What an HR Audit Actually Involves (From Someone Who’s Been Through Several)

The first time someone suggested an HR audit at one of my companies, I pushed back. We were a 40-person startup. I figured audits were for large corporations with compliance departments and outside counsel on retainer. Then a contractor classification issue almost cost us $80,000 in back taxes and penalties. We’d been treating three people as independent contractors when they should have been classified as employees under California’s AB5 law. An HR audit would have caught that in week one.

Since then, I’ve run HR audits at every company I’ve built or advised. I’ve worked alongside HR platforms like BambooHR and GoCo, managed international hiring through Deel, and set up compliance systems for teams across four countries. Most content about HR audits reads like a compliance manual. I want to explain what happens, what you find, and what to do about it.

HR Audit Basics

An HR audit is a structured review of your organization’s HR policies, processes, documentation, and legal compliance. It examines everything from job classifications and employee files to benefits administration and workplace safety protocols. The goal is to identify gaps, reduce legal risk, and improve how your people operations function.

Think of it like a financial audit, but for your workforce. A financial audit checks whether your books are accurate and your reporting follows GAAP standards. An HR audit checks whether your people practices follow employment law, match your stated policies, and serve the organization.

The scope varies. A full HR audit covers compliance, compensation, benefits, recruitment, onboarding, performance management, training, employee relations, safety, and recordkeeping. A targeted audit focuses on one or two areas because of a specific concern. When we ran our first audit, we focused on compliance and classification because that’s where our risk was highest. The following year, we expanded to include compensation benchmarking and benefits utilization.

HR audits aren’t required by law in most jurisdictions, but they’re recommended. The Society for Human Resource Management (SHRM) suggests organizations conduct some form of HR audit every year. Companies in regulated industries like healthcare, financial services, and government contracting often audit more often because the compliance stakes are higher.

Compliance Auditing

Compliance is where most HR audits start, and for good reason. Employment law is complicated, changes often, and varies by state. A company operating in California, Texas, and New York faces three different sets of rules on pay transparency, leave policies, and harassment training requirements.

During our first compliance audit, we discovered three issues. First, our offer letters didn’t include the required language about at-will employment status in one state. Second, we’d missed the deadline for California’s mandatory sexual harassment training for managers. Third, our I-9 forms had errors in about 30% of our employee files. None of these was intentional. They accumulated because we were growing fast, and nobody was checking.

A compliance audit reviews federal requirements (FLSA, FMLA, ADA, Title VII, OSHA), state-specific laws, and local ordinances. It checks whether required posters are displayed (or digitally provided for remote workers), whether employee handbooks are current, and whether mandatory training has been completed and documented.

The Department of Labor conducted over 21,000 compliance actions in fiscal year 2023. Penalties for wage and hour violations alone averaged $1,200 per employee affected. That’s why compliance is the first stop in any audit.

Recruitment and Hiring Practices

This part of the audit examines how you find, evaluate, and bring on new employees. It checks whether your job descriptions are accurate and non-discriminatory, whether your interview processes are consistent, and whether your background check procedures comply with the Fair Credit Reporting Act.

When we audited our recruitment practices, we found that different hiring managers were asking different interview questions. One manager was asking candidates about their family situation, which creates legal risk under anti-discrimination laws. Another was making verbal salary promises during interviews that didn’t match our written offer letters. The audit helped us standardize the process. We built an interview guide with approved questions, required all salary discussions to reference approved bands, and added a step where HR reviewed every offer letter before it went out.

The audit also looks at your applicant tracking data. If you’re using a system like Greenhouse or Lever, you can pull data on time-to-fill, source effectiveness, and diversity of candidate pools. If your hiring data shows a pattern, like hiring from one demographic for certain roles, that’s a flag worth investigating before it becomes a legal issue.

Employee Documentation and Records

This is the most tedious part of an HR audit, but it catches real problems. Every employee should have a complete file that includes their signed offer letter, I-9 verification, W-4 form, emergency contact information, signed acknowledgment of the employee handbook, any performance reviews, and records of disciplinary actions.

When we audited our files at a 60-person company, 22% of employee records were missing at least one required document. Most often missing were signed handbook acknowledgments and updated emergency contacts. Some employees who’d been promoted had never received an updated offer letter reflecting their new title, salary, or responsibilities.

The fix was straightforward but time-consuming. We created a checklist for each employee file, assigned an HR coordinator to work through the backlog, and set up quarterly spot checks. We also moved from paper files to a digital HRIS (we chose BambooHR at the time) so that missing documents triggered automatic reminders.

Records retention matters too. Federal law requires keeping payroll records for three years, I-9 forms for three years after hire or one year after termination (whichever is later), and FMLA records for three years. State requirements sometimes extend these periods. An HR audit verifies you’re keeping the right records for the right duration.

Compensation and Benefits Review

The compensation piece of an HR audit checks if what you’re paying is fair, legal, and consistent. It examines pay equity across gender, race, and other protected categories. It verifies compliance with minimum wage laws (which vary by state and sometimes city). It reviews overtime classifications to ensure non-exempt employees are categorized.

At one of my companies, the compensation audit revealed a 23% difference in pay between two engineers doing the same work. There was no clear reason tied to experience, performance, or market rates. It was a legacy of when they were hired during different budget cycles. We corrected it within 30 days, but if we hadn’t caught it, that pay gap could have become evidence in a discrimination claim.

The benefits review checks enrollment accuracy, plan compliance (like ACA reporting requirements for applicable large employers), COBRA administration, and whether benefits are being communicated to employees. We found during one audit that our benefits summary document hadn’t been updated in two years and still referenced a dental plan we’d switched away from.

Performance Management and Training

This section of the audit reviews whether your performance management system works and whether required training is happening. It checks if performance reviews are being conducted on schedule, if feedback is documented, and if there’s a clear process for performance improvement plans.

At my companies, I’ve always used structured 30-60-90 day plans for new hires and quarterly check-ins for existing employees. But the audit at one company showed that managers were completing quarterly reviews for only 60% of their reports. The other 40% just slipped through. We fixed it by tying review completion to manager performance scorecards. Completion jumped to 95% the next quarter.

Training audits check for mandatory compliance training (anti-harassment, workplace safety, data privacy) and whether it’s documented with dates and completion records. In California, employers with five or more employees must provide sexual harassment prevention training every two years. Missing that deadline creates direct legal exposure.

The HR Audit Process Step by Step

Here’s how I’ve seen effective HR audits run, based on doing them multiple times.

First, define the scope. Decide whether you’re doing a full audit or targeting specific areas. If you’ve never done one, start with compliance and employee records.

Second, assign the team. This can be internal HR staff, an outside consultant, or a combination. For our first audit, we used an external firm because we wanted an unbiased review. It costs about $15,000 for a company of 50 employees. For subsequent audits, we handled most of it within the company.

Third, gather documentation. Pull every policy, handbook, form, and process document you have. Collect employee files, training records, payroll data, and benefits enrollment information.

Fourth, conduct the review. Go through each area, comparing what you have against what’s required by law and best practice. Use a checklist. SHRM publishes comprehensive HR audit checklist templates that work well as a starting point.

Fifth, document findings. Classify issues by severity: critical (legal risk), important (operational risk), and minor (best practice gap). Our first audit produced 14 critical findings, 23 important ones, and about 40 minor recommendations.

Sixth, build an action plan. Assign owners and deadlines for each finding. Critical items get 30-day deadlines. Important items get 60-90 days. Minor items go on a quarterly improvement plan.

Seventh, follow up. Re-audit the critical findings at 90 days to verify they’ve been resolved. Then schedule your next full audit for 12 months out.

Who Should Conduct an HR Audit

You have three options: internal HR staff, external consultants, or a hybrid approach.

Internal audits are cheaper and faster. Your HR team already knows the systems, the people, and the history. The downside is bias. Internal teams sometimes rationalize gaps they’ve been living with (“we’ve always done it this way”) or avoid flagging issues that implicate their own work.

External audits bring objectivity and specialized knowledge. Firms like ADP, SHRM-affiliated consultants, and boutique HR consulting shops offer audit services. Expect to pay between $5,000 and $25,000, depending on company size and scope. The advantage is credibility. If you’re preparing for a funding round or acquisition, an external HR audit report carries more weight with investors and lawyers.

The hybrid approach, which is what I’ve settled on, uses internal staff for routine annual audits and brings in external help every two to three years or when a major change happens (like entering a new state, acquiring a company, or crossing the 50-employee threshold that triggers FMLA and ACA obligations).

Final Thoughts

In fast-growing companies where everyone is focused on product and revenue, HR audits can feel like overhead. However, every audit I’ve done has paid for itself. The one that caught our contractor misclassification issue saved us from an $80,000 penalty. The one that found our pay equity gap prevented what could have been a discrimination lawsuit. The point isn’t to create bureaucracy. It’s to make sure the systems you’re building for people work the way you think they do.

FAQ

Here I answer the most frequently asked questions about hr audits.

How often should a company conduct an HR audit?

I recommend once a year for a baseline review and every two to three years for a comprehensive external audit. Companies going through rapid growth, entering new states, or preparing for acquisitions should audit more often. After our contractor classification scare, I started running targeted compliance checks quarterly, which took about two days of HR time per cycle.

What is the difference between an internal and external HR audit?

An internal audit is conducted by your own HR team using checklists and self-assessment tools. An external audit uses a third-party firm that brings specialized compliance knowledge and objectivity. Internal audits cost less but can miss blind spots. External audits cost $5,000 to $25,000 but produce findings that carry weight with legal counsel, investors, and regulators.

What areas does an HR audit typically cover?

A full audit covers compliance with employment law, employee records and documentation, recruitment practices, compensation and pay equity, benefits administration, performance management, training completion, workplace safety, and policy currency. Most organizations start with compliance and records because those carry the highest legal risk.

Can small businesses benefit from an HR audit?

Yes. In fact, they need them more. Small businesses often lack dedicated HR staff, which means compliance gaps accumulate faster. A company with 20 employees in two states still has to follow federal, state, and local employment laws. I’ve seen startups with fewer than 30 people accumulate five or six compliance violations without knowing it because nobody was checking.

What happens if an HR audit finds serious compliance issues?

You fix them on the spot. Classify findings by severity and start with the ones that carry legal penalties. If the issue involves wage and hour violations or misclassification, consult an employment attorney. In most cases, proactively correcting the problem reduces or eliminates penalties. The worst outcome is discovering the issue through an external audit or lawsuit rather than finding it yourself.

How much does a professional HR audit cost?

For a company of 50 to 200 employees, expect $8,000 to $20,000 for a comprehensive external audit. Larger companies with multiple locations or international employees can pay $25,000 or more. Some HR consulting firms offer targeted audits (compliance-only or compensation-only) for $3,000 to $8,000. Internal audits cost staff time but no direct fees. The ROI is almost always positive when you factor in avoided penalties and legal exposure.