complaint process matters when harassment claims under Title VII are judged; see the EEOC's current harassment resources at eeoc.gov. Has it been updated for laws that took effect since it was written? Also review confidentiality, social media and conduct rules: the National Labor Relations Board applies the National Labor Relations Act to non-union workplaces too, and its standard for judging work rules has changed over time, so check nlrb.gov for the current approach.

7. Leave and accommodation

• FMLA covers private employers with 50 or more employees in 20 or more workweeks; an employee is eligible only if the employer has 50 employees within 75 miles of their worksite, among other conditions. Covered employers must give specific notices and use specific forms (DOL).
• ADA accommodation. Employers with 15 or more employees must engage in an interactive process when an employee asks for a change at work for a medical reason (EEOC). Check whether managers know how to recognize a request.
• Pregnancy. The Pregnant Workers Fairness Act, enforced by the EEOC, requires reasonable accommodations for known limitations related to pregnancy and childbirth at employers with 15 or more employees.
• State and local leave laws vary widely; list every state where you have employees.

8. Benefits

Check that eligibility rules in your plan documents match what employees are told and what payroll does. For employers at the ACA's 50-employee threshold, confirm offers of coverage and annual reporting on Forms 1094-C and 1095-C (IRS). Confirm that COBRA notices go out when coverage ends (DOL), and check whether your state has a separate continuation law for smaller employers.

9. Safety

Most employers with more than ten employees must keep OSHA injury and illness records on Forms 300, 300A and 301 unless their industry is partially exempt, and must post the annual summary (Form 300A) from February 1 to April 30 (OSHA). Check that you know how to report a severe injury to OSHA within the required time, and that you have the written programs your industry requires.

10. Managers and documentation

Policies only work if managers follow them. An audit samples recent terminations, write-ups and complaints: was the reason documented at the time, was the policy applied consistently, and did someone with HR judgment review it? Inconsistent treatment is often the root of a discrimination charge filed with the EEOC or the Indiana Civil Rights Commission.

Self-audit or outside audit?

A self-audit with this checklist is a good start, especially for a company under 25 people. An outside review adds a second set of eyes and the experience of having seen how other employers get it wrong. Some employers ask their employment attorney to direct an audit so that findings may be protected by attorney-client privilege; ask your attorney whether that makes sense for you.

Whichever route you take, rank what you find. Fix anything that creates ongoing wage liability or affects employees right now (classification, overtime, I-9s) before cosmetic policy edits.

How Signent HR helps

At Signent HR, a paid HR audit comes before ongoing service work. We confirm the audit scope around the priorities we agree on, and the findings and recommendations are yours to use. Read how it fits into our approach, or see the services that can follow. To talk through where your company stands, schedule a discovery call. Current clients can reach us through the client portal.