HR Compliance: What It Covers and How to Stay Audit Ready

HR compliance is the work of making sure your employment practices follow the laws and regulations that apply to your company, and of keeping the records that prove it. In the United States that means federal law, state law and sometimes city or county rules, all applied at once. This guide shows which federal laws apply at which headcount, how long to keep each type of record, what a mistake can cost and how to run an audit.

It covers U.S. federal employment law only. State and local rules add to it and often go further, so treat the tables below as the floor, not the full picture. Every threshold and retention period links to the agency page it comes from. This is general information for HR and people operations teams, not legal advice, so have an employment lawyer review anything that carries real risk.

What Is HR Compliance and How Does It Work?

HR compliance is the process of making your hiring, pay, leave, safety, benefits and termination practices follow the employment laws that apply to your company, and documenting that you did. It's a continuing job rather than a certification you earn once. The rules change, although slowly, your headcount changes and each new state you hire in adds its own requirements.

In practice, the obligations come from four places:

1. Statutes are laws passed by Congress or a state legislature, such as the Fair Labor Standards Act (FLSA) or the Family and Medical Leave Act (FMLA).
2. Regulations and agency guidance are the detailed rules that agencies such as the Department of Labor (DOL) and the Equal Employment Opportunity Commission (EEOC) publish to carry out a statute.
3. Contracts include employment agreements, collective bargaining agreements and, for federal contractors, contract clauses.
4. Your own policies aren't law, but you can be held to them. A handbook that promises a leave policy you don't follow is a problem of your own making, not a gap in the law.

Federal law sets a floor, and states can set a higher one, so what's legal in one office may not be in another. The DOL's FLSA page puts it plainly for minimum wage: where a worker is covered by both state and federal law, the worker is entitled to the higher minimum wage. The same layering applies to leave, final pay, record retention and anti-discrimination rules, so the working rule is to follow the stricter standard for the state where each employee works.

Here's how that works day to day. When someone is hired, HR verifies work authorization on a Form I-9 and sets up pay under wage-and-hour rules. When they need leave, HR checks whether the FMLA or a state law applies. When the company grows past a threshold, new laws start to apply. When the employee leaves, HR handles final pay, benefits continuation and record retention. Compliance is less a project than a habit: asking "which rule applies here and what proves we followed it?" at each of those points.

People often ask for the "types" of HR compliance, and there's no neat answer. There's no official list of four, and sources group them differently. A useful split's by subject: pay and hours, equal opportunity and discrimination, leave and benefits, workplace safety, and records and reporting. The next section organizes the laws that way.

Which HR Compliance Laws Apply to Your Company?

Most federal employment laws switch on at a headcount, so the first compliance task is to count your employees correctly and track when you cross a line. The table lists the main federal laws, who they cover and what they require of HR.

Law	Who it covers	What it requires of HR
Fair Labor Standards Act (FLSA)	Covered employers and employees; federal minimum wage is $7.25 an hour	Minimum wage, overtime at 1.5 times the regular rate after 40 hours in a workweek, records, a posted notice and youth employment limits
Title VII of the Civil Rights Act	Employers with 15 or more employees	No discrimination or retaliation based on race, color, religion, sex or national origin
Americans with Disabilities Act (ADA)	Employers with 15 or more employees	No disability discrimination; reasonable accommodation unless it causes undue hardship
Age Discrimination in Employment Act (ADEA)	Employers with 20 or more employees	No discrimination against workers aged 40 or older
Equal Pay Act (EPA)	Virtually all employers, no minimum headcount	Equal pay for equal work regardless of sex
Family and Medical Leave Act (FMLA)	Private employers with 50 or more employees in 20 or more workweeks; public agencies and schools regardless of size	Up to 12 workweeks of job-protected leave for eligible employees, notices and a posted notice
COBRA	Group health plans of employers with 20 or more employees	Offer continued health coverage after qualifying events, usually for up to 18 months
ACA employer mandate	Employers with 50 or more full-time employees, counting full-time equivalents	Offer affordable coverage to full-time employees and file information returns
WARN Act	Employers with 100 or more employees, not counting part-time workers	60 calendar days' notice before a plant closing or mass layoff
OSHA recordkeeping	Many employers with more than 10 employees; some industries are exempt	Keep injury and illness logs and report severe incidents
Form I-9	Every U.S. employer, for every hire	Verify identity and work authorization within the I-9 rules and keep the form
EEO-1 report	Private employers with 100 or more employees; some federal contractors with 50 or more	Report workforce demographics by job category, sex and race or ethnicity, when the EEOC opens a collection

The numbers come from the agencies themselves: the EEOC's threshold guidance for the 15 and 20 employee counts, the DOL's FMLA fact sheet for the FMLA tests, the DOL's COBRA employer guide for COBRA, the IRS page on applicable large employers for the ACA, the WARN regulation at 20 CFR Part 639, OSHA's recordkeeping page and the EEO data collections page.

How the headcount tests work

The thresholds aren't a single snapshot, and they don't all count the same way:

• Title VII, the ADA and the ADEA look at whether you had 15 (or 20) employees for each working day in 20 or more calendar weeks in the current or preceding calendar year.
• The FMLA looks for 50 employees in 20 or more workweeks in the current or previous calendar year. Whether an individual employee is eligible is a separate test: 12 months with the employer, 1,250 hours worked in the prior 12 months and a worksite with at least 50 employees within 75 miles.
• COBRA counts employees on more than half of your typical business days in the previous calendar year, and part-time staff count as a fraction of a full-time employee based on hours.
• The ACA averages full-time employees plus full-time equivalents across the months of the prior year.
• WARN excludes part-time employees from the 100-employee test, though it also counts a group of 100 or more employees who together work at least 4,000 hours a week.

An example: say a company with 48 employees grows to 52 in March and doesn't shrink again. It doesn't become an FMLA-covered employer in March, because the test needs 50 or more employees in 20 workweeks. Once that count is reached, the company is covered, and it stays covered through the end of the following calendar year even if headcount dips. Put the next threshold on your hiring-plan calendar so the policies and notices are ready before the date, not after. Don't treat the table as a snapshot, because it's a moving target as you hire.

EEO-1 reporting is in flux

The EEOC's data collections page still describes EEO-1 Component 1 as a mandatory annual report for private employers with 100 or more employees, and notes that the 2024 collection is closed and the 2025 collection will be announced there. In July 2026 the EEOC also published a proposal to remove the EEO-1 and several other reporting requirements from its regulations. It's a proposal, so confirm the current status on the EEOC page before you plan staff time for a filing or tell anyone the requirement is gone.

HR Compliance Across the Employee Lifecycle

The laws above are easier to manage when you attach them to the points in the employee lifecycle where HR acts. Each stage below lists what you'll want to get right and which record proves it.

Hiring and onboarding

Every employer must complete a Form I-9 for every person it hires, citizen or not. The employee completes Section 1 no later than their first day of work. You complete Section 2 within three business days after that first day: you examine the documents, confirm they reasonably appear to be genuine and relate to the employee, and record what you saw. Mistakes cluster in timing, in documents that were accepted but not recorded and in forms that are missing entirely. Keep a single owner for I-9 completion and check forms against the instructions, not against memory. Don't wait for an audit to find a form that was never signed.

Anti-discrimination law applies from the job post onward, not just after the hire, so questions in interviews should stay tied to the job. Offer letters, background-check notices where you use them and policy acknowledgments belong in the same onboarding checklist. Our employee onboarding checklist lists these steps with owners.

Record that proves it: a completed I-9 per employee, signed offer letter and acknowledgments.

Pay and hours

The FLSA sets the federal minimum wage at $7.25 an hour and requires overtime at not less than one and one-half times the regular rate for hours over 40 in a workweek, unless the employee is exempt. Exempt status isn't a job title or a salary alone, but a mix of both plus the duties actually performed. For the executive, administrative and professional exemptions, the DOL's overtime fact sheet requires a salary of at least $684 per week plus a duties test, and the duties test is where most misclassification disputes are decided. Where a state sets a higher minimum wage or overtime rule, the higher standard applies.

You'll need accurate time and pay records for every non-exempt employee, and they're what an investigator asks for first. The DOL lists the basics: name, address, occupation, the start of the workweek, hours worked each day and week, the basis of pay, regular rate, straight-time and overtime earnings, deductions and additions, total wages and the date and period of payment.

Record that proves it: time records, payroll registers and exemption analyses on file for each exempt role.

Leave and benefits

If you're an FMLA-covered employer, an eligible employee can take up to 12 workweeks of job-protected leave in a 12-month period for the qualifying reasons (the military caregiver provision has its own, longer limit). HR's job is to display the FMLA notice and to give the required notices when an employee asks for leave. Track the 12-month period with one method, and don't switch it mid-year. Keep it consistent, and keep leave requests, designations and notices in a file separate from the general personnel file.

Group health plans of employers with 20 or more employees trigger COBRA. After a qualifying event such as termination or reduced hours, the plan must offer continuation coverage, typically up to 18 months, and the DOL notes that people have 60 days to elect it. Missed COBRA notices are a common but avoidable error, and they usually happen because the notice usually depends on a handoff between HR, the benefits administrator and payroll.

Record that proves it: leave notices and designations, COBRA notices with proof of delivery.

Safety and incident reporting

OSHA requires all employers to notify it within 8 hours of a work-related death and within 24 hours of an in-patient hospitalization, an amputation or the loss of an eye. Many employers with more than 10 employees must also keep injury and illness logs on OSHA forms 300, 300A and 301, unless their industry is exempt. Some establishments must submit their data electronically each year between January 2 and March 2. Safety is usually owned outside HR rather than inside it, so agree who records, who reports and who checks the deadline. That's a handoff, and handoffs are where deadlines get missed.

Record that proves it: the OSHA logs and incident reports, kept for five years after the year they cover.

Termination and layoffs

Final pay timing, benefits notices and access removal all land at exit. The federal WARN Act requires 60 calendar days' notice for a plant closing or mass layoff at covered employers, and its tests count employment losses at a single site over 30 or 90 days, so plan a reduction in force with a lawyer before the first notice goes out, not after. Send the COBRA notice, collect equipment and revoke access on the last day. That's why the exit checklist matters, and our employee offboarding checklist puts these in order.

Record that proves it: separation documents, final pay records and a dated access-removal log.

How Long Should You Keep HR Records?

You should keep HR records for at least the longest retention period that applies to them, and that period is set by different agencies for different records. The table collects the federal minimums.

Record	Keep for at least	Source
Form I-9	The later of three years after the date of hire or one year after employment ends	USCIS Handbook for Employers (M-274)
Payroll records under the FLSA	3 years	DOL Fact Sheet #21
Time cards, wage rate tables, work schedules and records of wage additions or deductions	2 years	DOL Fact Sheet #21
Personnel and employment records (hiring, promotion, discharge) under EEOC rules	1 year; for an involuntary termination, 1 year from the termination date	EEOC recordkeeping requirements
Payroll records under the ADEA	3 years	EEOC recordkeeping requirements
Records that explain pay differences between men and women in the same establishment	2 years	EEOC recordkeeping requirements
OSHA 300 log, privacy case list, annual summary and 301 incident reports	5 years following the end of the calendar year they cover	29 CFR 1904.33

The sources are USCIS's Form I-9 retention page, the DOL's Fact Sheet #21, the EEOC's recordkeeping page and the OSHA retention rule.

Two practical points you'll want to remember. First, keep I-9s in a separate file from personnel files so you can produce them within three business days of an inspection request, which is the window USCIS gives for paper forms kept on site or off site. Second, when a state sets a longer retention period, keep the longer one. A single retention schedule that uses the longest period per record type is simpler than one schedule per law, and it's easier to defend.

Common HR Compliance Issues

The same handful of problems cause most compliance trouble. It's rarely malice; it's usually a manager who didn't know the rule. For each, here's what it looks like and the fix.

Misclassifying workers. Calling someone an independent contractor or an exempt employee doesn't make them one, whatever the contract says. Under the FLSA, the DOL applies an economic reality test that asks whether the worker is economically dependent on the employer or is in business for themself, and its guidance says the label the parties use isn't relevant. Don't just accept the contract label; review every contractor who works set hours, uses your equipment or does the same work as employees, and review every exempt role against the duties test.

Overtime and off-the-clock work. Unpaid pre-shift setup, post-shift tasks and answering messages after hours are the usual sources, and they're easy to miss. The fix isn't a new policy but accurate, complete time records, and managers who know they can't ask for unrecorded work.

Unequal pay. The Equal Pay Act applies to nearly all employers. Review pay by role and level at least once a year instead of only at hiring, and document the non-sex-based reason for any gap.

I-9 errors. Missing forms, late completion and unrecorded document details are routine findings in audits. A quarterly check of new-hire forms catches them while the employee is still on the payroll.

Missing notices. Federal posters, including the FLSA and FMLA notices where they apply, must be displayed. For remote and hybrid workforces, put the notices on the intranet or in the onboarding packet as well. The DOL's poster page and its elaws Poster Advisor show which ones you need.

Inconsistent discipline and termination. Two people with the same conduct and different outcomes is how discrimination and retaliation claims get started, and the paperwork rarely explains the difference after the fact. Write down the reason, apply the policy the same way and have a second person review terminations, because you'll want a record that wasn't written after the fact.

Poor records, the quiet problem. An accurate file you can produce on request is the difference between a short inquiry and a long one, and that's usually a matter of filing habits rather than law. Records scattered across email, HR software and a manager's drive fail that test.

What Happens When HR Gets Compliance Wrong?

The cost of non-compliance is usually back pay, damages and legal fees first, and agency fines second. It isn't only the fine that hurts. The fines are still worth knowing, but they change every year, so don't memorize them.

• FLSA: the DOL's civil money penalty table lists up to $2,515 per violation for repeated or willful violations of the minimum wage or overtime provisions. The DOL states the 2026 amounts are unchanged from 2025. Employees can also recover unpaid wages.
• FMLA: a willful failure to post the required notice carries a penalty of up to $216, which is small, but a missing notice can also weaken your position in a later leave dispute.
• OSHA: maximum penalties are adjusted for inflation each year and are listed on OSHA's penalties page; willful or repeated violations carry the largest amounts.
• Form I-9: paperwork violations carry a civil fine per form, adjusted annually under 8 CFR 274a.10, so a pattern across many employees adds up quickly.
• Discrimination claims: an employee generally must file a charge with the EEOC within 180 days of the alleged act, or 300 days where a state or local agency enforces a similar law. That's a long window for something you did last spring.

The amounts above come from the DOL's penalty adjustment table and agency pages; check the agency page for the current figure before you quote one, and note that state agencies set their own penalties.

How to Run an HR Compliance Audit

An HR compliance audit's a structured check that your practices and records match the laws that apply. Run a small one every quarter for the areas that move fastest and a full one once a year. Don't try to boil the ocean on the first pass; you'll stall.

1. Set the scope

   Choose the entities, states and areas to review. For a first audit, start with the areas that carry the most exposure: Form I-9, pay and overtime, leave, and classification of exempt employees and contractors.

   Owner: head of People · 1 hour

2. List the laws that apply

   Use the threshold table above, then add each state where you have employees. Write the list down with the date so you can show that you checked it.

   Owner: People Ops with counsel · 2 to 4 hours

3. Sample the records

   Pull 10 to 20 records per area, or all of them if you have fewer. Include recent hires, recent leavers and at least one employee from each state. Check each against the rule, not against the last audit.

   Owner: HR generalist · 1 to 2 days

4. Log findings with a fix, an owner and a date

   Rate each finding by risk and by whether it can be fixed now. Fix errors on forms where the instructions allow it, and don't backdate anything. Where you can't tell whether something is an error, ask counsel before you change a record.

   Owner: head of People · 2 hours

5. Close the loop and schedule the next audit

   Re-check the fixed items after 30 days, since a fix that isn't verified isn't a fix, update the retention schedule and put the next audit on the calendar. Report the number of findings and the number closed to leadership; they'll care about the trend more than the list.

   Owner: People Ops · ongoing

Ask counsel to run the first audit under attorney-client privilege if you suspect serious problems, since audit notes that describe violations can otherwise be requested in a dispute. You wouldn't want your own notes used against you, and they're easy to protect if you plan ahead. For a routine check of forms and notices, an internal audit's fine.

HR Compliance Calendar: Who Does What and When

Compliance slips when nobody owns the date, not because people don't care. This calendar ties each recurring task to an owner and a trigger. Here's a version to adapt, and you'll want to rename the owners to match your team.

1. HRComplete and review Form I-9 for the new hire At hire
2. PayrollRecord hours, apply overtime and keep payroll records Every pay period
3. HRSend FMLA notices and designate leave When leave is requested
4. Safety leadReport fatalities within 8 hours and hospitalizations, amputations or eye loss within 24 hours At the incident
5. Safety leadSubmit injury and illness data electronically if your establishment must January 2 to March 2
6. HR with counselCheck headcount against thresholds and update policies and notices Quarterly
7. HR with counselPlan WARN notice for a closing or mass layoff At least 60 days before
8. BenefitsSend the COBRA election notice After a qualifying event
9. Head of PeopleRun the compliance audit and review the retention schedule Every year

HR Compliance Checklist

Use this as a quick self-check; it's not a full review. A full department checklist deserves its own page, so this one stays short, and it's meant for a quick pass rather than a complete review.

Where The People Ops Manager Fits

Several compliance tasks sit inside onboarding and offboarding: a person has to complete the paperwork, a manager has to approve an access change and someone has to confirm that equipment came back. When those tasks are spread across HR, IT, finance and managers, the usual gap is that nobody can see which one is still open. That's the gap the product below is built for, and it's all it claims to do. It isn't a compliance engine, it doesn't give legal advice and it doesn't store identity documents, so it doesn't replace your HRIS or an I-9 system.

HR Compliance FAQ

• GuideEmployee onboarding checklist
• GuideEmployee offboarding checklist
• GuideHR metrics: definitions, formulas and how to choose them
• SoftwareBest HRIS software