4 Risks Every HR Audit Must Evaluate
An HR audit is not a compliance ritual. It is a structured look at whether the records, policies, and pay practices you would need in a dispute actually exist — before someone asks you to produce them.
Most small employers discover their documentation gaps at the worst possible moment: after a claim is filed, when a government agency opens an inspection, or during diligence for a sale. At that point the gap is no longer fixable. The purpose of auditing periodically is to move that discovery earlier, when it is still cheap.
A full audit covers recruiting, hiring, performance management, training, compensation, and separation. But four areas produce a disproportionate share of the exposure we see in small and mid-sized companies — and all four have shifted meaningfully in the last two years.
1. Incomplete employee files
In an employee claim, an accurate and complete personnel file is your first line of defense. It is also the first thing your opposing counsel will ask for.
Three things trip up small employers most often:
I-9s stored in the wrong place, or never audited
Form I-9 should be stored separately from personnel files, not inside them. The reason is practical: if ICE inspects, you produce the I-9 binder — not every employee's full file including medical notes and performance write-ups.
The stakes here changed in 2026. In March, ICE revised its Form I-9 inspection guidance to reclassify a range of errors that had long been treated as technical — and therefore correctable within a 10-business-day cure period — as substantive violations subject to immediate penalty. Missing dates of birth, missing hire dates, and undated sections now fall on the fineable side of the line.
What that means in dollars. Civil penalties for I-9 paperwork violations currently run $288 to $2,861 per form under 8 C.F.R. § 274a.10(b)(2). Because the fine is assessed per form, the arithmetic moves quickly: a 40-person company with errors on half its forms is looking at roughly $5,800 to $57,000 — before any knowing-hire violations, which carry substantially higher penalties.
Historical ICE inspections have found at least one fineable error on approximately three-quarters of the forms reviewed. The assumption that your I-9s are probably fine is usually wrong.
Medical information mixed into the general file
The ADA requires medical information — accommodation requests, doctor's notes, FMLA certifications, workers' compensation records — to be kept in a separate confidential file with restricted access. Mixing it into the general personnel file is both a compliance problem and a discrimination-claim problem, because it establishes that decision-makers had access to information they should not have had.
No performance record at all
This is the gap we find most often, and the one owners are most surprised by. Not missing annual reviews — missing any record whatsoever that a conversation about performance ever happened, good or bad.
When a terminated employee alleges the real reason was age, race, or retaliation, the employer's answer is supposed to be a documented history of the actual reason. An empty file makes that answer sound invented, because from the outside it is indistinguishable from one. This is the single cheapest exposure to close: a dated note after a performance conversation costs nothing and takes two minutes.
2. Flawed time records
Unpaid overtime remains one of the most common wage claims filed against small employers, and the burden works against you. When an employer's records are inadequate, courts will accept the employee's reasonable estimate of hours worked. Accurate, objective time records are the defense.
What most small employers miss is not the timeclock itself. It is the practices around it:
- Off-the-clock work. Answering texts and email after hours, prep before a shift, cleanup after. If a non-exempt employee does it and you know or should know, it is compensable.
- Automatic meal-break deductions. Deducting 30 minutes automatically is legal only if the employee actually takes the break, uninterrupted. Working lunches at the desk are where this collapses.
- Rounding. Rounding practices must be neutral over time. Rounding that consistently favors the employer is a violation regardless of how small each increment is.
- Remote and mobile non-exempt staff. If you have non-exempt employees working outside a fixed location, you need a defined method of capturing their hours and a policy requiring them to report all time worked.
A correction to earlier advice on biometric timeclocks. An earlier version of this article recommended biometric clock-in for non-exempt employees. That recommendation no longer reflects the legal landscape, and we are flagging the change rather than quietly removing it.
Fingerprint and facial-recognition timeclocks now carry meaningful liability of their own. Illinois' Biometric Information Privacy Act (740 ILCS 14) is the only such law with a private right of action, providing statutory damages of $1,000 per negligent violation and $5,000 per intentional one — and employee timekeeping has become one of the most common sources of BIPA class actions. Texas and Washington have their own biometric statutes enforced by their attorneys general, Colorado added requirements in 2025, New York City regulates biometric collection municipally, and roughly twenty states now treat biometric data as sensitive information under comprehensive privacy laws requiring opt-in consent.
If you already use biometric timekeeping, the baseline obligations are written notice before collection, informed written consent, a published data retention and destruction schedule, secure separate storage, and restricted access. Build the program to satisfy Illinois and you will generally satisfy the others. If you are only now choosing a system, a badge, PIN, or geofenced mobile app achieves the same evidentiary purpose without acquiring a category of data that carries per-violation statutory damages.
3. Misclassified workers
This is really two separate questions that get collapsed into one, and they are governed by different tests.
Employee or independent contractor
The federal picture is genuinely unsettled right now. The Department of Labor's 2024 six-factor rule technically remains on the books for private FLSA litigation, but the DOL stopped applying it in its own investigations and instructed field staff to use an earlier framework. In February 2026 the Department proposed rescinding it entirely and replacing it with a streamlined analysis built around two core factors: the nature and degree of control over the work, and the worker's opportunity for profit or loss based on initiative and investment. That rule is not final.
We walk through the full test, including the state-level variations, in our guide to employee vs. independent contractor classification.
Two things are true regardless of how the rulemaking lands. First, actual practice outweighs contract language — a signed independent contractor agreement does not save a relationship where you set the schedule, supply the tools, and direct the method. Second, several states apply their own and considerably stricter tests. California, Massachusetts, and New Jersey use versions of the ABC test, under which a worker is presumed an employee unless the employer proves all three prongs. Federal flexibility does not help you in those states.
Exempt or non-exempt
The federal salary threshold has been through two years of whiplash. The 2024 rule that would have raised it to $1,128 per week was vacated by a federal court in November 2024. The DOL dropped its appeal and, in May 2026, issued a technical amendment restoring the prior figures to the regulations. For the full duties-test breakdown, see our guide to exempt vs. non-exempt classification.
| Test | Current federal requirement (2026) |
|---|---|
| Salary basis | Paid a predetermined salary not subject to improper deduction |
| Salary level | At least $684 per week ($35,568 annually) |
| Duties | Primary duties must fit the executive, administrative, professional, computer, or outside sales categories |
| Highly compensated | $107,432 in total annual compensation, including at least $684 per week in salary |
Two cautions. The federal number is a floor, not a ceiling — California, New York, Washington, Colorado, and several other states set higher thresholds, and the higher figure governs for employees working there. And the salary test is the easy half. The duties test does the real work, and a job title is not a duties analysis. "Office Manager" and "Assistant Manager" are two of the most frequently misclassified titles in small business.
Why misclassification is expensive. A misclassified non-exempt employee is owed unpaid overtime going back two years, or three if the violation was willful, typically doubled as liquidated damages, plus the employee's attorney's fees. Because misclassification usually applies to a whole job category rather than one person, a single complaint tends to become a group claim.
One practical safeguard: the FLSA provides a safe harbor at 29 C.F.R. § 541.603(d) for employers who maintain a clearly communicated written policy prohibiting improper salary deductions, provide a complaint mechanism, and reimburse any that occur. The policy has to exist before the problem does.
4. Incomplete or outdated policies
An HR audit is not complete without reviewing the handbook, required postings and notices, insurance documentation and coverages, and the standard operating procedures employees are actually expected to follow — how to request PTO, how expenses get reimbursed, how payroll timing works.
The handbook is not paperwork. In harassment cases, an employer's ability to raise the Faragher-Ellerth affirmative defense depends on having a clear anti-harassment policy with a functioning complaint procedure that the employee was aware of. No policy, no defense.
Four areas that were not on most small business handbook checklists in 2022 and belong there now:
- Multi-state employment. If you hired remotely during or after 2020, you may owe state-specific handbook supplements, state-specific leave policies, and state-required notices in every state where an employee physically works — not just where your office is. Our multi-state HR compliance guide covers what triggers where.
- Electronic postings for remote staff. A poster in the breakroom does not reach someone working from home. Remote employees generally require electronic equivalents of required federal and state notices.
- AI acceptable use. Employees are already using AI tools with company and customer data. If you have no policy, you have no basis for discipline and no control over what leaves the building.
- Pay transparency. A growing list of states requires salary ranges in job postings. If you hire remotely, the requirement follows the candidate's location, not yours.
How often, and what to do next
An annual review is the right baseline for most small employers. Move it up if you have crossed a headcount threshold that triggers new obligations, hired into a new state, been through a leadership change, or have a transaction on the horizon — buyers and investors will run this audit whether or not you have.
These four are not the whole picture. A complete audit also looks at hiring practices, manager capability, compensation structure, benefits administration, and separation processes. But getting these four right removes a meaningful share of the exposure most small businesses are carrying without knowing it. If you'd rather have someone run the full review with you — and stay on to close what it finds — that's the core of our fractional HR services.
Frequently asked questions
What is an HR audit?
An HR audit is a structured review of a company's people practices, records, and policies against current legal requirements and operational standards. It typically covers personnel files, wage and hour practices, worker classification, handbook and policy documentation, hiring and onboarding, performance management, and separation procedures. The output is a picture of where the company is exposed and in what order those gaps should be closed.
How often should a small business conduct an HR audit?
Annually is the right baseline. Audit sooner if you have crossed a headcount threshold that triggers new legal obligations, hired employees in a new state, changed payroll or HR systems, been through a leadership transition, or are preparing for a sale, funding round, or due diligence review.
What is the current federal salary threshold for exempt employees?
As of 2026, the federal threshold for the executive, administrative, and professional exemptions is $684 per week, or $35,568 annually. The 2024 rule that would have raised it was vacated in November 2024, and the Department of Labor restored the prior figures to the regulations in May 2026. Several states set higher thresholds, and where they do, the state figure governs. Salary is only one of three tests — the duties test still has to be satisfied independently.
Are biometric timeclocks legal for employers?
Generally yes, but with conditions that vary by state and carry real financial consequences if missed. Illinois, Texas, and Washington have dedicated biometric privacy statutes, Colorado and New York City have added requirements, and roughly twenty states regulate biometric data as sensitive information under broader privacy laws. Illinois is the only one permitting employees to sue directly, with statutory damages of $1,000 to $5,000 per violation. Employers using biometric timekeeping need written notice, informed written consent obtained before collection, a published retention and destruction policy, and secure restricted storage.
How far back can an employee claim unpaid overtime?
Under the FLSA, two years, extending to three if the violation is found to be willful. Unpaid overtime is typically doubled as liquidated damages, and prevailing employees recover attorney's fees. Some states have longer lookback periods than the federal standard.
Can a signed independent contractor agreement protect against misclassification?
Not on its own. Agencies and courts look at how the relationship actually operates, not how the paperwork describes it. If the company controls the schedule, directs the method of work, supplies the equipment, and the worker has no genuine opportunity for profit or loss, the agreement will not survive scrutiny. Several states apply an ABC test that presumes employee status unless the employer proves all three prongs.
Not sure where your gaps are? A conversation is usually enough to tell.
Schedule an HR consultationThis article is general information about HR practices and is not legal advice. Employment law varies by state and locality and changes frequently. Consult qualified employment counsel about your specific circumstances.
