HR Audit: What It Is, the 7-Step Process, and a Complete Checklist
How to conduct an HR audit at a small business. 7-step process, 5 audit types, compliance checklist, common gaps, and how to fix them without an HR team.
HR Audit
How to review your HR compliance, find the gaps, and fix them
An HR audit is a structured review of everything your business does (and should be doing) related to employees: documentation, compliance, policies, classification, onboarding, and offboarding. I run a small company myself, and it is the first HR task I would recommend to another founder, because it shows you exactly where you stand.
The output of an audit is a list of gaps between what the law requires and what your company actually has in place, ranked by how much risk each gap creates. This guide covers the seven-step process, a compliance checklist, the questions to ask in each area, and the five gaps first audits most often find.
Most HR audit guides assume you have an HR department. This one does not. If you are running a small business, there is a good chance the founder, office manager, or operations lead is handling HR alongside everything else. The audit process is the same. The scope is simpler.
The stakes are just as high, though. An I-9 paperwork violation carries a civil penalty of $288 to $2,861 for each individual the violation involves. Putting a worker in the wrong category under the Fair Labor Standards Act, known as FLSA misclassification, can result in back pay plus an equal amount again in liquidated damages for every affected employee.
What Is an HR Audit?
Think of an HR audit the way you think of a financial audit: it verifies that the records are accurate, the processes are followed, and the organization is meeting its legal obligations. The difference is that financial audits are often required by investors or regulators, while HR audits are typically voluntary.
Because the audit is usually optional, many small businesses never conduct one. That is why a small business often discovers an HR compliance gap only when a government agency finds it first.
An audit is not a one-time fix. It establishes a baseline: here is what we have, here is what we are missing, here is the plan to close the gaps. After the first audit, annual reviews maintain the baseline and catch new requirements triggered by growth, new states, or regulatory changes.
Why Small Businesses Need an HR Audit
Small businesses face many of the same employment laws as large companies but have fewer resources to track compliance. Those laws do not scale down. A small business must complete I-9s with the same rigor as a global corporation, follow the same FLSA classification rules, and keep the same Occupational Safety and Health Administration (OSHA) logs once recordkeeping applies.
The difference is who checks. A large company has an HR team on it, and a small business usually does not. According to the Society for Human Resource Management (SHRM, 2025), recruiting spend alone averaged $5,475 per nonexecutive hire, so a gap that drives preventable turnover costs money long before any fine arrives.
The full cost of a hire runs higher than the recruiting line. A talent management consultant quoted by SHRM (2022) says many employers estimate the total cost to hire at three to four times the position's salary.
According to research reported by SHRM (2017), up to 20% of all employee turnover happens within the first 45 days. An onboarding audit often reveals why: paperwork is incomplete, training is inconsistent, and new hires never get the structured first week that the research links to staying.
Three situations make an audit especially urgent. First, you have never conducted one. If your business has been operating for more than a year and has never reviewed its HR documentation and compliance, there are almost certainly gaps.
Second, you recently crossed an employee threshold. At 15 employees, Title VII of the Civil Rights Act, the Americans with Disabilities Act (ADA), and the Genetic Information Nondiscrimination Act (GINA) apply. At 20, the Age Discrimination in Employment Act (ADEA) and COBRA continuation coverage apply. At 50, the Family and Medical Leave Act (FMLA) and the Affordable Care Act (ACA) employer mandate apply.
Third, you expanded into a new state, which adds its own wage, leave, anti-discrimination, and reporting requirements.
5 Types of HR Audits
The five main types of HR audits are compliance, documentation, onboarding and offboarding, compensation and classification, and policy and handbook audits. Not every audit needs all five. They are listed below in priority order for a first audit, and the later types can wait for your annual reviews.
For a first-time audit at a small business, a combined compliance and documentation audit is the right starting point. These two types catch the highest-risk gaps (missing I-9s, misclassified employees, unsigned policies) and produce the most actionable remediation list.
When to Run Your First HR Audit
Run your first HR audit now if you have never done one. The table lists each event that calls for an audit and what to cover.
| Trigger | Why It Matters | What to Audit |
|---|---|---|
| You have never conducted one | Gaps accumulate over time. The longer you wait, the larger the remediation effort. | Full compliance and documentation audit |
| You crossed 15 employees | Title VII, ADA, GINA, Pregnancy Discrimination Act, and PWFA now apply | Anti-discrimination policies, reasonable accommodation process, EEO poster |
| You crossed 20 employees | ADEA and COBRA apply | Age discrimination policy, COBRA notification process |
| You crossed 50 employees | FMLA and ACA employer mandate apply | Leave policy, health insurance offering, FMLA eligibility tracking |
| You hired in a new state | State employment laws now apply to those employees | State-specific wage, leave, posting, and reporting requirements |
| You received a complaint or agency notice | Immediate compliance review needed | Targeted audit of the specific area cited |
| It has been more than 12 months since your last audit | Laws change annually, records accumulate gaps | Annual refresh of full compliance checklist |
The threshold crossings are the most commonly missed triggers. Many founders do not realize that hiring their 15th employee changes their legal obligations. An audit at that point takes 2 to 4 hours and catches whether you have the required policies, posters, and processes in place.
The HR Audit Process: 7 Steps
The HR audit process runs in seven steps that stay the same at every company size; only the scope and depth scale with your headcount. It works whether you conduct the audit yourself or brief a consultant.
Step 1: Define the Audit Scope
Decide what you are auditing. A first-time audit should cover compliance (are we meeting legal requirements?) and documentation (are employee files complete?). You can expand to onboarding, classification, and policies in subsequent audits. Auditing everything at once on your first attempt is overwhelming and unnecessary, so start where the legal risk is highest.
Step 2: Gather All HR Documents and Records
Collect every employee file, including I-9 forms, W-4s, signed offer letters, handbook acknowledgments, emergency contacts, training records, performance documentation, and any signed policies. If files are scattered across filing cabinets, email attachments, and Google Drive folders, this step will take the longest. It also reveals your first finding: if gathering the documents is difficult, the organization system is a gap.
Step 3: Build Your Compliance Checklist
Create a checklist of requirements based on your employee count and the states where you have employees. Your state-specific requirements come from your state's labor agency. The checklist should include every document that should exist, every poster that should be displayed, every training that should be completed, and every process that should be in place.
Step 4: Review Each Item Against the Checklist
Go through every employee file and every HR process, checking each item against your requirements list. Mark each item compliant (present and correct), incomplete (present but missing information), or missing (not present at all). This is usually the most time-consuming step: at a small business, expect 4 to 8 hours, depending on how organized your files are.
Work it as a grid rather than as a pile. One row per employee, one column per document, and the pattern across the roster becomes visible while you are still reviewing rather than afterward. The second tab totals each column, which is what turns a morning of file opening into a finding you can act on.
| A | B | C | D | E | F | G | H | I | J | K | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Employee | Hire date | Form I-9 complete and signed | Form W-4 | Signed offer letter | Handbook acknowledgment | Emergency contact | Exempt or non-exempt recorded | Personnel, medical, and I-9 files separate | Reviewed on | Notes |
| 2 | Sample: A. Rivera | Compliant | Compliant | Compliant | Missing | Compliant | Compliant | Compliant | Never re-signed after the handbook was updated | ||
| 3 | Sample: J. Okafor | Incomplete | Compliant | Missing | Missing | Missing | Incomplete | Compliant | I-9 Section 2 signed but not dated. Title says manager, duties not reviewed | ||
| 4 | |||||||||||
| 5 | |||||||||||
| 6 | |||||||||||
| 7 | |||||||||||
| 8 | |||||||||||
| 9 | |||||||||||
| 10 | |||||||||||
| 11 | |||||||||||
| 12 | |||||||||||
| 13 |
Step 5: Identify and Categorize Gaps
List every gap found during the review. Categorize each as high risk (creates legal exposure, such as missing I-9s or misclassified employees), medium risk (creates process failure, such as inconsistent onboarding or missing training records), or low risk (best practice improvement, such as outdated emergency contacts or missing optional policies).
Record each gap in the same format: the current state, the required state, and the exact difference between them. That format turns a review into an HR gap analysis you can work from. A finding like nine of 24 employees missing a signed handbook acknowledgment tells you what to do and when you are done. A note that acknowledgments are inconsistent does not.
Step 6: Prioritize by Legal Risk
Address high-risk gaps first: items that carry fines or legal exposure come before best-practice improvements. Missing I-9s, misclassified employees, missing required training, and unsigned handbook acknowledgments are almost always at the top of the list. A signed acknowledgment is a best practice, but a missing one ranks high because the signature is your record that the employee received your policies.
Step 7: Create a Remediation Plan
Assign each gap an owner, a deadline, and a specific action. Track completion. Schedule a follow-up review in 90 days for high-risk items to verify they were closed. The remediation plan is the output of the audit. Without it, the audit is just a list of problems.
HR Audit Checklist for Small Businesses
This checklist covers federal requirements and the most common state-level ones. Your state may add obligations of its own.
| Category | Audit Item | Required For |
|---|---|---|
| Employee Files | I-9 completed and signed for every employee | All employers (1+ employees) |
| Employee Files | W-4 on file for every employee | All employers |
| Employee Files | Signed offer letter or employment agreement | Best practice (strongly recommended) |
| Employee Files | Signed employee handbook acknowledgment | Best practice |
| Employee Files | Emergency contact information | Best practice |
| Employee Files | Medical records stored separately from personnel files | ADA, GINA (15 or more employees) |
| Employee Files | I-9s stored separately from personnel files | USCIS recommendation, not a legal requirement |
| Compliance | Federal and state labor law posters displayed | All employers |
| Compliance | New hire reports filed with the state within 20 days (some states set a shorter deadline) | All employers |
| Compliance | OSHA 300 log maintained in most industries | OSHA (more than 10 employees) |
| Compliance | EEO-1 Component 1 report filed | EEOC (private employers with 100 or more employees; the separate federal contractor rule at 50 is rescinded effective October 26, 2026) |
| Classification | Each role documented as exempt or non-exempt | FLSA (all employers) |
| Classification | Salary meets minimum threshold for exempt classification | FLSA |
| Classification | Workers classified as employees vs contractors correctly | IRS, DOL (all employers) |
| Policies | Employee handbook exists and is current | Best practice (required content varies by state) |
| Policies | Anti-harassment policy included | Required in some states, including CA and NY |
| Policies | At-will employment statement included | Best practice (all at-will states) |
| Policies | Equal employment opportunity statement | Best practice; the EEO poster is required of covered employers (15 or more) |
| Training | Anti-harassment training completed where required by state | CA, NY, IL, CT, DE, ME, and others |
| Training | Safety training completed for applicable industries | OSHA (industry-specific) |
| Onboarding | Consistent onboarding process documented | Best practice |
| Onboarding | Onboarding completion rate tracked | Best practice |
| Offboarding | Exit process documented and followed | Best practice |
| Offboarding | Final pay delivered within state-required timeline | State law (varies) |
| Records | Records retained for required periods by document type | FLSA, OSHA, Title VII, ERISA |
The OSHA row is the one people read wrong. The recordkeeping exemption covers employers with 10 or fewer employees at all times during the last calendar year. Peak at 10 and you stay partially exempt; reach 11 and you keep the records the following year. Reporting a fatality or a severe injury is separate: every employer owes that at any size.
HR Audit Questions to Ask in Each Area
The checklist tells you what exists. It does not tell you whether the process behind it works: a file can be complete because one person happened to remember, not because a system made sure of it. These are the questions to put to whoever runs each area.
| Audit Area | Questions to Ask | Who Answers |
|---|---|---|
| Hiring and onboarding | Did the last five hires get the same process? Who confirms the I-9 is complete within three business days of the start date, and what happens when it is not? | Whoever runs onboarding day to day |
| Classification and pay | How was each exempt role decided, by duties or by title? When was a salaried role last checked against the duties test? | The owner or whoever sets pay |
| Leave and time off | How are PTO balances tracked, and where does that record live? Who approves leave, and is the same rule applied to everyone? | The manager approving time off |
| Policies and handbook | Which version of the handbook is current, and who has signed that version? What triggers an update when a state law changes? | Whoever maintains the handbook |
| Training | Which training is required by your state or industry, and how is completion evidenced? What happens when a deadline passes? | The manager or training owner |
| Records and access | Who can open an employee file, and is that access recorded? Where do medical documents sit, and are they separate from the personnel file? | Whoever holds the files |
| Offboarding | What did the last departure actually look like? Was final pay issued inside the state deadline, and was system access removed the same day? | The owner or operations lead |
Write each answer down in the words you actually hear, not the words you hoped for. The distance between what the policy says and what the person doing the work believes is usually where the finding is. A handbook can be current and the process still fail if the only person who knows it is out for a week.
The 5 Most Common Gaps Small Businesses Find
The five gaps below turn up again and again in first-time audits at companies that have grown without dedicated HR. The good news: all five are fixable within 2 to 4 weeks.
| Gap | Why It Happens | How to Fix It |
|---|---|---|
| Missing or incomplete I-9s | Completed late, Section 2 skipped, not re-verified for rehires | Audit every I-9 on file. Complete missing ones immediately. Set up a system so Section 2 is done within three business days of every future start date. |
| Employees misclassified as exempt | Job title confused with classification. 'Manager' title given but duties are non-exempt. | Review each exempt classification against the FLSA duties test. Reclassify and adjust pay going forward for any misclassified roles. |
| Missing signed handbook acknowledgments | Handbook was emailed but never signed. Updated handbook distributed without collecting new signatures. | Re-distribute the current handbook with e-signature. Collect signed acknowledgments from every current employee. |
| Inconsistent onboarding process | First few hires got thorough onboarding. Later hires got less as the founder got busier. | Document a standard onboarding checklist. Use task workflows to ensure every hire receives the same process. |
| Outdated or missing labor law posters | Posters from year of founding never updated. Remote employees never received required notices. | Order current federal and state posters. Send electronic notices to remote employees. |
From Audit Findings to Ongoing HR Risk Management
An audit is a snapshot. What keeps it useful is a standing list of the people risks the business is carrying, each with an owner and a review date. That list is all human resource risk management amounts to at a company without an HR department, and it fits on one page.
Score every open item two ways: how likely it is to surface in the next 12 months, and what it costs if it does. A single missing emergency contact and a misclassified role held by six people are both findings from the same review, and only one of them grows with headcount and with every pay period that passes.
The categories below cover the risks that actually come up at small companies. Most audit findings land in the first row. The second row is the one small teams underrate, because nothing about it shows up in a file review.
| Risk Category | What It Looks Like at a Small Business | The Control That Reduces It |
|---|---|---|
| Legal and regulatory | Missing I-9s, an exempt role that fails the duties test, a state requirement nobody tracked after the first remote hire | The annual audit, plus a calendar of filing, posting, and training deadlines |
| Key person dependency | One person knows the pay cycle, holds the logins, and remembers the promises made to two employees | Processes documented in a system rather than carried in memory, with a second person granted access |
| Turnover and hiring | Early departures concentrated in the first weeks, or one role you cannot keep filled | Structured onboarding, exit reasons recorded in one place, and a look at the pattern each quarter |
| Safety and injury claims | No incident log, no training records for equipment, a claim that arrives with nothing on file to answer it | Written incident reporting, tracked training completion, and the OSHA log where it applies |
| Data and confidentiality | Employee documents spread across personal drives and inboxes, medical notes filed inside personnel records | Central storage with access permissions, and medical records held separately |
| Employee relations | Complaints handled in conversation, with no record of what was looked into or decided | A written intake and outcome record for every complaint, however small it seems |
Two of these are worth transferring rather than managing. Workers' compensation coverage, which most states require, and employment practices liability insurance both exist because some exposure is cheaper to insure than to control, and a broker will quote both against your actual headcount and payroll.
Then set a cadence. Review anything scored high each quarter and the rest annually, and reopen the list on the events that change your obligations: crossing a headcount threshold, hiring in a new state, or receiving a complaint. A list nobody reads is the same as no list, so give it a date rather than an intention.
How an HRIS Makes Audits Faster
A human resources information system (HRIS) speeds up the most time-consuming part of an audit: gathering and verifying documents. If employee files are scattered across filing cabinets, Google Drive folders, email attachments, and a laptop belonging to the founder, the gathering phase alone can take days.
An HRIS with document management removes that phase. The documents are already centralized, organized, and searchable, so the audit starts with the review instead of the retrieval.
| Audit Task | Without HRIS | With HRIS |
|---|---|---|
| Gathering I-9s | Check filing cabinet, scan email, call former office manager | Search by document type, export list of missing forms |
| Verifying handbook acknowledgments | Search email for signed PDFs, check physical files | Filter employees by signed/unsigned status |
| Checking training completion | Review email confirmations, ask managers | Dashboard showing completion rates by employee |
| Verifying classification | Review spreadsheets, check payroll records | Employee profiles with classification field and audit trail |
| Generating audit report | Manual compilation from multiple sources | Export structured report from employee database |
A platform like FirstHR handles the document layer that audits depend on: e-signature for offer letters and handbook acknowledgments, document management for storing and organizing employee files, employee profiles with classification fields, and training modules with completion tracking. When audit time comes, the data is already there.
Frequently Asked Questions
What is an HR audit?
An HR audit is an inspection of a company's HR policies, everyday practices, employee records, and compliance status. It measures what federal and state employment law expects against what the business actually does, and each mismatch becomes a finding. The review usually spans employee documentation such as I-9s, W-4s, and signed policies; exempt versus non-exempt classification; compensation practices; onboarding and offboarding; and required training. The result is a prioritized list of gaps, each paired with the steps that will close it.
How do you conduct an HR audit?
The HR audit process has seven steps: (1) Set the scope by deciding which areas the audit will cover. (2) Pull together every employee file and HR record. (3) List the requirements that apply at your headcount and in each state where you employ people. (4) Check every document and process against that list. (5) Note each gap where a requirement goes unmet. (6) Rank the gaps by legal risk and impact. (7) Write a remediation plan that gives each gap an owner and a deadline. Plan on 8 to 16 hours, spread over 1 to 2 weeks, for a first audit at a small business.
How often should you do an HR audit?
Annually for a comprehensive review. Additionally, conduct a focused audit whenever you cross an employee threshold that triggers new legal requirements (15 employees for Title VII and ADA, 20 for ADEA and COBRA, 50 for FMLA and ACA). State law changes, new hire spikes, and expansion into new states are also triggers for targeted audits. Companies in regulated industries or those that have experienced recent complaints should audit more frequently.
Who should conduct an HR audit?
At a small business without an HR department, the founder or operations manager can conduct the audit using a structured checklist. For the first audit, consider bringing in an HR consultant to establish a baseline you can then maintain yourself. Subsequent annual audits can be done internally if you use the same framework. For compliance-sensitive areas like wage and hour classification, an employment attorney review is worthwhile even if the rest of the audit is done internally, because a wrong exempt call compounds with every pay period it survives.
What does an HR audit checklist include?
A comprehensive HR audit checklist covers: employee files (I-9 for every employee, W-4, signed offer letter, handbook acknowledgment, emergency contact), compliance (labor law posters, new hire state reporting, required training records), classification (exempt vs non-exempt documentation for each role), policies (employee handbook with required policies for your state, anti-harassment policy, at-will statement), onboarding (consistent process documentation, compliance paperwork completion rates), and record retention (files kept for required periods by document type).
What are the types of HR audits?
The five main types are: compliance audit (reviews legal requirements by federal and state law), documentation audit (checks completeness of employee files), onboarding and offboarding audit (evaluates process consistency), compensation and classification audit (verifies exempt/non-exempt status and pay equity), and policy and handbook audit (reviews the handbook for missing and outdated policies). Most small businesses should start with a compliance and documentation audit because these carry the highest legal risk.
How much does an HR audit cost?
A self-conducted audit costs only time: roughly 8 to 16 hours at a small business for the first pass, less once the checklist exists. Outside help is quoted by scope rather than by a standard rate, so ask two consultants or employment attorneys to price the same written scope and compare. What is easier to put a number on is the cost of not auditing. Each worker whose Form I-9 has a paperwork violation can cost $288 to $2,861 in civil fines. Treat a non-exempt employee as exempt and the unpaid overtime can be owed twice over, since liquidated damages match the back pay, and the claim can reach back two years, or three if the violation was willful. Missing required training exposes the company on top of that.
Can I do an HR audit without an HR department?
Yes. Many small businesses conduct their first HR audit without dedicated HR staff. The key is having a structured checklist that covers federal and state requirements for your employee count, a system for organizing employee files (personnel, medical, and I-9 files stored separately), and a clear process for tracking what you find. HR software with document management and compliance tracking makes the audit significantly faster because the data is already organized and searchable rather than scattered across folders and email.