Small Business Compliance · 16 min read
Small Business Compliance Guide: How Hard It Is and How to Stay Compliant
Compliance is hard for a small business mainly because of volume and proof, not because any single rule is complicated. A US company can fall under 70 federal obligations, more than half of which require something in writing, and each state adds more on top. To stay compliant you need to know which rules apply to you, write down how you meet them, tell the right people, keep the records and check all of it on a schedule, usually without anyone doing this full time.
I’ve been through ISO 9001 audits more than ten times, ISO 27001 twice, and SOC 2 and HIPAA, and I’ve seen the same problem from the small company’s side, including five versions of an NDA that depended on when someone joined and signatures scrambled together before an audit. This guide uses the obligations data we keep at Policy and Compliance to show how much there really is, which requirements are toughest, how to meet them in a sensible order and how to keep them met.
How hard is compliance for a small business?
Here is what the numbers look like. We count these in the obligations register behind Policy and Compliance, which covers federal rules, every state and sector requirements.
| What we counted | Number | What it means |
|---|---|---|
| Federal obligations a US business can fall under | 70 | Across general employment and sector rules; no single company faces all of them |
| Of those, needing a written policy, plan or program | 39 | More than half, so the paperwork is the rule and not the exception |
| Needing a filing or report | 16 | Each one has a deadline |
| Needing a license or registration | 9 | Mostly by industry, and many renew |
| Needing a workplace posting | 5 | Simple, and easy to forget at a new site |
| Applying to employers in general | 27 | 14 start with your first employee, and 13 more arrive as you grow to 100 |
| Extra federal rules in one regulated sector | Up to 9 | Healthcare and financial services carry the most |
| State obligations | 752 | About 15 per state on average, and from 11 to 24 depending on the state |
Source: Policy and Compliance obligations register, read 1 November 2026. Counts are indicative: depth of checking varies by row, and they are not a legal list for any one company
No company faces all of this. A 30-person marketing agency in one state might deal with around 20 federal items plus its state’s list, while a 30-person home health agency adds HIPAA, accreditation and a compliance program, and a trucking firm of the same size adds driver files, drug testing and hours-of-service records. That is the first reason a generic checklist so often disappoints: it is usually too long and too short at the same time.
Federal employment rules also arrive in stages as you hire, which is why a company can be fully on top of things at 12 people and exposed at 16 without having changed anything.
The cost of compliance falls hardest in the middle
The best evidence on cost comes from economists Francesco Trebbi and Miao Ben Zhang, who measured the share of company pay that goes to compliance work across the US economy. They put it at about 1.3 percent of the wage bill on average, varying widely by industry and rising over time. It doesn’t fall evenly either. The share rises with size and peaks at workplaces of around 500 employees, then declines at larger scale.
Source: Trebbi and Zhang, The Cost of Regulatory Compliance in the United States, NBER Working Paper 30691
Their measure only covers staff time, so it leaves out software, auditors and lawyers, but the shape of the curve fits what I have seen. A company of 10 can get by informally. A company of 10,000 has a department. It is the company of 60 or 300 that has enterprise-sized duties and a small-company budget, and that is who this guide is for.
Customers now ask for more than the law does
Much of today’s compliance work isn’t required by any law. It comes from customers, through security questionnaires, supplier audits and contract terms. ISO’s own survey counted about 1.48 million ISO 9001 certificates and nearly 97,000 ISO 27001 certificates worldwide in 2024. For many small suppliers, one of these is the price of selling to a bigger company, and the deadline comes from a sales conversation rather than a regulator. Our guide to security questionnaires covers how to handle those.
Source: ISO Survey 2024
Why compliance feels so hard
It is nobody’s job. In most companies under 200 people, compliance sits with an office manager, the head of HR or a founder, on top of their real work. It gets attention when something is due and none in between.
The rules depend on facts that keep changing. Headcount, states, products and customers all move, and nobody sends you a letter when you cross a threshold. Remote work makes this worse, because hiring one person in a new state can bring that state’s rules with them.
Doing it isn’t enough. You also have to prove it. A safety briefing that happened but wasn’t recorded looks exactly like one that never took place. In audits the rule is simple: if it isn’t documented, you can’t show it.
Laws keep changing. FDA’s quality rule for medical devices was rewritten and took effect in February 2026, and ISO 9001 has a new 2026 edition, which puts certified companies on a transition. Nobody at a small company has time to watch all of this.
The advice is split. Your lawyer, payroll provider, insurer and IT provider each see one part, and nobody has the whole list.
Which compliance requirements are hardest?
This is my own ranking from working through these as a company, not an official scale. What separates the easy ones from the tough ones is whether a requirement can be met once, or whether it needs records of ongoing behavior.
| Requirement | Who it hits | What makes it hard | Effort |
|---|---|---|---|
| Workplace posters and new-hire filings | Every employer | Nothing but remembering | Low |
| Form I-9 and pay records | Every employer | Short deadlines per hire, and years of retention | Low, but constant |
| Harassment, discrimination and accommodation | 15 or more employees, and earlier in some states | A policy is easy; a working complaint process and proof that staff received it are not | Medium |
| Family and medical leave | 50 or more employees within 75 miles | Case by case, with notices and timing rules for each request | Medium to high |
| OSHA written programs | Depends on the hazards | Plans, training and logs have to match what happens on site | Medium to high |
| HIPAA | Providers, health plans and their business associates | A risk analysis, written policies, training and agreements with vendors, with records kept for six years | High |
| SOC 2 | Software and service firms, when customers ask | A Type 2 report tests whether controls worked over a period of months, so a gap can’t be fixed afterward | High |
| ISO 9001 and ISO 27001 | Companies selling to customers who require them | A full management system, an outside audit and surveillance audits every year of a three-year cycle | High |
| SEC, FINRA, AML and FTC Safeguards rules | Advisers, broker-dealers and other financial firms | Named officers, annual reviews and testing, from the first employee | High |
| CMMC | Defense contractors | Long security requirements, and for some levels an outside assessment | Very high |
Notice the pattern as you go down the table. The easy items happen at a moment, and you are done. The tough ones ask you to show that something kept happening for months. You can’t catch up on those the week before an audit, which is why starting early matters more than working hard at the end.
For detail on specific standards, including what each one requires, Policy and Compliance covers them one by one, and we have guides to SOC 2 policies, the ISO 9001 surveillance audit and CARF accreditation.
How to meet your compliance requirements
You don’t need to do everything at once, and trying to is the most common way this stalls. Work through these steps in order. For a company of 50 people with little in writing, 90 days of part-time effort is a realistic target for the core set.
1. Build your list
Write down five facts: your headcount in each location, the states people work in, your industry, the kinds of data you hold and what your customers require in contracts. Then list what applies, with who enforces it, what it requires you to produce and how often. This one page does more good than any software purchase. Our guide to laws by headcount and HR compliance checklist are a good starting point, and an employment lawyer can review the result in an hour or two, which costs far less than having them build it.
2. Rank by risk
Not everything matters equally. Start with what could hurt someone, what could stop you trading, what a customer is waiting for and what has a date attached. Leave the rest for later, on purpose and in writing.
3. Name an owner for each item
Every obligation needs one person, not a team. A policy owner keeps a document current and answers for it, and the person who coordinates the whole list needs protected time. Half a day a week is often enough for a company of under 100.
4. Write the policies you need
Write short policies that describe what you really do. Start with a handbook, then add the standalone policies your list demands, such as harassment, information security, acceptable use and, increasingly, AI use. Keep steps out of the rules, as we explain in policy vs procedure vs SOP. Every promise you write down is a promise you can be audited on.
5. Approve and tell people
Each policy needs someone senior to approve it, and the people it covers need to receive it and confirm it. Record that confirmation by name and version. Acknowledgment tracking sounds like admin, but it is usually the first thing an auditor or a court wants to see, and for a code of conduct or a security policy you may want a stronger attestation.
6. Train where the rule asks for it
Some obligations require training outright, and others only work if people know what to do. Keep it short and specific to the job, and keep the attendance record with the policy it relates to.
7. Keep the evidence together
Decide where the proof lives. Inspections, certificates, training logs and signed forms should sit next to the rule they support, because that is the order an auditor asks in. Check your retention periods as well, since some records must be kept for years. OSHA injury logs are kept for five years, for example, and HIPAA documentation for six. Our guide to records retention schedules explains how to set this up.
Sources: 29 CFR 1904.33, 45 CFR 164.316(b)(2)(i)
8. Test yourself
Pick ten records and try to find each one, timing how long it takes. That exercise tells you more than any self-assessment. Our guide on how to prepare for a compliance audit covers this in depth, including the 90-day and two-week plans.
How to ensure ongoing compliance
The first pass is a project, and everything after it is a habit. Companies that stay compliant aren’t the ones that work harder. They are the ones that made it boring, and treat it as a loop that runs through the year.
Run it from a calendar
Put every deadline in one compliance calendar, with an owner for each. This table is a starting rhythm for a company of 20 to 200 people. Adjust it to the rules on your list.
| How often | What to do |
|---|---|
| Every new hire | I-9, new-hire report, core policies sent and confirmed, role training, system access by role |
| Every leaver | Access removed, final pay checked, records kept |
| Every month | Check who hasn’t confirmed what, look at overdue reviews and open findings, and look through what is due next month on the calendar |
| Every quarter | Payroll filings, access reviews if you promised them, a sample of ten records, and a headcount check against the thresholds |
| Every year | Review policies, repeat required training, renew licenses, run an internal audit, and rebuild your list of what applies |
| When something changes | New state, new product, new customer requirement, new law, an incident or an audit finding: update the list and the policies it touches |
Watch for the events that change your list
Most lapses come from an event that nobody connected to compliance. Build these into your routines: the first hire in a new state, crossing 15, 20, 50 or 100 employees, a new product or a new type of customer data, a contract with new security terms, a new vendor who touches sensitive data, and a change of the person who owns compliance. Have HR flag headcount each quarter, and have sales flag any contract that promises something new.
Review policies on a date, not when you remember
Give every policy a review date and let the system remind you. A yearly review is a common default, and riskier areas may need more. If a policy is still right, record that it was reviewed. If it changes, approve the new version and send it out again, since people who confirmed the old wording haven’t confirmed the new one. Our guide to policy governance sets out how to run this.
Stay on top of law changes
Pick your sources: the agencies on your list, a trade association, your lawyer’s client alerts and your payroll provider. When something changes, ask three questions: does it apply to us, which policy does it touch and who needs to know? Then record the decision, even if the answer is that nothing needs to change, because that note is what shows you were paying attention.
Check your own work
Every quarter, sample a few records. Once a year, run an internal audit with someone who didn’t do the work. When you find a problem, record the fix, the reason it happened and how you know it stayed fixed. Findings you caught yourself are far better than the same findings from an auditor.
When to get outside help
Use an employment lawyer to review the handbook, for terminations and for anything involving a complaint. Use a consultant for a first certification, where experience saves months, and through a fractional arrangement if you can’t justify a hire. Use an outside auditor or a friendly peer for a first internal audit. Use your payroll provider or PEO for filings, but remember that they cover their slice and that the responsibility generally stays with you.
How much compliance software does a small business need?
Buy for the work that repeats. Policies and acknowledgments repeat, so they are worth a tool early on. A shared drive and spreadsheet can work at first, and they stop working when someone asks who confirmed which version. Technical evidence for SOC 2 is a separate job, which automation platforms handle. Our guide to the best policy management software for small business compares the options by situation.
How AllyMatter helps a small business stay compliant
We built AllyMatter so that a small or medium business can run the paper side of compliance without a compliance team, whatever it needs to comply with. It doesn’t decide which laws apply to you, and it doesn’t replace your lawyer. It keeps the rules you have decided on approved, in front of the right people, confirmed and ready to show.
| The hard part | How AllyMatter helps |
|---|---|
| Nobody knows which version is current | Only the approved version reaches your people, and earlier versions are kept |
| Nobody signed off | Every document goes through an approval flow of up to four steps before anyone sees it |
| The right people didn’t get it | Tags decide the audience, so a warehouse policy goes to the warehouse and a new hire with the right tags gets the right documents |
| You can’t prove anyone read it | Each acknowledgment records the person, the version, the date and the time, with automatic reminders |
| Reviews get missed | Review dates raise alerts and emails when a policy is due |
| Laws change | When laws change, we tell you, so you know what to revisit |
| The evidence is scattered | Certificates, training records and reports attach to the policy they support, and the log exports as a PDF or CSV |
| An auditor wants access | Give them Viewer access limited to what their tags allow |
Common small business compliance mistakes
Copying another company’s policies. A template full of promises you don’t keep is worse than no policy, because it is written evidence of a gap.
Treating it as a one-time project. Policies written for one audit and never reviewed are out of date by the next one.
Keeping proof in email. When the person leaves, the proof usually goes with them.
Waiting for a trigger. Companies often start when a big customer sends a questionnaire with a deadline, and a rushed pass costs far more than a steady one.
Assuming a provider handles it. A PEO or payroll company carries out specific tasks. Ask them in writing what is theirs and what stays with you.
Forgetting contractors. Confidentiality and security policies often need to reach them too, and they are usually missing from the list.
Questions about small business compliance
How hard is compliance for a small business?
The individual rules are rarely hard. What makes it hard is the number of them, the fact that they change with your headcount, your states and your customers, and the need to prove each one on request, usually with nobody whose full-time job it is. Most small companies find that the first full pass is the heavy part, and upkeep is manageable if it runs on a calendar.
What compliance does a small business need?
It depends on five things: how many people you employ, where they work, what industry you are in, what data you hold and what your customers require. From your first employee, expect pay records, I-9s, tax filings, workers’ compensation, safety duties and workplace posters. Our guide to small business compliance by headcount shows what is added at 15, 20, 50 and 100 employees.
What is the hardest compliance requirement for a small business?
In my experience the hardest are the ones that test you over time and not at one moment, such as a SOC 2 Type 2 report, ISO certification and HIPAA, because you need records from months of normal work. For a company with no certifications, the toughest is often leave and accommodation, since each case is different and timing matters.
How long does it take to become compliant?
A company of 50 people with no written policies can usually put the core set in place in 90 days of part-time effort. Certifications take longer, and a first ISO 27001 certificate or SOC 2 Type 2 report commonly takes the better part of a year, including the period being tested.
Do small businesses need a compliance officer?
Usually not a full-time one, unless a rule names one, as SEC rules do for advisers and the FTC Safeguards Rule does for financial institutions with its qualified individual. What every company needs is one named person responsible, with enough time to do it and help from outside when needed.
How do you stay compliant as a small business?
Put compliance on a calendar, give every policy an owner and a review date, record who confirmed each version, keep the evidence with the policy it supports, and recheck what applies to you when your headcount, states or customers change.
What happens if a small business is not compliant?
It depends on the rule. Results range from a fine, a lawsuit or an order from a regulator to a lost customer or a failed audit. For many small companies, the first consequence is commercial: a security questionnaire goes unanswered and a deal stalls.
Can software make a small business compliant?
No software makes you compliant, because compliance is what your company actually does. Software can make the work repeatable and the proof easy to produce, which is where small companies usually fall down.
Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.