What is an HR audit?

An HR audit is a structured check of your HR records, policies and practices against the law and your own rules. It finds problems while they are still cheap to fix.

In shortAn HR audit reviews whether an organization’s people practices are compliant, consistent and documented. A compliance audit typically covers I-9 forms, payroll and time records, employee classification, required notices, policies and personnel files. A broader audit also looks at hiring, onboarding, performance and turnover. Several record rules give an audit concrete targets: Form I-9 must be kept for 3 years after the date of hire or 1 year after employment ends, whichever is later (8 CFR 274a.2(b)(2)(i)(A)), and under federal wage and hour rules payroll records are kept at least 3 years and basic time cards at least 2 (29 CFR 516.5 and 516.6).

What a compliance audit checks

HR audit checklist
Area Check Common finding
Form I-9 One for every employee, complete, kept for the right period Missing forms, forms kept too long
Time and payroll records Hours, pay and overtime records retained Edits with no reason or trail
Classification Exempt status matches duties and pay Exempt titles with non-exempt duties
Policies Handbook matches current law and practice Outdated leave or break rules
Personnel files Medical records separate and restricted Medical notes in the general file

For time records specifically, see time record retention requirements.

Form I-9 retention: the later of two datesHired 2018Hire + 3 yearsLeft 2024Left + 1 yearKeep until March 2025, the later date
For a long-serving employee, the 1-year-after-termination date usually decides.

Worked example: an audit at a restaurant group

70 employees, 3 locations

A restaurant group runs its first HR audit. In I-9s it finds 4 current employees with no form on file, and 9 forms for people who left long enough ago that the retention period has passed. For example, a cook hired in January 2018 who left in March 2024 had to be kept until the later of January 2021 or March 2025, so March 2025.

In time records, 22 edits in one month at one location have no reason noted. In classification, two kitchen managers paid a salary as exempt spend most of the day cooking on the line, which needs a closer look at whether their duties meet an exemption.

The fixes take a few weeks: complete the 4 missing I-9s under current rules, set a purge date on the others, require a reason on every time edit, and review the two managers’ duties with an adviser. Each finding was cheaper to fix in an audit than in a claim.

Mistakes that are specific to HR audits

Running an audit in a small business

  1. Pick the scope: start with compliance records, such as I-9s, time and payroll records, classification and required notices.
  2. Choose a sample, such as 20 personnel files or one month of time records per location.
  3. Check each item against a written checklist and note every gap.
  4. Rank the gaps by risk and fix the highest-risk ones first.
  5. Set a date for a follow-up check on the same sample size.

Keep the audit notes and the fixes together. If a question arises later, showing that you found and corrected a problem is far better than having no record of looking.

Second example: required notices

A retailer with 5 stores checks whether each store displays the required federal and state workplace notices. Two stores have outdated minimum wage posters, and one store’s posters are in a back office employees cannot enter.

The retailer orders current posters, moves them to the break rooms, and adds a yearly check of posted notices to the audit checklist. It also posts the same notices digitally where employees can see them, which reaches staff who rarely visit the break room.

Start with one random filePick one employee file at random and check everything about that person: I-9, pay rate, time records, classification and signed policies. One file often shows most of the problems a full audit will find.

Questions people ask

What is included in an HR audit?

Typically I-9s, payroll and time records, classification, policies, required notices and personnel files, plus hiring and performance practices in a broader audit.

How often should you do an HR audit?

Many businesses do a full audit yearly and a focused one after major changes such as opening a location.

How long must I keep Form I-9?

3 years after the date of hire or 1 year after employment ends, whichever is later.

Who should do an HR audit?

HR or an outside adviser. An outside reviewer is useful for the first audit or when the findings may be sensitive.

What is the difference between an HR audit and a payroll audit?

A payroll audit checks pay calculations and payroll records. An HR audit is broader, covering records, policies, classification and practices.

What is the first thing to check in an HR audit?

Many start with Form I-9 and time and payroll records, because the rules are specific and gaps are common.

Related on EZTime

Related reading

Reach every shift, not just the office

Announcements by location, department or role, and a company feed with surveys and read confirmations, so frontline staff see the same news.

Disclaimer: This explanation of HR audit is general information, not legal, payroll or tax advice; rules differ by state and city and change over time, and the examples are fictional.