HR Audit
A systematic review of an organization's HR policies, procedures, documentation, and practices to identify compliance gaps, operational inefficiencies, and legal risks before they become regulatory violations or costly lawsuits.
What Is an HR Audit?
Key Takeaways
- ✓An HR audit is a structured examination of an organization's human resources policies, procedures, documents, and systems to evaluate legal compliance, identify risks, and find operational improvement opportunities.
- ✓68% of organizations that conduct HR audits discover significant compliance gaps they didn't know existed, including missing I-9 forms, outdated handbook policies, and FLSA classification errors (SHRM, 2023).
- ✓The average employment lawsuit costs $2.5 million in legal fees, settlements, and lost productivity. Most of these lawsuits target issues an HR audit would have caught: wage/hour violations, discrimination, harassment, and wrongful termination.
- ✓HR audits cover 12-16 functional areas: hiring/I-9 compliance, employee classification, wage/hour practices, benefits administration, safety/OSHA, leaves of absence, anti-discrimination, termination procedures, record retention, data privacy, and more.
- ✓Audits can be conducted internally by HR staff, externally by employment attorneys or HR consultants, or as a hybrid. External audits carry attorney-client privilege if conducted through legal counsel, protecting findings from discovery in litigation.
Think of an HR audit like a financial audit, but for your people operations. A financial audit catches accounting errors before the IRS does. An HR audit catches compliance gaps before the DOL, EEOC, OSHA, or a plaintiff's attorney does. The stakes are real. FLSA collective actions, discrimination class actions, I-9 penalties, and OSHA citations all hit harder when the employer can't show they had systems in place to prevent violations. An audit creates a documented record that the company takes compliance seriously. But an HR audit isn't just about avoiding lawsuits. It's about knowing whether your policies match your actual practices. Many organizations have beautifully written employee handbooks that nobody follows. Policies say one thing, managers do another, and the disconnect creates liability. The audit finds those gaps.
Types of HR Audits
Different audit types serve different purposes. Most organizations benefit from a full audit initially, followed by targeted audits based on risk areas.
| Audit Type | Scope | When to Use | Typical Duration |
|---|---|---|---|
| Full/Comprehensive audit | All HR functions: compliance, policies, practices, systems, documentation | First audit, after acquisition, new HR leadership, major regulatory changes | 4-12 weeks depending on org size |
| Compliance audit | Legal requirements only: FLSA, FMLA, ADA, Title VII, OSHA, I-9, ACA | Annual or when entering new jurisdictions | 2-6 weeks |
| I-9 audit | Immigration compliance: Form I-9 completeness, accuracy, retention, E-Verify | Annually (recommended), before ICE audit, after acquisition | 1-3 weeks |
| Classification audit | Exempt/non-exempt status, independent contractor relationships | After DOL threshold changes, class action risk assessment | 2-4 weeks |
| Compensation audit | Pay equity, FLSA compliance, benefits accuracy, payroll practices | Annually, after pay equity legislation, before public reporting | 3-6 weeks |
| Safety audit | OSHA compliance, workplace safety programs, injury records (OSHA 300 log) | Annually, after incidents, before OSHA-targeted inspections | 1-4 weeks |
| Policy/handbook audit | Review all written policies against current law and actual practices | Every 1-2 years, after state/federal law changes | 2-4 weeks |
| Best practices audit | Benchmarking HR practices against industry standards and leading practices | When upgrading HR operations, after rapid growth | 4-8 weeks |
Key Areas Examined in an HR Audit
A full HR audit typically covers these functional areas. Each one has specific documents to review, regulations to check, and red flags to identify.
Hiring and I-9 compliance
Review job postings for discriminatory language. Check that application forms don't ask prohibited questions (disability, religion, marital status, age). Verify consistent interview processes and documentation. Audit every Form I-9 for completeness: Section 1 signed on or before day one, Section 2 completed within 3 business days, acceptable documents properly recorded, reverifications completed on time. Common findings: 76% of I-9 forms contain at least one technical error, and many employers discover missing I-9s for current employees (SHRM, 2023).
Employee classification (FLSA)
Review every exempt position against the salary threshold and applicable duties test. Verify that 'exempt' employees actually perform exempt-level work as their primary duty. Check that non-exempt employees' hours are accurately tracked and overtime is properly calculated including non-discretionary bonuses in the regular rate. Review independent contractor relationships against IRS and state classification tests. Common findings: 30% of employers have at least one misclassified position (DOL estimate).
Wage and hour practices
Verify minimum wage compliance in all jurisdictions. Check overtime calculation methods (are non-discretionary bonuses included in the regular rate?). Review meal and rest break policies against state requirements. Audit time rounding practices for bias. Verify final pay compliance (many states require immediate payment upon termination). Check deduction practices: are exempt employees improperly docked? Are non-exempt employee deductions reducing pay below minimum wage?
Employee handbook and policies
Compare handbook policies against current federal, state, and local law. Check for required policies: sexual harassment (mandatory in many states), equal employment opportunity, anti-retaliation, FMLA (if 50+ employees), ADA accommodation procedures, and drug/alcohol policies. Verify at-will employment disclaimers and acknowledgment signatures. Remove outdated policies that create implied contract claims. Ensure handbook language doesn't inadvertently waive employee NLRA rights.
Benefits compliance
Verify ACA compliance for applicable large employers: coverage offers, affordability testing, 1094-C/1095-C accuracy. Review COBRA administration: are qualifying event notices sent within 14 days? Is the 60-day election period properly administered? Check ERISA compliance for retirement plans: Summary Plan Descriptions distributed, annual Form 5500 filed, fiduciary responsibilities documented. Audit FMLA administration: eligibility determinations, medical certifications, designation notices, reinstatement practices.
Safety and OSHA compliance
Review OSHA 300 log for accuracy and completeness. Verify required OSHA postings. Check training records for required safety programs. Audit first-aid and emergency response procedures. Review workers' compensation claims management process. For applicable industries, verify compliance with industry-specific OSHA standards (construction, healthcare, manufacturing).
How to Conduct an HR Audit: Step-by-Step
A structured audit process produces consistent, actionable results. Here's the recommended approach.
- Step 1: Define scope and objectives. Decide whether this is a full audit or targeted review. Identify the functional areas, employee populations, and locations covered.
- Step 2: Assemble the audit team. For internal audits, include senior HR staff, payroll, and legal counsel. For external audits, engage an employment attorney (to establish attorney-client privilege) or an HR consulting firm.
- Step 3: Gather documents. Collect the employee handbook, policy manuals, I-9 forms, personnel files, job descriptions, offer letter templates, termination checklists, training records, OSHA logs, benefits plan documents, and payroll records.
- Step 4: Create audit checklists. Develop detailed checklists for each functional area using current federal, state, and local requirements as the baseline.
- Step 5: Conduct the review. Compare policies against legal requirements. Compare actual practices against written policies. Interview managers and HR staff about how processes actually work (not how they're documented).
- Step 6: Identify gaps and assess risk. Categorize findings by risk level: critical (immediate legal exposure), high (likely to become a problem), medium (non-compliant but lower risk), and low (best practice improvements).
- Step 7: Create a remediation plan. Assign owners, deadlines, and priorities to each finding. Critical items get immediate attention. Schedule follow-up reviews to verify corrections.
- Step 8: Document everything. The audit report should detail the scope, methodology, findings, risk assessments, and remediation actions. This documentation demonstrates good faith compliance efforts if enforcement actions occur.
Most Common HR Audit Findings
These are the compliance gaps found most frequently during HR audits, based on practitioner surveys and enforcement data.
| Finding | Frequency | Risk Level | Typical Resolution |
|---|---|---|---|
| Incomplete or missing I-9 forms | Found in 76% of audits | High | Complete missing forms; correct errors using proper procedures (line through, initial, date) |
| Outdated employee handbook | Found in 65% of audits | Medium-High | Update to reflect current federal, state, and local law; redistribute with new acknowledgments |
| FLSA exempt misclassification | Found in 30% of audits | Critical | Reclassify affected positions; calculate and pay back overtime if applicable |
| Inconsistent job descriptions | Found in 60% of audits | Medium | Update descriptions to match actual duties; align with ADA essential functions analysis |
| Missing harassment training records | Found in 55% of audits | High (in mandatory states) | Implement training and tracking system; comply with state-specific requirements |
| Improper overtime calculations | Found in 40% of audits | Critical | Recalculate including non-discretionary bonuses; pay back wages if owed |
| Personnel file access non-compliance | Found in 35% of audits | Medium | Implement state-specific file access procedures; separate confidential records |
| COBRA administration gaps | Found in 45% of audits | High | Review qualifying event tracking; verify notification timelines; audit election periods |
Internal vs External HR Audits
Each approach has advantages. Many organizations use a combination for maximum effectiveness.
| Factor | Internal Audit | External Audit |
|---|---|---|
| Cost | Lower (staff time only) | Higher ($5,000-$50,000+ depending on scope and org size) |
| Objectivity | May miss issues due to proximity or organizational politics | Independent perspective catches blind spots |
| Attorney-client privilege | Not privileged unless counsel directs it | Privileged when conducted under attorney direction (protects findings from litigation discovery) |
| Organizational knowledge | Deep understanding of culture, history, and informal practices | Must learn the organization; may miss context-dependent issues |
| Expertise | Depends on HR team's compliance knowledge | Specialized expertise across employment law areas |
| Follow-through | Team is in place to implement changes | May require additional engagement for remediation |
| Credibility | Good for ongoing monitoring | Greater weight with boards, executives, and regulators |
| Recommended use | Annual ongoing reviews, quarterly I-9/payroll checks | First audit, post-acquisition, response to enforcement actions, periodic deep dives |
HR Audit Quick-Start Checklist
Use this checklist as a starting point for your next HR audit. Each item represents a common compliance requirement.
- I-9 forms: Complete for all active employees? Section 2 completed within 3 days? Reverifications current? Proper retention for terminated employees?
- Employee handbook: Updated within the past 12 months? Reflects current state and local law? Written acknowledgments on file for all employees?
- Job descriptions: Current for all positions? Include essential functions (ADA)? Match the duties test for exempt classifications?
- FLSA classification: Every exempt position meets salary threshold AND duties test? Non-exempt employees' overtime properly calculated? No off-the-clock work?
- Harassment prevention: Training completed for all employees (and managers, where required)? Complaint procedures clearly communicated? Investigation process documented?
- Personnel files: Organized and accessible within state-required timeframes? Medical records separated from general files (ADA)? Background check documents separated (FCRA)?
- Benefits: ACA 1094-C/1095-C filed accurately? COBRA notices sent timely? ERISA SPDs distributed? FMLA eligibility tracked?
- Safety: OSHA 300 log current? Required postings displayed? Safety training documented? Incident investigation procedures in place?
- Payroll: Minimum wage compliant in all jurisdictions? Overtime calculated correctly (including bonuses in regular rate)? Final pay procedures meet state deadlines?
- Termination: Consistent documentation? Exit interviews conducted? Final pay issued per state law? Benefits continuation (COBRA) initiated? I-9 retention schedule followed?
HR Audit and Compliance Statistics [2026]
Data showing the importance and impact of regular HR audits.
Frequently Asked Questions
How often should an HR audit be conducted?
Does an HR audit create legal risk by documenting problems?
What happens if an HR audit finds serious violations?
Can HR conduct an effective audit without legal counsel?
How much does an external HR audit cost?
Should employees know an HR audit is happening?
Written by Adithyan RK