HR Compliance Checklist: 3 Fast Checks to Catch Risk Early
An HR compliance checklist has one job: reduce legal risk and keep every record audit-ready across categories including records and timekeeping, hiring and onboarding, classification and wage-and-hour, policies and training, benefits and leave, terminations, and recurring audits. Key checks to run this week include I-9 completion, an accurate payroll export, and contemporaneous time records that would hold up if a wage dispute landed tomorrow.
TL;DR:
- Prioritize missing employment verification forms, unpaid overtime, and active discrimination complaints; assign every finding an owner, deadline, and required closure evidence.
- Retain payroll records for at least three years, wage calculation records such as time cards for two years, and general personnel records for one year.
- Title VII and ADA generally apply at 15 employees, ADEA at 20, and FMLA at 50; wage and verification rules can apply from one employee.
- For a fast first pass, export the last full quarter of payroll, sample 10 to 15 work authorization forms against payroll, and audit one department’s hours.
Table of Contents
- How to use this checklist without stalling your team
- Records, retention, and timekeeping requirements
- Hiring and onboarding compliance checkpoints
- Worker classification and wage-and-hour checkpoints
- Policies, handbooks, training, and accommodations
- Benefits, leave, and separation compliance
- Terminations, investigations, and complaint handling
- HR compliance audit: scope, steps, and remediation playbook
- Systems and documentation: how HR tech supports defensible compliance
- Running your first HR audit without disrupting the team
- How workforce management software can simplify checklist items
- FAQ
- Sources
How to use this checklist without stalling your team
A checklist only works when someone owns each line item and a deadline forces action. Sort every finding into a triage tier before you touch policy language or training decks.
- Critical (address promptly): missing I-9s, unpaid overtime, active discrimination complaints.
- High (address after critical items): outdated handbook language, missing training records, unclear exempt classifications.
- Medium (schedule for follow-up): posting updates, policy acknowledgment gaps, inconsistent timekeeping practices.
- Low (next scheduled review): formatting fixes, archiving old versions, minor wording cleanup.
Assign an HR lead to run the work and a leadership sponsor to clear roadblocks and approve budget for fixes. For each finding, log an owner, a due date, and the proof required to close it out: a signed form, a corrected pay stub, a completed training log.
Start with a quickstart that produces evidence fast:
- Export a clean payroll or HRIS CSV covering the last full quarter.
- Sample-check 10 to 15 I-9s and matching payroll records for completeness.
- Run a small timekeeping audit on one department to confirm hours match pay.
Pro Tip: Pick the department with the most hourly turnover for your sample audit. It surfaces more gaps per hour of review than a department with stable, salaried staff.
Records, retention, and timekeeping requirements
Retention periods are not uniform, and treating them as one blanket number is a common audit failure. Under FLSA recordkeeping requirements, payroll and collective bargaining records should generally be kept at least three years, records used for wage computations, including time cards, should be kept at least two years, and general personnel and employment records must be preserved for at least one year.
Nearly every wage dispute turns on documentation, and the FLSA puts the burden of proof on the employer: if your time records are incomplete, investigators tend to side with the employee’s version of events.
I-9 retention follows a separate rule. Check the applicable official requirements to determine how long to retain each Form I-9. Keep these practices in place:
- Maintain contemporaneous, exportable time records rather than reconstructed timesheets.
- Keep an audit trail showing who entered or edited hours and when.
- Store payroll and personnel records separately, since their retention clocks differ.
- Confirm your timekeeping method captures actual hours worked, not scheduled hours.
Hiring and onboarding compliance checkpoints
Most compliance failures start at onboarding, not termination, because gaps compound quietly over months. Build a checkpoint for every new hire file:
- Confirm a completed Form I-9 with acceptable identity and work-authorization documents.
- File a signed W-4 and verify background-check consent forms and FCRA notices where checks are used.
- Store the signed offer letter, classification rationale, and policy acknowledgment in the personnel file.
- Verify required workplace posting notices are accessible to both remote and on-site staff, since remote hires often get missed.
A single missing I-9 or an unsigned acknowledgment form is a small thing on its own, but a pattern of them across dozens of hires is exactly what an auditor samples for first.
Worker classification and wage-and-hour checkpoints
Misclassification can be a significant finding in an HR audit, and reviewing classifications may help address issues before they become complaints. Document the actual duties and salary basis supporting exempt status under the FLSA rather than relying on job titles alone.
- Confirm overtime math: regular rate calculations, overtime premiums, and any time-rounding practices.
- Cross-check hourly rates against the applicable state or local minimum wage, since these vary by jurisdiction.
- Reconcile a sample of recent pay stubs against time records to confirm disclosures match hours paid.
- Flag any employee whose duties shifted since their last classification review.
Pro Tip: Reclassification may cost less than responding to a wage claim. If a role’s day-to-day duties no longer match its exempt justification, fix the classification before an employee or regulator finds it for you.
Policies, handbooks, training, and accommodations
A handbook that has not been reviewed recently may create risk if it no longer reflects current requirements or workplace practices. Keep anti-discrimination, harassment, and ADA accommodation procedures current and specific to how your workplace actually operates.
- Record every training completion with date, content covered, and attendee list.
- Collect signed acknowledgment receipts each time a policy changes materially.
- Add jurisdictional addenda for states with requirements that differ from your base handbook.
- Document each ADA interactive-process conversation, including the outcome and any accommodation granted.
Benefits, leave, and separation compliance
Leave obligations scale directly with headcount, so map eligibility against your actual employee count rather than assuming one policy fits every location.
- Document FMLA eligibility, notice timelines, and leave tracking where your headcount triggers coverage.
- Retain ERISA plan documents and COBRA election notices for any group health plan you sponsor.
- Confirm final-pay timing rules for the states where you employ people, since deadlines after termination vary.
- Check whether a layoff triggers WARN Act notice obligations based on size and timing.
Terminations, investigations, and complaint handling
Every complaint needs a paper trail that survives scrutiny months or years later.
- Keep confidential investigation notes, complaint timelines, and documented outcomes with proof of any remedial action taken.
- Retain all records tied to an EEOC charge until the charge reaches final disposition, not just until the internal case closes.
- File complete separation paperwork, final pay documentation, and any signed release agreements in the employee’s permanent file.
HR compliance audit: scope, steps, and remediation playbook
A repeatable audit process beats an ad hoc scramble every time a regulator calls. Run it in these steps:
- Determine scope, including which business units, locations, and time period the audit covers.
- Identify applicable laws by headcount and jurisdiction (3 to 5 days).
- Gather documents, such as I-9s, payroll exports, personnel files, and policies, allowing time based on company size.
- Review each category against the applicable standard.
- Analyze findings and score risk by severity and likelihood.
- Build a remediation plan with owners and deadlines.
- Implement fixes and monitor through the next review cycle.
| Field | Purpose |
|---|---|
| Finding | What the audit uncovered |
| Root cause | Why the gap exists |
| Owner | Who closes it |
| Due date | When it closes |
| Proof required | Document that confirms closure |
Systems and documentation: how HR tech supports defensible compliance
Auditors expect contemporaneous, exportable records, not reconstructed spreadsheets built the night before a review. A system that keeps audit logs and role-based permissions for every record accessed or changed removes the guesswork about who touched what.
At minimum, your HR system should produce these on demand:
- A full timesheet export with approval history.
- A payroll register matching hours paid to hours worked.
- A PTO log showing requests, approvals, and balances.
Pro Tip: Test your export process before an auditor asks for it. If it takes more than a few minutes to produce a clean payroll register, that gap itself becomes a finding.
Running your first HR audit without disrupting the team
Appoint a leadership sponsor before you start, and tell managers the exact scope up front. Focus the first pass on I-9s, payroll exports, and timekeeping, the highest-leverage checks you can run.
— Adrian
How workforce management software can simplify checklist items
Most of the heavy lifting in this checklist comes down to producing clean records fast: exportable timecards, approved PTO logs, and a payroll register that matches hours to pay. That’s the gap workforce management software is built to close, and it’s where we built Horium.
We offer one-tap clock in/out, per-employee PTO and leave management, and payroll reporting and export, all on a fully white-labeled platform under your own branding. No per-feature charges, no hidden fees, just one plan at €3.99 per employee per month. Start a trial and see how quickly your first export comes together.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
FAQ
What is considered HR compliance?
HR compliance means meeting the employment laws and recordkeeping rules that apply to your business based on headcount and location, covering areas like wage and hour rules, recordkeeping, hiring documentation, workplace safety, and anti-discrimination protections. It also means keeping evidence that you followed those rules, not just following them.
What are the 7 major HR activities?
The core activities are recordkeeping and timekeeping, hiring and onboarding, worker classification and wage-and-hour management, policies and training, benefits and leave administration, terminations, and recurring compliance audits. Each activity carries its own documentation and retention requirements.
How to measure HR compliance?
Measure compliance through a structured audit: scope the review, identify which laws apply at your headcount, gather documents, and score each finding by severity and how likely it is to trigger a complaint or claim. Thresholds vary by size, for example FLSA and I-9 rules apply at one or more employees, while Title VII and ADA apply at 15 or more, ADEA at 20 or more, and FMLA at 50 or more.
How to be HR compliant?
Being compliant means keeping accurate, exportable records for hiring, pay, and leave, applying the right wage and classification rules for each employee, and retaining documentation for the periods regulators require. A workforce management system that exports clean timecards and payroll registers makes it far easier to produce that proof when it’s requested.