Why you audit yourself before someone else does it for you

Small businesses rarely have an HR compliance problem they know about. They have ones they discover — when a terminated employee files a claim, when the Department of Labor sends a letter, when a contractor gets reclassified, when a missing I-9 surfaces during an audit. By then the cheap fix is gone and you are dealing with penalties, back pay, or a lawsuit. An annual HR self-audit is the alternative: a scheduled, unglamorous morning once a year where you find your own gaps while they are still paperwork problems instead of legal ones.

You do not need an outside firm to run a basic one. You need a checklist, a couple of hours, and the honesty to write down what is actually missing. This guide walks the major sections. It is general guidance, not legal advice — if the audit surfaces something serious (systematic misclassification, a pattern of missing wage records), that is the moment to bring in counsel.

Section 1: Hiring and personnel files

Start where liability starts — the paperwork from before day one.

  • I-9s for every employee. Every worker hired needs a properly completed Form I-9, stored separately from the personnel file, retained for the required period (three years after hire or one year after termination, whichever is later). Missing or incomplete I-9s carry per-form penalties even when everyone is authorized to work. Verify your process against the I-9 and E-Verify guide.
  • Complete new-hire paperwork. W-4s, state withholding forms, signed offer letters, and handbook acknowledgments — spot-check files against your new-hire paperwork checklist for gaps.
  • State new-hire reporting. Confirm you actually reported each new hire to your state directory within the required window; it is easy to skip and easy to prove you missed. See state new-hire reporting requirements.
  • File hygiene and access. Personnel files, medical/ADA files, and I-9s should be three separate, access-controlled stores. Medical information commingled into a general file is its own violation.

Section 2: Worker classification

This is the section that produces the biggest surprises and the biggest bills.

  • Employee vs. independent contractor. Review every 1099 worker against the actual control and economic-reality tests, not your intent. Misclassification means back taxes, back overtime, and penalties. Work through each questionable case with the 1099 vs. W-2 classification guide.
  • Exempt vs. nonexempt. Confirm every salaried "exempt" employee genuinely meets both the salary-basis and duties tests under the FLSA. A manager in title who spends the week doing nonexempt work may be owed overtime. Job titles do not determine exemption; duties do.

If either check surfaces a pattern, stop auditing and get advice — reclassification has to be handled carefully to avoid admitting more than you owe.

Section 3: Wage, hour, and payroll

  • Timekeeping for nonexempt staff. Are you capturing accurate hours, including all time worked? Missing or rounded-away time is the core of most wage claims.
  • Overtime calculation. Verify overtime is paid at the correct regular rate — including nondiscretionary bonuses where required — not just base pay.
  • Pay-stub and recordkeeping compliance. Confirm pay stubs meet your state's content requirements and that you retain payroll records for the required years.
  • Final-pay procedures. Check that your separation process honors your state's final-paycheck deadlines, which can require near-immediate payment on termination.
  • Payroll setup basics. If you are newer to this, confirm the fundamentals against setting up payroll for your first employee — registrations, deposits, and filings all have to be current.

Section 4: Required policies and the handbook

  • Handbook currency. Pull your employee handbook and check the date. A handbook more than a year or two old is almost certainly missing law changes. Confirm it has anti-harassment, at-will, leave, and complaint-procedure language, and that every employee has a signed acknowledgment on file.
  • At-will language intact. Verify no policy — especially any probationary/introductory period wording — accidentally promises "permanent" employment and undercuts at-will status.
  • Leave policies match the law. PTO, sick leave, and any state-mandated leave should be written down and consistent with current requirements, including accrual and carryover rules.

Section 5: Required postings and notices

The cheapest violations to fix and the easiest to forget.

  • Labor-law posters. Federal and state postings (minimum wage, FLSA, OSHA, EEO, family leave, workers' comp) must be current and displayed where employees can see them — including a digital equivalent for remote staff. Poster requirements change; last year's set may already be out of date.
  • Program-specific notices. Confirm you have distributed any required benefits and insurance notices.

Section 6: Anti-discrimination, safety, and required programs

  • EEO compliance. Confirm your practices align with EEO obligations, including consistent, documented hiring and discipline decisions and any applicable reporting.
  • Workplace safety. Even small employers have OSHA obligations — hazard training, required recordkeeping, and a way for employees to report unsafe conditions.
  • Workers' compensation coverage. Verify your coverage is active and meets your state's threshold; going bare is a serious exposure.
  • Investigation readiness. Confirm you actually have a process to handle complaints — a workplace investigation process you can run — before you need it.

Section 7: Recordkeeping and retention

  • Retention schedules. Different records have different required retention periods — payroll, I-9s, recruiting and EEO records, benefits, medical. Confirm you are keeping what you must and not purging early.
  • Data security. Personnel and payroll data contain SSNs and financial details. Check that access is restricted and files (paper and digital) are genuinely secured.

Turning the audit into action

A checklist you complete and file changes nothing. The value is in what you do next:

  1. Score each item green (compliant), yellow (needs attention), or red (violation or major gap).
  2. Triage the reds first — an active wage or misclassification exposure outranks a stale poster.
  3. Assign an owner and a due date to every yellow and red. "We should fix that" with no owner is how the same gap shows up next year.
  4. Write down what you found and fixed. A dated audit record showing you self-identified and corrected issues is itself evidence of good faith if a regulator ever comes calling.

Bottom line

An annual HR audit is the cheapest insurance a small business can buy: a few hours of honest self-review that surfaces the missing I-9, the misclassified contractor, the stale handbook, and the expired poster while they are still small. Schedule it, run it section by section, fix the reds with named owners, and keep the record. The businesses that get blindsided by an HR claim are almost never the ones that looked — they are the ones that assumed they were fine.

This is general HR guidance, not legal advice. Recordkeeping periods, classification tests, posting requirements, and leave laws vary by state and employer size — use a self-audit to find issues, and consult qualified counsel to resolve serious ones.