An HR audit is not a performance review of the HR department. It is a structured examination of whether what your organization does matches what its policies, its records, and the law say it does. The gaps between those three things are where liability accumulates.
The value of running one yourself is simple: you get to choose the timing, the scope, and the pace of remediation. Every one of those choices is made for you when the audit is triggered by an agency notice or a demand letter instead.
Not every audit needs to cover everything. Pick the type deliberately.
For a first audit, a compliance audit with a function-specific deep dive on your single highest-risk area is usually the right choice. Trying to audit everything at maximum depth produces a report nobody acts on.
Define scope in writing: which entities, which locations, which states, what time period, and — critically — which populations. "All employees" and "all non-exempt employees at the Ohio facility over the last two years" produce very different amounts of work.
This decision comes before you gather anything, because it cannot be made retroactively.
An audit creates a written record of your own problems. If a plaintiff's lawyer obtains that record, your candid internal assessment becomes their exhibit. Conducting the audit at the direction of counsel, for the purpose of providing legal advice, may bring the findings within the attorney-client privilege or work product protection.
The protection is not automatic and it is not absolute. It requires the engagement to be genuinely legal in purpose, documented as such at the outset, and handled consistently — privilege is routinely waived by sharing findings broadly, by mixing legal and business purposes in the same document, or by having HR run the audit and copy counsel afterward.
Rule of thumb: if you have reason to believe the audit will surface a systemic problem with real exposure — misclassification across a job family, an I-9 population with widespread defects, a pay equity gap — engage counsel first. For a routine annual review of a well-run function, in-house is usually fine.
Assemble before you analyze. A partial document set produces findings that evaporate when the missing piece turns up.
Review applications for unlawful pre-offer inquiries — salary history where prohibited, criminal history before the point permitted by ban-the-box laws, disability and medical questions. Check that background check practices satisfy FCRA notice, authorization, and adverse action requirements, including the standalone disclosure rule. Confirm offer letters do not create implied contracts or undermine at-will status.
Audit every Form I-9 against the population roster. Look for: missing forms, Section 1 not completed by the first day of work, Section 2 not completed within three business days, missing signatures or dates, over-documentation (requesting specific documents or more than required), improper reverification, and forms retained past the destruction date.
Correct errors properly — line through, insert correct information, initial and date. Never backdate, never use white-out, never complete a missing form with the original date. A newly completed form gets today's date with a signed explanatory memo attached. See our I-9 Training I-9 Training for the correction protocol.
The retention rule: three years after the date of hire, or one year after termination, whichever is later. Forms held beyond that should be destroyed on schedule.
This is where the money is. Test:
Our FLSA Training FLSA Training covers the standards; the audit step is comparing your practice to them on real data.
Confirm the separation of files: personnel, medical/ADA/FMLA, I-9, and investigation records must each be kept apart. Medical records in the personnel file is one of the most common findings and one of the easiest to fix. Verify retention periods, employee access rights under state law, and — for terminated employees — that files were retained rather than purged.
Test a sample of leaves end to end: eligibility determined correctly, Notice of Eligibility and Designation Notice issued within five business days, certifications complete, intermittent leave tracked in proper increments, and — the critical one — that ADA analysis occurred when FMLA entitlement was exhausted rather than automatic termination.
Confirm eligibility rules are applied as written, COBRA notices went out within the deadlines with proof of mailing, required participant notices were distributed, Forms 5500 were filed, and ACA reporting is accurate and consistent with your measurement method.
Check the handbook against current law in every state where you have employees, confirm at-will and disclaimer language, verify acknowledgments are on file for every employee, and check that policies do not restrict activity protected under Section 7 of the NLRA — which applies to non-union workplaces too.
OSHA logs current and posted during the required period, required training completed and documented, posters current at every location and distributed electronically to remote employees.
Auditing everything is rarely feasible; auditing haphazardly is worse than not auditing.
Whatever you choose, document the sampling method and size. An unexplained sample invites the question of what you avoided looking at. And if a sample shows a defect rate above a few percent, expand it — a 40 percent defect rate in a 25-form sample is not a sampling result, it is a population problem.
A flat list of 60 findings tells leadership nothing. Rank them.
Score each on likelihood of discovery and magnitude of exposure, and sequence remediation by the product of the two. A defect that is certain to be found in any agency inspection outranks a larger one that only surfaces in litigation you may never face.
The report should state, for each finding: what was reviewed, what was found, the specific requirement implicated, the risk rating, the recommended action, an owner, and a due date. Avoid conclusory legal characterizations in an unprivileged document — "37 of 120 I-9s had Section 2 completed after the third business day" is a fact; "we are in violation of IRCA" is a legal conclusion that reads badly in an exhibit.
Then remediate in a deliberate order:
The step most often skipped is the last one. An audit that identifies problems and does not verify their correction creates a written record that you knew — which is materially worse than never having looked. Finish what you start.
How often should we conduct an HR audit?
A full compliance audit annually, function-specific audits when risk warrants, and an immediate targeted audit when entering a new state, completing an acquisition, or receiving a complaint that suggests a systemic issue.
Should an attorney conduct the audit?
Involve counsel when you expect to find systemic issues with meaningful exposure — classification, pay equity, or a large I-9 population. The privilege must be established at the outset; it cannot be added afterward.
How do I correct an I-9 error found during an audit?
Line through the incorrect information, enter the correct information, and initial and date the change. Never backdate or use correction fluid. If a form is missing entirely, complete a new one with today's actual date and attach a signed memo explaining the circumstances.
What's the biggest risk area in most HR audits?
Wage and hour — specifically exempt misclassification and unrecorded work time. These carry back-pay liability, liquidated damages, attorneys' fees, and a natural class of similarly situated employees.
Does finding a problem make us more liable?
Not fixing it does. Documented knowledge of a violation followed by inaction supports a willfulness finding, which extends the limitations period and increases damages. If you audit, commit to remediation.
Can employees request their personnel files?
In many states, yes — with specific timeframes, copying rules, and rules about what may be excluded. Verify the requirements in every state where you employ people.
Scope it, decide the privilege question first, sample deliberately, rank findings by risk rather than listing them, and — above all — close the loop with verified remediation and a re-audit date. An audit is only valuable to the extent it changes what happens next.
For structured instruction, explore our HR Audits HR Audits training, work through our HR Compliance Checklists HR Compliance Checklists, or review the Top Ten HR Compliance Mistakes Top Ten HR Compliance Mistakes.
Recommended In-Person Seminars
1-770-410-1219
support@HRTrainingCenter.com
770-410-1219
