HR Due Diligence Checklist for Indian Startups
The HR and payroll due diligence checklist Indian startups need before a funding round, acquisition or audit, with red flags, a data room structure and a 90-day readiness plan.
Why HR due diligence decides how smoothly your next big moment goes
Somewhere between the term sheet and the close, a spreadsheet arrives. It has 140 rows, each one a document request, and about a third of them are about people. That is HR due diligence, and for most Indian startups it is the workstream that quietly eats the most calendar time and creates the most avoidable friction.
This is a practical walkthrough of what reviewers ask for, what "good" looks like, and how to get ready in ninety days — written for the person who has just been told the HR and payroll data room needs to be ready by month end, and is now staring at a shared drive full of folders named Final_v3_updated_NEW.
One thing up front. This is general guidance, not legal, tax or accounting advice. Indian employment and payroll law spans multiple central and state statutes, and rates, wage ceilings, thresholds, filing dates and consequences change over time and vary by state, headcount and establishment type. Nothing here states what the current numbers are. Every time you need a figure or a date, verify it with the relevant authority or your own advisors.
What HR due diligence actually is
HR due diligence is a structured review of everything connecting your company to the people who work for it — employment relationships, compensation, statutory obligations, records, liabilities and risk.
It is an evidence exercise, not a judgement on your HR team. The reviewer's job is to move from what you say to what you can show. If you say you have 212 employees, they want three independent sources that agree.
It appears in four contexts, and the questions rhyme across all of them:
- Investor diligence, run by the investor's counsel, focused on liabilities that land on the balance sheet.
- Acquisition, run by the acquirer's HR, finance and legal teams — everything an investor looks at, plus integration questions.
- Pre-emptive internal audit, finding problems while you still control the timeline.
- Statutory audit, narrower, but it hits the same records.
The four questions behind every request
- Real headcount. Not the deck number. Everyone who in substance works for you, including "consultants" who behave like employees and agency workers sitting in your office.
- Real cost. Fully loaded — gross pay, employer contributions, variable pay accrued versus paid, contractor invoices, agency margins, anything promised but unpaid.
- Real liabilities. Accrued leave, gratuity, bonus, arrears from late revisions, under-contributed dues, unsettled full and final payments.
- Real risk. Misclassification. A missing POSH internal committee. No IP assignment in the contract of the engineer who wrote your core module.
Every request maps back to one of those four.
Why HR issues delay and reprice deals
Deals rarely die of HR problems. They get slower and cheaper, which for a founder is often worse.
The mechanic is simple. A reviewer finds something that looks like a liability but cannot be sized from your records. They cannot ignore it, so they hold back consideration in escrow, add a surviving indemnity, or ask for a price adjustment based on a conservative estimate. Conservative estimates are never in your favour.
The usual triggers:
- Unquantified statutory arrears. A wage base a reviewer considers too narrow, or workers left outside coverage, produces an open-ended number — and open-ended numbers get provisioned generously.
- Misclassified contractors. Long-tenured "consultants" with fixed hours, company laptops, a reporting manager and no other clients.
- Undocumented ESOP grants. Board approval says one number, the cap table another, the grant letter a third.
- Missing employment agreements. Without signed IP assignment, ownership of your own product becomes a question. This one genuinely stalls deals.
- Reconciliation failures. When HRMS, payroll, finance and filings disagree unexplained, the reviewer stops trusting the numbers and starts sampling. Sampling takes weeks.
A clean HR diligence closes in two to four weeks. A messy one runs for months and occupies your CFO full time.
The thirteen HR due diligence workstreams
1. Entity and registration records
Asked for: Incorporation documents, PAN and TAN, registrations for provident fund, employees' state insurance, professional tax and labour welfare fund where applicable, shops and establishments registration per location, and a list of every place people actually work, including remote employees by state.
Good looks like: One establishment register — a row per location with address, start date, headcount, applicable registrations, certificate numbers and an owner — with certificates filed to match row by row.
Traps: Registration taken for the head office but never the second city. Remote-first companies that never asked whether a state-level obligation applies where their people sit; check each state rather than assuming one national answer. Registered particulars that no longer match reality because nobody filed an amendment.
2. Headcount reconciliation
This sets the tone. If headcount ties out, reviewers relax. If not, everything after gets harder.
Asked for: Month-wise headcount, the employee master with joining and exit dates, monthly payroll registers, the salary ledger from finance, and statutory filing extracts for the same months.
Good looks like: A bridge file — opening headcount, plus joiners, minus leavers, closing headcount — agreeing with payroll, the ledger and the filings, with every difference explained.
Here is how the numbers commonly diverge in one month. Figures are illustrative only.
| Source | Count | Why it differs from HRMS | Legitimate? |
|---|---|---|---|
| HRMS active master | 214 | Baseline | — |
| Payroll register | 209 | 5 joiners after the cut-off | Yes, if paid next month with arrears |
| Finance salary ledger | 221 | 12 consultants in the salary cost centre | Classification question |
| Statutory filing A | 186 | 28 treated as outside coverage | Only if the basis is documented |
| Statutory filing B | 141 | Different coverage criteria | Only if applied correctly |
| Salary tax withholding return | 209 | Matches payroll | Yes |
| Contract and agency workers on site | 34 | Not in HRMS at all | Needs a separate register |
Reviewers expect differences. They object to unexplained ones.
How to tie it out:
- Freeze one date. Every source pulled as of the same day. Half of all reconciliation pain is comparing a 31 March extract to an 8 April extract.
- Define categories in writing — permanent, probationer, fixed-term, intern, retainer consultant, agency worker — and apply them consistently.
- Save raw extracts untouched, with the date in the filename. That file is your evidence.
- Build the bridge line by line. Never net differences against each other.
- Chase every unexplained head. They are either a data error or a compliance question.
- Repeat for six months. One clean month is luck; six is a system.
- Document coverage logic for each filing — who is in, who is out, why — and have your advisor confirm the basis is currently correct.
3. Employment documentation
Asked for: Every offer letter and agreement template version, executed copies, confirmation letters, amendments and revision letters, IP assignment and confidentiality terms, and founders' own agreements.
Good looks like: Everyone who works for you has a signed, dated agreement with all annexures and clear IP and confidentiality terms. Amendments are signed, not emailed.
Traps:
- Founders without agreements — extremely common, extremely consequential, because there is then no documented assignment of the IP they created. Start here.
- Early employees on a one-page email. Those are the people who built the product.
- Unsigned copies. From a reviewer's seat, an unsigned agreement is close to no agreement.
- Verbal promises on pay, role or equity, which surface in management interviews at the worst moment.
- Template drift — several versions in circulation with different notice and IP language, and no record of who signed which.
Build a documentation matrix: one row per employee, one column per required document, colour-coded present, missing or unsigned. It answers half the workstream and shows you know your own gaps.
4. Compensation and payroll
Asked for: Salary structure and CTC composition, employee-level payroll registers for every month, revision history, bonus and incentive plans with approvals, off-cycle payments, the payroll workflow, and bank advices reconciled to payroll.
Good looks like: Registers reconciling line by line to bank payments and the ledger, every revision tied to an approval, no material payments to workers outside payroll, and a written payroll calendar with named owners.
Where reviewers push:
- Wage base. How you structure CTC affects which components fall into the base for statutory contributions, and what constitutes wages has been an area of significant attention, including under the labour codes. Do not assume a structure set up years ago still computes correctly — get your advisor's current view and document it.
- Arrears. Retrospective revisions create knock-on effects in contributions and withholding. Reviewers check whether those were processed.
- Off-payroll payments — a bonus routed through accounts payable, a reimbursement that is really pay, a transfer to an employee's own consulting entity.
- Cash payments. A serious finding that creates exposure across several statutes at once. Stop, take advice, remediate before the process starts.
- Minimum wages, notified by state and revised periodically. Reviewers test the lowest-paid roles; confirm current rates per state rather than working from an old file.
- Controls. Who can change a salary, who approves, whether there is a maker-checker step and a log.
The most useful single artefact here is a twelve-month payroll summary — gross, deductions, employer contributions, net, headcount — each month tied to the ledger.
5. Statutory contributions and filings
This is the heart of payroll due diligence and where quantifiable exposure sits.
Asked for: Registration certificates; returns and challans for provident fund and employees' state insurance; professional tax per state; labour welfare fund where applicable; salary tax deducted at source, including challans, periodic returns and the annual certificates issued to employees; and reconciliations between filings, payments and books.
Good looks like: A filing calendar showing every obligation, frequency, owner and actual filing date with acknowledgements attached — plus this reconciliation, completed for every month of the review period:
| Contribution | Computed from payroll | Paid per challans | Reported in return | Books balance | Difference explained |
|---|---|---|---|---|---|
| Provident fund | Employee-wise total | Challan total | Return total | Payable account | Yes / No — reason |
| Employees' state insurance | Covered employees | Challan total | Return total | Payable account | Yes / No — reason |
| Professional tax, State A | Per applicable slab | Challan total | Return total | Payable account | Yes / No — reason |
| Professional tax, State B | Per applicable slab | Challan total | Return total | Payable account | Yes / No — reason |
| Labour welfare fund | Where applicable | Challan total | Return or receipt | Payable account | Yes / No — reason |
| TDS on salary | Computed liability | Challan total | Periodic return | Payable account | Yes / No — reason |
Traps: Late filings, where interest, damages or penalties may apply — do not guess the quantum, have it computed and disclose it with the working. Coverage errors, where someone should have been included or an establishment crossed a threshold without registering. Wage base errors that create arrears stretching back years. Returns that do not match the books. Missing acknowledgements, because undocumented compliance is nearly as bad as non-compliance.
On the labour codes: India has consolidated a large number of central labour statutes into four codes covering wages, industrial relations, social security, and occupational safety, health and working conditions, with implementation involving both central and state rules. Reviewers ask how you are tracking the transition. Show that you are watching it, and confirm the current status with your advisor rather than quoting effective dates from memory.
6. Leave and attendance
Asked for: Leave policy and history, employee-level balances, accrual and carry-forward rules, encashment records, attendance and overtime records, and the accrued leave liability with its computation.
Good looks like: HRMS balances reconciling to the accrued liability in the financials, with accrual, carry-forward, lapse and encashment rules documented and consistently applied.
Traps: Unlimited leave policies with no accrual model, which is awkward when a reviewer still wants the liability position and consistency with statutory leave entitlements. Uncapped carry-forward that has quietly compounded. Balances that do not tie to the provision. Missing attendance records where record-keeping obligations apply.
7. Terminal benefits
Asked for: Gratuity computation and funding status, the actuarial valuation if obtained, bonus policy and payment evidence, full and final settlements for every exit in the period, notice period practice, and any disputed settlements.
Good looks like: Gratuity computed on a consistent documented basis with the funding position stated, and settlements completed within a defined window, each with a signed statement and payment evidence.
Traps: Treating unfunded gratuity as a non-issue; funding is a choice, the liability exists either way and will be sized. A settlement backlog, which is both a liability and a set of motivated claimants. Notice periods waived for some and enforced for others with no documented approval. Bonus applicability assumed rather than confirmed. Incomplete exit files — resignation, acceptance, relieving letter, settlement statement, asset return.
8. Contingent workforce
Asked for: The full list of contractors, consultants, freelancers and agency workers; contracts, invoices, scope and tenure; contract labour registrations and licences where applicable; and vendor compliance evidence.
Good looks like: One register of every non-employee worker with engagement date, scope, contract reference and a documented classification assessment, plus staffing vendors supplying monthly compliance evidence that someone actually reviews.
#### The substance test reviewers apply
Reviewers apply substance over form. The legal tests depend on statute and facts, so get your counsel's view — but a reviewer's preliminary judgement usually forms around questions like these:
| Reviewer's question | Looks like an employee | Looks like a contractor |
|---|---|---|
| Who controls how work is done? | Company sets methods, hours, priorities | Contractor decides how to deliver |
| Where and when? | Company premises, hours and systems | Own location and schedule |
| Reporting line? | Sits in a team, has a manager | Deals with a client contact |
| How paid? | Fixed monthly, on the payroll date | Against invoices tied to deliverables |
| Other clients? | None | Multiple; runs a business |
| Duration? | Years, continuously renewed | Defined scope with an end |
| Benefits? | Leave, appraisal, laptop, internal title | None |
| Integration? | In the org chart and directory | Treated as external |
| Substitution? | Personal service expected | Can delegate |
If most of your consultants land on the left, the reviewer will size the exposure as if the answer were "employee."
Remediating without creating new problems:
- Assess before acting. Have counsel review the contract and the real working pattern and give you a written view.
- Never rewrite contracts retrospectively. Backdating turns a compliance issue into a credibility issue, and it gets found.
- Fix go-forward first. Convert employee-like roles from a clear effective date; make genuine contractor terms reflect real substance.
- Take advice on the past. Whether to regularise, provision or disclose is a legal and tax judgement with consequences either way.
- Disclose with a plan. A disclosed classification issue is a negotiation item; a discovered one is a trust problem.
- Fix intake. Most misclassification starts with a hiring manager using a consultant agreement to skip approvals.
Principal employer obligations may attach where you engage workers through a contractor or agency, depending on the statute, worker numbers and nature of work. Verify what applies to your situation.
9. Equity and incentives
Asked for: The ESOP scheme and amendments, board and shareholder approvals, pool utilisation, the grant register, signed grant letters, vesting and exercise records, leaver treatment, tax withholding on exercise, and reconciliation to the cap table.
Good looks like: A grant register reconciling exactly to approvals, signed letters and the cap table, with systematic vesting and consistent leaver treatment.
Traps: Options promised in an offer letter and never granted, which is a live commitment. Verbal grants, which surface in employee interviews. Unsigned grant letters. Pool over-allocation. Inconsistent leaver treatment creating precedent arguments. Perquisite taxation and withholding on exercise is technical and includes provisions relevant to eligible startups — get the current position from your tax advisor and document how you applied it.
Reconcile the grant register to the cap table quarterly. Equity gaps are hardest to fix late because fixing them needs approvals.
10. Policies and governance
Asked for: The handbook and standalone policies, evidence of acknowledgement, the POSH policy and internal committee constitution including the external member, training records, complaint register and annual reporting, and disciplinary and grievance records.
Good looks like: A current handbook with a version date and owner, acknowledgements captured for everyone including new joiners, and a properly constituted internal committee with documented training.
On POSH: every serious reviewer treats obligations relating to prevention of sexual harassment at the workplace as non-negotiable, checking committee composition, the external member, training, the complaint register and the annual reporting obligation. Confirm the current requirements applicable to you. Gaps here are severity-high almost everywhere — partly because they are serious, partly because they are easy to verify.
Traps: A handbook describing policies nobody follows. Committee members who do not know they are on it. Disciplinary action without a documented process. Grievances handled informally with no record.
11. Litigation, notices and disputes
Asked for: Correspondence with labour authorities and inspectors, inspection reports and responses, show-cause notices and replies, demand orders, pending employee litigation, settlement records, and a schedule of matters with counsel's view.
Good looks like: One continuously maintained schedule — facts, status, next date, counsel, likely outcome — with a documented response filed against every notice.
Traps: The unanswered notice, received, forwarded to someone who left, never replied to. Matters settled informally with no release. Anything the founder knows that is not on the schedule; the reviewer's own searches will surface it. Inspection observations fixed but never documented as closed.
12. People data and privacy
Asked for: A map of where employee data lives, HR and payroll vendors and what each processes, vendor contracts with data protection terms, consent practices, retention policy, access controls, cross-border transfers and incident history.
Good looks like: A documented inventory of systems holding employee data, with categories, legal basis, retention period and access model for each.
India's data protection framework has been evolving, with implementation mechanics established over time. Employee data includes identifiers, bank details, health information from insurance enrolment and verification records. Confirm the current framework with privacy counsel rather than working from memory.
Traps: Employee data in personal spreadsheets, inboxes and chat groups. Ex-employees who still have system access. Vendors holding sensitive data with no contractual protection. No retention policy, so nothing has ever been deleted.
13. Culture and key-person risk
Asked for: Attrition by month, function and tenure band with reasons; the org chart; key persons and what depends on them; open roles; exit interview themes; and retention arrangements.
Good looks like: Attrition tracked on a stable definition, key-person dependency named with a mitigation plan, and retention arrangements documented rather than promised.
Traps: The engineer who understands the billing system, has no agreement and no documentation — reviewers ask what happens if they leave tomorrow and expect a real answer. A spike in senior attrition just before the process. Verbally promised retention bonuses.
The master HR due diligence checklist
Assign every row an owner and a date.
| # | Workstream | Documents to produce | Owner | Typical gap | Effort |
|---|---|---|---|---|---|
| 1 | Entity and registrations | Incorporation, PAN/TAN, PF/ESI/PT/LWF, shops and establishments, establishment register | CS / Finance | Missing registration for a newer location | Medium |
| 2 | Headcount reconciliation | Monthly headcount, employee master, payroll registers, salary ledger, bridge file | HR Ops + Finance | Sources disagree, unexplained | Medium |
| 3 | Employment documentation | Templates, executed agreements, amendments, IP terms, founder agreements | HR | Unsigned or missing agreements | High if founders involved |
| 4 | Compensation and payroll | Salary structure, monthly registers, revision history, bank reconciliations, SOP | Payroll | Off-payroll payments; structure never re-reviewed | Medium to high |
| 5 | Statutory contributions | Returns, challans, acknowledgements, filing calendar, monthly reconciliations | Payroll + Compliance | Late filings, coverage gaps, book differences | High if arrears exist |
| 6 | Leave and attendance | Policy, balances, accrual rules, attendance records, liability computation | HR Ops | Balances do not tie to the provision | Low to medium |
| 7 | Terminal benefits | Gratuity computation, actuarial report, bonus records, settlements, exit files | Finance + HR | Settlement backlog; unsized liability | Medium |
| 8 | Contingent workforce | Contractor register, contracts, vendor evidence, classification assessment | HR + Legal | Consultants who look like employees | High |
| 9 | Equity and incentives | Scheme, approvals, grant register, signed letters, cap table tie-out | CFO + CS | Promised but never granted options | Medium to high |
| 10 | Policies and governance | Handbook, acknowledgements, POSH policy, committee records, complaint register | HR | Committee wrongly constituted | Low to medium, urgent |
| 11 | Litigation and notices | Authority correspondence, inspection reports, replies, matter schedule | Legal | An unanswered notice | Matter-dependent |
| 12 | Data and privacy | Data map, vendor contracts, retention policy, access controls | HR + IT + Legal | Data scattered on personal drives | Medium |
| 13 | Culture and key-person risk | Attrition data, org chart, key-person map, retention arrangements | Founder + HR | Undocumented dependency | Low to medium |
Red flags, severity and remediation
Severity is indicative; actual severity depends on your facts and the deal context.
| Finding | Why it worries a reviewer | Severity | Remediation | Timeline |
|---|---|---|---|---|
| Founders without signed agreements or IP assignment | Ownership of core IP becomes questionable | Critical | Execute agreements; counsel's advice on the prior period | 2 to 6 weeks |
| Cash component in compensation | Exposure across several statutes; destroys record credibility | Critical | Stop; legal and tax advice; restructure and disclose | 4 to 12 weeks |
| Consultants performing employee-like roles | Potential reclassification with retrospective exposure | High | Written assessment; convert forward; advisor-led approach to the past | 6 to 12 weeks |
| Returns filed late or not at all | Interest or penalties may apply; weak controls | High | Regularise; compute exposure; disclose with evidence | 4 to 10 weeks |
| Contributions on a narrow wage base | Potentially large retrospective arrears | High | Advisor review; correct forward; provision | 4 to 8 weeks |
| POSH committee absent or wrongly constituted | Easily verified gap and a governance signal | High | Constitute correctly; train; maintain register | 2 to 4 weeks |
| Options promised but never granted | Direct cap table impact; unresolved claims | High | Reconcile; obtain approvals; execute letters | 3 to 8 weeks |
| Headcount does not reconcile | Confidence drops; sampling expands | High | Build the bridge; explain differences; make it monthly | 2 to 4 weeks |
| Backlog of pending settlements | Liability plus motivated claimants | Medium to high | Clear with documented releases | 3 to 6 weeks |
| Unanswered authority notice | Correspondence unmonitored; may have compounded | Medium to high | Counsel-led response; monitored channel | Immediate |
| Unsigned employment agreements | Notice, IP and confidentiality hard to enforce | Medium | Re-issue for signature; never backdate | 2 to 4 weeks |
| Gratuity unfunded and unassessed | Unsized balance sheet liability | Medium | Valuation; funding decision; disclose | 3 to 6 weeks |
| Employee data on personal drives | Privacy and access-control exposure | Medium | Consolidate; revoke access; retention policy | 3 to 6 weeks |
Two principles run through that table. Fix the go-forward position immediately — it is in your control and shows good faith. And never fix the past by rewriting documents. Take advice, provision, disclose.
Building the HR data room
A well-organised room saves weeks, because reviewers find things without asking — and because organisation signals that the underlying operation is organised too.
Suggested folder structure
`` HR-DUE-DILIGENCE/ ├── 00_INDEX_AND_TRACKER/ │ ├── Master_Document_Index.xlsx │ ├── Request_Response_Log.xlsx │ └── Known_Gaps_and_Remediation_Plan.pdf ├── 01_ENTITY_AND_REGISTRATIONS/ │ ├── 01.1_Incorporation_and_Tax/ │ ├── 01.2_Labour_Registrations/ (PF, ESI, PT_by_State, LWF_by_State) │ ├── 01.3_Shops_and_Establishments_by_Location/ │ └── 01.4_Establishment_Register/ ├── 02_HEADCOUNT/ │ ├── 02.1_Employee_Master/ │ ├── 02.2_Monthly_Headcount/ │ ├── 02.3_Joiners_and_Leavers_Log/ │ └── 02.4_Reconciliation_Bridge_Files/ ├── 03_EMPLOYMENT_DOCUMENTATION/ │ ├── 03.1_Templates_by_Version/ │ ├── 03.2_Executed_Agreements/ (Founders, Leadership, Employees_by_ID) │ ├── 03.3_Amendments_and_Revision_Letters/ │ └── 03.4_Documentation_Matrix/ ├── 04_COMPENSATION_AND_PAYROLL/ │ ├── 04.1_Salary_Structure/ │ ├── 04.2_Payroll_Registers_Monthly/ │ ├── 04.3_Revision_History/ │ └── 04.4_Bank_Reconciliations_and_SOP/ ├── 05_STATUTORY_COMPLIANCE/ │ ├── 05.1_Compliance_Calendar/ │ ├── 05.2_PF/ 05.3_ESI/ 05.4_PT_by_State/ 05.5_LWF/ │ ├── 05.6_TDS_Salary_Challans_and_Returns/ │ ├── 05.7_Statutory_Registers/ │ └── 05.8_Monthly_Reconciliations/ ├── 06_LEAVE_AND_ATTENDANCE/ ├── 07_TERMINAL_BENEFITS/ (Gratuity, Actuarial, Bonus, FnF_Settlements) ├── 08_CONTINGENT_WORKFORCE/ (Register, Contracts, Vendor_Evidence, Classification) ├── 09_EQUITY/ (Scheme, Approvals, Grant_Register, Signed_Letters, Vesting_and_Tax) ├── 10_POLICIES_AND_GOVERNANCE/ (Handbook, Policies, Acknowledgements, POSH) ├── 11_LITIGATION_AND_NOTICES/ (Schedule, Correspondence, Inspections) ├── 12_DATA_AND_PRIVACY/ (Data_Map, Vendor_Contracts, Retention_and_Access) └── 13_ORGANISATION/ (Org_Charts, Attrition, Key_Person_Map, Open_Roles) ``
Naming, versions and redaction
Use one convention: [Folder]_[DocType]_[Entity or EmployeeID]_[Period]_[Version] — for example 05.2_PF_Acknowledgement_2024-07_v1.pdf.
- Dates as
YYYY-MM-DDorYYYY-MM. Never11-04-23. - Underscores, no spaces. No
final_final. Usev1,v2with a version log. - Employee IDs in filenames, not names. IDs are stable and help with redaction.
- One document per file. Do not staple twelve months of challans into a 400-page PDF.
- Keep one current version visible; archive superseded files. If you replace a file a reviewer already downloaded, tell them — silent swaps cost credibility.
On personal data: redact bank account numbers, full identity numbers, personal contact details, medical information and dependent details unless there is a specific need. Consider pseudonymised employee-level datasets — employee ID instead of name — for bulk analysis, with named documents for a sample. Redact properly by flattening the PDF; a black box over live text is not redaction. Check whether your privacy obligations and any employee notices permit the disclosure.
Access control and what not to include
Use a proper virtual data room, not a shared drive link. Grant folder-level access and stage it as workstreams open. Enable download tracking, watermark sensitive documents, review the access list weekly, and keep a record of what was in the room at each point — post-closing, that is part of the disclosure record.
Keep out of the room:
- Bulk unredacted identity documents and medical records.
- Raw POSH or misconduct investigation files. Provide the register and summary information, and explain the confidentiality position rather than silently omitting.
- Performance improvement documents naming individuals, unless requested and cleared.
- Internal chat exports and candid email threads. If a specific email is evidence, provide that email.
- Drafts, and anything nobody on your side has read.
The 90-day readiness plan
Days 0 to 30: see clearly
Objective: ground truth. No fixing yet.
| Activity | Owner | Output |
|---|---|---|
| Appoint a diligence lead and single point of contact | Founder | Named owner with protected time |
| Build the establishment register | CS / Finance | Register with gaps flagged |
| Pull dated raw extracts from HRMS, payroll, finance, filings | HR Ops + Finance | Untouched source files |
| Reconcile headcount for six months | HR Ops + Finance | Bridge file with differences explained |
| Build the documentation matrix and contractor register | HR | Gaps visible per person |
| Compile the compliance calendar with actual filing dates | Payroll | Calendar with evidence links |
| Reconcile the grant register to approvals and cap table | CFO / CS | Variance list |
| Assemble the litigation schedule and data map | Legal + IT | Matter schedule; data inventory |
| Set up the data room shell | Diligence lead | Structured empty room |
Day 30 milestone: a written gap register — description, severity, owner, target date for every gap. You are not fixing yet; you are refusing to be surprised.
Days 31 to 60: fix what you control
| Activity | Owner | Output |
|---|---|---|
| Brief counsel and tax advisors on flagged issues | Founder + Legal | Written views on classification, wage base, past periods |
| Execute missing agreements, founders first | HR + Legal | Signed agreements; matrix updated |
| Constitute or correct the POSH committee and train | HR | Committee order, training records, register |
| Reconcile leave balances; correct the provision | HR Ops + Finance | Reconciled balances, documented policy |
| Clear the settlement backlog | HR + Finance | Signed settlements with releases |
| Complete statutory reconciliations for the full period | Payroll | Reconciliation pack per contribution |
| Correct wage base or coverage forward; file missing registrations | Payroll + CS | Corrected computation; filed applications |
| Obtain the gratuity valuation; complete classification assessment | Finance + Legal | Valuation report; conversion plan |
| Circulate policies; consolidate data; revoke stray access | HR + IT | Acknowledgements; access review log |
Day 60 milestone: every unilaterally fixable gap closed; every remaining gap has an advisor's view and a written plan.
Days 61 to 90: package and rehearse
| Activity | Owner | Output |
|---|---|---|
| Populate the room with reviewed, named, redacted documents | Diligence lead | Complete indexed room |
| Map likely requests to file paths | Diligence lead | Master index |
| Write the known-gaps disclosure note with provisions | Founder + CFO + Legal | Advisor-reviewed note |
| Write one-page memos per workstream | Workstream owners | 13 summary memos |
| Run a mock diligence with an external reviewer | Founder | Findings list; sting removed |
| Brief interviewees; set up the response log | Founder + HR | Briefing note; working log |
| Fold monthly reconciliation into the operating rhythm | HR Ops | Business-as-usual cadence |
Day 90 milestone: you can answer any reasonable HR due diligence question within one business day, with evidence.
How to answer diligence questions well
Appoint a single point of contact. One person routes every request and controls what leaves the building. Without this, three people answer the same question three ways and the reviewer has an inconsistency to chase.
Keep a response log. Request ID, date received, question as asked, owner, due date, documents provided with paths, date responded, status. It stops requests falling through gaps and becomes part of your disclosure record.
Never guess. "Let me confirm and come back tomorrow" is fine. An answer that turns out to be untrue makes the reviewer re-examine everything you already said. This applies double to numbers, rates and dates — check the source rather than answering from memory.
Disclose gaps before they are found. The highest-leverage behaviour in the process. Use this format: what the issue is in plain language; how it arose; the period and population affected; the exposure as computed by your advisor with assumptions stated, or an honest explanation of why it cannot be quantified; what you have already done; what remains, with owners; and whether it is provisioned.
Answer the question asked, then stop. Wandering into adjacent topics creates new questions.
Be consistent across channels. The document says one thing, the deck another, the HR head a third in an interview. That is one of the most common ways problems get discovered.
What an HRMS actually gives you — honestly
A good HRMS makes HR due diligence far less painful. It does not make you compliant. Those are different claims.
What it genuinely does:
- Single source of truth. One employee master feeding payroll, leave, documents and reporting. Most reconciliation failures come from parallel spreadsheets that drifted apart.
- Immutable audit trail. Every change recorded with who, what, when and the prior value. When a reviewer asks when a salary changed and who approved it, you have evidence instead of a theory.
- Registers and reports on demand for any period, without rebuilding them in Excel at midnight.
- Document repository with access control, so the documentation matrix stays green instead of decaying.
- Filing history stored against the period it relates to, so the compliance calendar has evidence attached rather than a tick mark.
What it does not do: make classification decisions, fix historical non-compliance, replace advisors, or improve data you migrated badly. It can flag a consultant paid a fixed monthly amount for thirty straight months; it cannot decide what that means.
The honest summary: an HRMS turns diligence from a reconstruction project into a retrieval exercise. That is usually the difference between four weeks and four months.
Common mistakes
- Treating it as document collection. Reviewers test whether what you say matches what you can prove. Volume does not help; indexed, reconciled evidence does.
- Starting when the term sheet is signed. Registrations, valuations, advisor opinions and agreements with people who have leverage all take longer than the window.
- Fixing the past by rewriting documents. Backdated agreements get found through metadata, signatures and referenced entities that did not yet exist. Then the finding is no longer about the original gap.
- Letting each function answer independently. Finance gives one headcount, HR another, the founder a third from an old deck.
- Hiding the known problem. It comes up. Disclosing on your terms is a different conversation from having it discovered.
- Ignoring contingent workers. They are not in the HRMS, so nobody thinks about them — and they are frequently the largest single exposure.
- Assuming your home state covers everywhere. Requirements vary by state, and remote hiring creates obligations a single-city setup does not cover.
- Never reconciling filings to books. Filing on time is necessary, not sufficient.
- Leaving equity to the end. Equity fixes need board or shareholder action, which needs notice and meetings.
- Over-redacting, so the document proves nothing and the reviewer has to ask again.
- Letting it decay afterwards. Teams that keep the monthly reconciliation running find the second diligence takes days.
Frequently asked questions
How far back does HR due diligence look?
Payroll and financial records are commonly reviewed for the last two to three financial years plus the current year to date, though exposure and limitation periods for statutory matters can extend further depending on the statute and facts. Employment documentation is usually reviewed for everyone currently employed, regardless of joining date. Assume three years readily available and older records retrievable, and confirm applicable retention periods with your advisor.
We are a 40-person startup raising a seed round. Is all this necessary?
The workstreams are the same; the depth is not. Early-stage reviewers focus hardest on signed agreements with IP assignment for everyone who built the product, founders' own agreements, registrations wherever you actually operate, whether contributions and withholding are computed and filed, contractor classification, ESOP documentation matching approvals, and POSH obligations.
Who should own it internally?
One named lead with authority across functions — usually the CFO or a senior HR leader — plus an owner per workstream, with the founder involved for founder agreements, equity, litigation and disclosure decisions. Treating it as HR-only does not work; at least half the evidence sits in finance.
What is the most common finding in Indian startups?
Three recur constantly: contractor classification, where long-tenured consultants operate as employees; documentation gaps, particularly unsigned agreements for founders and early employees; and reconciliation failures across HRMS, finance and statutory filings.
Should we disclose a gap we found ourselves?
Take advice on the specific matter, but as a general principle, yes and early. A gap disclosed with a remediation plan, an advisor's assessment and a provision is a negotiable item. A gap the reviewer discovers expands the scope of everything else.
How long does the HR workstream take?
For a prepared company with an organised data room and clean reconciliations, often two to four weeks of active review. For an unprepared one, commonly two to four months, because each finding triggers more sampling and each request needs reconstruction first.
What if we find serious non-compliance right before a process?
Stop and get advice immediately. Establish the population, period and amount if computable. Fix the go-forward position from a stated effective date. Get written views from counsel and your tax advisor on the past period, provision appropriately, then disclose with the plan attached. Do not rewrite documents or answer in ways that are technically accurate but designed to mislead.
Does an HRMS make us compliant?
No — be suspicious of anyone who says otherwise. It makes compliance easier to execute and far easier to evidence, but it must be configured correctly for your establishments and kept current as rules change. Judgement calls on classification, structure and disclosure stay with you and your advisors.
This is a preparation problem, not a luck problem
Almost nothing in HR due diligence is unfixable given time. Agreements can be executed. Registrations can be obtained. Reconciliations can be built. Even significant historical exposure becomes a bounded, negotiable item once it is quantified, provisioned and disclosed with a plan.
What makes it hard is compression — attempting three years of record-keeping in three weeks while running the company and negotiating a deal. That is where shortcuts turn a compliance problem into a credibility problem.
So here is the reframe: this checklist is really a description of what a well-organised people operation looks like. If your headcount reconciles monthly, your compliance calendar has evidence on every line, every employee has a signed agreement and your registers are generated rather than reconstructed, then diligence is just a reviewer reading files you already have.
Start with the gap register. Thirty days of honest looking beats ninety days of anxious guessing.
Getting the foundation right with CozyHR
CozyHR is built for Indian startups and SMBs who want their people data to hold up under scrutiny — one employee master that payroll, leave, attendance and documents all run from, an audit trail on every change, documents and acknowledgements stored against the right record, registers and payroll reports for any period, and filing history kept where you can find it. It will not make judgement calls for you or replace your advisors. It will mean that when the request list arrives, you are retrieving rather than reconstructing.
If a funding round, an acquisition or your first serious compliance review is on the horizon, that is worth having in place before the list shows up. Try CozyHR or book a walkthrough with our team, and see what your data room could look like.
---
This article is general guidance for information purposes only. It is not legal, tax, accounting or professional advice, and it does not state current rates, thresholds, wage ceilings, filing dates, penalty amounts or statutory provisions. Indian employment and payroll law involves multiple central and state statutes whose requirements change over time and vary by state, headcount, industry and establishment type. Always verify applicable requirements with the relevant authority and obtain advice from qualified professionals before acting.