An HR audit checklist helps a small business test whether its people practices work in real situations. Start with employee locations, pay records, complaint reporting, manager decisions, and access to sensitive information. Record the evidence, the gap, the owner, and the next action for each area.
Picture the handbook sitting neatly in a shared drive while a manager searches three message threads for the person who can approve a pay correction. The document exists. The handoff still fails. This review helps you find that gap and turn it into an action someone owns.
What should a small business HR audit cover?
Use the following eight checks as an operating review. They are a starting point for U.S. employers, not a certification that every employment requirement has been met. Industry, location, workforce structure, and contracts can change the scope.
1. Workforce and location map
List where each employee actually works, who supervises them, and which entity employs them. Include remote arrangements and recent moves. Identify who checks location-specific employment requirements before a move or hire is approved.
Do not assume one employee-count threshold answers every coverage question. The EEOC's small business coverage guide describes different federal thresholds. State and local protections can reach smaller employers.
Evidence to request: the current roster, work locations, reporting lines, and the person accountable for checking coverage.
2. Pay and time records
Choose a recent pay period. Trace actual hours, corrections, approvals, and pay calculations through the system. Ask how employees report work that happened outside their planned schedule. Have a qualified reviewer assess exemption and worker-classification questions separately.
The Department of Labor's recordkeeping fact sheet explains that covered employers must keep accurate required records for nonexempt employees. A schedule alone does not establish what someone actually worked.
Evidence to request: time records, payroll reports, correction history, and a documented route for reporting errors.
3. Hiring and onboarding handoffs
Follow one recent hire from approved role to first assignment. Check whether the job expectations, compensation approval, required onboarding records, system access, and manager responsibilities reached the right people.
Ask the new employee what success looked like in their first week. Compare that answer with the manager's. A mismatch is an operating gap even when every form was signed.
Evidence to request: the role description, offer approval, onboarding checklist, and first check-in record.
4. Complaint reporting and response
Ask how an employee reports a concern about their own supervisor. Test whether the alternative reporting route reaches someone with authority to act. Identify a backup if that person is absent or involved in the concern.
The EEOC's harassment fact sheet recommends accessible reporting procedures with multiple options. A useful audit tests whether employees can use those options in practice.
Evidence to request: reporting instructions, the intake owner, restricted case storage, and a recent anonymized process walkthrough.
5. Performance and manager decisions
Review a sample of expectations, feedback, and follow-through. Can a reader distinguish what happened from the manager's interpretation? Are comparable situations handled consistently? Does the employee's response appear in the record?
Start with the process described in Verk Vibe's performance management field note. Then test an actual record against it.
Evidence to request: role expectations, dated feedback, support commitments, and follow-up dates.
6. Leave and accommodation routing
Ask managers what they do when an employee says a health issue is affecting work or requests time away. Test whether the request reaches the designated HR contact without circulating medical details through ordinary team channels.
This checkpoint assesses routing. Eligibility, notices, documentation, and decisions require review under the applicable rules and the facts of the request.
Evidence to request: escalation instructions, the responsible contact, and an access-controlled record location.
7. Separation and access removal
Walk through a recent departure. Who approved the decision, checked location-specific pay obligations, communicated with the employee, and removed access? Identify where the process depends on a single person's memory.
Evidence to request: a completed departure checklist, access-removal confirmation, and the decision record. Apply retention and preservation requirements before deleting records.
8. HR data and Ai use
Find where employee information travels: shared drives, email, payroll systems, spreadsheets, and Ai tools. Ask who can access it and what happens when someone shares it with the wrong destination.
Evidence to request: an access list, approved-tool list, and an incident-reporting route. Give particular attention to investigation and medical information.
How do you prioritize the findings?
Use three operating categories. These are Verk Vibe's suggested triage categories, not legal classifications.
- Act now: an active safety concern, ongoing alleged harm, suspected pay error, exposed sensitive information, or an approaching legal deadline. Route it to the responsible specialist immediately.
- Repair the process: unclear ownership, inconsistent handoffs, or missing records that need a defined correction plan.
- Improve the system: duplicated work, confusing forms, and avoidable manual steps after urgent issues have an owner.
For every finding, write five things: the observation, supporting evidence, immediate containment if needed, accountable owner, and next review date. Do not call an issue closed because someone sent a reminder. Check that the repaired process actually works.
How often should you run an HR audit?
A practical cadence is a focused quarterly review plus checks after significant changes, such as hiring in a new state, changing payroll systems, or adding a management layer. That is an operating recommendation, not a universal legal schedule. Use more frequent reviews where the risk or applicable requirement calls for them.
Can an HR team of one run the audit?
Yes, if the scope is realistic and someone else can review conflicts involving HR or leadership. Start with one workflow and a small sample. Bring in payroll, security, legal, or an independent HR advisor where the finding exceeds your authority or expertise.
The useful result is a short list of verified problems with owners. That gives leadership something it can act on this week.
Get help turning findings into an operating plan
The practical insight: a process becomes credible when the next person can show how it works. Take one finding into your next leadership meeting with the evidence, the owner, and the decision needed to repair it.
Talk with Verk Vibe about fractional HR support to assess the gaps, prioritize the work, and build the manager routines that keep the fixes in place.
