HR Compliance Checklist for Small and Growing Businesses

An HR compliance checklist is a list of the employment-law tasks a company has to complete and the records it has to keep, from the first job post to an employee’s last day. For a small or growing business, it is the practical side of the wider picture in our small business compliance guide, which explains what federal law adds at 15, 20, 50 and 100 employees.

This checklist is written for companies of roughly 10 to 500 people, where HR is often one person or a part of someone else’s job. It is organized by the stages of an employee’s time with you, it says what proof to keep for each item, and it ends with a calendar and an audit routine, because doing the work is only half of HR compliance and being able to show it is the other half.

Key takeaways

• An HR compliance checklist covers hiring, onboarding, pay and hours, leave, safety, policies and leaving, with the proof to keep for each item.
• What applies depends on headcount, so recheck the list each time you cross 15, 20, 50 or 100 employees.
• Most HR compliance failures aren’t missing policies but missing proof, such as an acknowledgment for last year’s handbook only.
• A yearly calendar and a small sample audit keep the checklist honest without a dedicated compliance team.

What HR compliance covers

HR compliance means following the employment laws that apply to your company and keeping the records that show you did. At a small company it runs through four stages of each person’s time with you, with written policies and records sitting behind all of them.

Which HR laws apply at your size

The checklist grows as you hire, because several federal laws only apply above a certain number of employees and each counts employees in its own way. Use this table to see which parts of the checklist apply to you today, and our guide to employment laws by number of employees for the counting rules.

Sources: 42 USC 2000e(b), 29 USC 630(b), 29 USC 1161(b), 29 CFR 825.104, IRS, Determining if an employer is an applicable large employer, 29 CFR 1602.7, 20 CFR 639.3, 29 CFR 1904.1

State and local laws often start at lower headcounts and add their own leave, pay, notice and training rules, so check the rules wherever your people work. This checklist covers federal law and is general information rather than legal advice.

The HR compliance checklist

Work through each section once a year, and again whenever you cross a headcount threshold or start hiring in a new state. For each item, the question isn’t only whether you do it but whether you could show someone that you did.

Hiring

• Job posts and interview questions. Check they describe the job and skills and avoid questions about protected characteristics such as age, religion, pregnancy or disability. Keep the posting and the interview notes.
• Employee or contractor. Decide each person’s status on how the work is actually done, not on what the contract calls it, and write down why.
• Exempt or non-exempt. Decide whether each role is entitled to overtime based on its duties and how it is paid, and record the decision so it can be checked later.
• Background and reference checks. Where you use them, get written consent first and follow the notice steps before acting on what you find.
• Offer letters. Keep pay, status and start date in writing, and avoid promises your handbook contradicts.

Onboarding

• Form I-9. Complete the employee section by the first day of work and the employer section within three business days, and keep each form for three years after hire or one year after the person leaves, whichever is later.
• Tax forms and new-hire reporting. Collect the federal and state withholding forms and report each new hire to the state on the timeline it sets.
• Handbook and core policies. Give each new person the current handbook and the policies that apply to their team and location, and collect an acknowledgment of the exact version they received.
• Safety training. Train people on the hazards of the work they will do before they start it, and record who was trained on what and when.

Source: 8 CFR 274a.2

Pay and hours

• Hours and overtime. Track hours for every non-exempt employee and pay overtime for hours over 40 in a workweek, at no less than one and a half times the regular rate.
• Payroll records. Keep payroll records for at least three years and the timecards behind them for at least two.
• Equal pay. Check that people doing substantially equal work are paid equally, and that any difference has a reason you can explain.
• Breaks and state rules. Follow your state’s rules on breaks, pay frequency and pay statements, which are often stricter than federal law.

Sources: 29 USC 207, 29 CFR 516.5, 29 CFR 516.6

Leave and accommodation

• Written leave policy. Once you reach 50 employees, explain family and medical leave in writing, including who is eligible, and handle each request with the notices the law requires.
• Accommodation requests. From 15 employees, handle requests related to disability or pregnancy through a written process, and record the request, the discussion and the decision.
• Military leave. Every employer, whatever its size, has to protect the jobs of employees called up for military service.

Sources: 29 CFR 825.104, 29 CFR 825.110, 42 USC 12111, 38 USC 4303

Workplace safety

• Hazards and written programs. Identify the hazards in your workplace and keep the written programs OSHA requires for them, such as hazard communication wherever hazardous chemicals are used.
• Injury records. With more than 10 employees, and outside the partially exempt industries, keep the injury and illness log and post the yearly summary from February through April.
• Serious incidents. Every employer reports fatalities, in-patient hospitalizations, amputations and losses of an eye to OSHA within the deadlines set out in the rules.

Sources: 29 CFR 1904.1, 29 CFR 1904.32, 29 CFR 1904.39, 29 CFR 1910.1200

Policies and the handbook

• Equal opportunity and anti-harassment. From 15 employees, have a written policy with a clear way to raise a complaint, and a record that each person received it.
• Handbook reviewed every year. Check it against new federal and state laws and against how your company actually works now, and have each change approved before it goes out.
• Changes acknowledged again. When a policy changes, send the new version to the people it applies to and collect new acknowledgments, so your record covers the version in force rather than last year’s.
• One owner per policy. Name a policy owner for each policy, with a review date, so nothing goes stale because it belonged to everyone.

Records and notices

• Personnel records. Keep hiring, promotion, discipline and termination records for at least one year from the record or the decision, and longer where a charge or lawsuit is pending.
• Posters and notices. Display the federal and state workplace notices that apply to your size and industry where employees can see them, and share them electronically with remote staff.
• Retention schedule. Write down how long you keep each type of record and who is responsible, as set out in our records retention schedule guide.

Source: 29 CFR 1602.14

Leaving

• Final pay. Pay final wages on the timeline your state sets, which can be the last day of work in some states.
• Benefits notices. Send continuation coverage notices where COBRA or a state law applies, on the timelines they set.
• Access and property. Remove system access the same day and recover company property.
• Records. Keep the person’s records, including their acknowledgments, for as long as the law and your retention schedule require.

Every item needs its proof

Most HR compliance problems at small companies aren’t missing policies but missing proof. The policy existed, but nobody can show who received the current version, or the handbook was signed once at hiring and never again after three rounds of changes.

The policy items are where software helps most, because they repeat every time something changes. In AllyMatter each policy goes through an approval workflow before anyone sees it, tags send it to the right teams and locations, each person acknowledges it while signed in, and the record keeps their name, the version and the time, while automatic reminders follow up with anyone who hasn’t confirmed.

An HR compliance calendar

A checklist you run once a year in a rush tends to miss things, so we suggest spreading the work across four quarters. Our compliance calendar covers filing and review dates beyond HR as well.

Sources: IRS, General Instructions for Forms W-2 and W-3, IRS, Information reporting by applicable large employers, 29 CFR 1904.32, eeoc.gov EEO data collections

Who owns HR compliance at a small company

At 20 people, HR compliance usually belongs to one HR or operations generalist, with a founder approving the policies. By 100 people the work has spread: HR owns the handbook and leave, IT owns acceptable use and security, operations or a safety lead owns the written safety programs, and finance owns payroll records, so the checklist needs an owner next to every section.

The simplest way to keep that straight is to give each policy one owner and a review date, and to keep the approvals and acknowledgments in one place where any owner can see them. Our guide to policy governance explains how to set that up as the company grows.

How to run an HR compliance self-audit

An HR audit checks real records against the checklist, which is how you find the gaps before someone else does. For a small or mid-sized company, a light version once a year is enough.

1. Pick a sample. Pull a handful of personnel files, I-9s and timecards from different teams, locations and hire dates, including your earliest hires.
2. Check each against the checklist. Look for missing forms, missing acknowledgments, out-of-date policies and decisions with no written reason.
3. Check the policies themselves. Confirm each one is the approved version, that it went to the right people, and that its review date hasn’t passed.
4. Fix and record. Correct what you find, note what you changed and when, and send any updated policy back out for acknowledgment.
5. Set the next date. Put next year’s audit on the calendar, with a smaller check in between if you are growing fast.

Questions about HR compliance checklists

What is an HR compliance checklist?

It is a list of the employment-law tasks a company has to complete and the records it has to keep, organized so someone can work through it and check nothing is missing. A useful one covers hiring, onboarding, pay and hours, leave, safety, policies and leaving, and says what proof to keep for each item.

What HR documents are legally required for a small business?

Federal law requires a Form I-9 for every employee, payroll and hours records, and tax forms from the first hire, plus injury records once you have more than 10 employees in most industries. A written handbook isn’t required by federal law, but it is the usual place for the policies that become important at 15 and 50 employees, and state laws add their own notices and records.

How often should a small business do an HR compliance audit?

Once a year is a sensible minimum, with an extra check whenever you cross a headcount threshold, hire in a new state, change benefits or take on a customer or certification that brings new requirements. Many companies spread the work across the year so no single month carries all of it.

Who should own HR compliance at a small company?

Usually an HR or operations generalist, with a founder or senior leader as the person who approves policies. As the company grows, ownership spreads, with IT owning security policies and operations owning safety, so each policy needs one named owner and a review date.

Does a small business need an employee handbook?

Federal law doesn’t require one, but most small businesses benefit from a short handbook as soon as they hire, because it is where pay, conduct, equal opportunity and complaint procedures are written down and acknowledged. It matters most once anti-discrimination law applies at 15 employees.

What is the difference between an HR compliance checklist and an HR audit?

The checklist is the list of what should be in place, while the audit is the act of checking a sample of real records against it, such as pulling ten I-9s or five personnel files to see whether they are complete. A checklist without an audit tells you what you intended, not what actually happened.

HR compliance at a small business is mostly a matter of doing a known list of things on time and keeping the proof as you go. On yearly plans, migration is on us, and we’ll move your handbook and policies from SharePoint, Google Drive, Confluence or Notion, usually within a week and often sooner.

Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.