HR Compliance Audit: A Self-Audit Checklist for India

Why every Indian employer needs an HR compliance audit before an inspector arrives

An HR compliance audit is a structured, evidence-based review of everything your organisation is legally required to register, record, deduct, remit, file, display and retain as an employer in India. Done properly, it is not a paperwork ritual — it is a risk-management exercise that tells you, with documents in hand, exactly where you would fail if a labour inspector, a PF enforcement officer, a due-diligence team or an acquirer walked in tomorrow.

For Indian SMBs and startups, this has become unusually urgent. The consolidation of twenty-nine central labour laws into four labour codes — on wages, industrial relations, social security, and occupational safety, health and working conditions — has been in motion for years, with staggered rulemaking at the Centre and in states. Whatever the final implementation timeline in your state, the direction of travel is clear: fewer, larger registers; a common definition of wages; combined returns; and far greater reliance on digital records. Employers who still keep compliance in three spreadsheets, one consultant's inbox and a cupboard of physical registers will find the transition painful.

This guide gives you a complete self-audit framework: scope, phases, checklists, a scoring model, a remediation plan template and a quarterly rhythm. It is written for HR managers, founders and payroll teams who need to run this internally, without a large budget, and defend the results to a board or an auditor.

A quick but important disclaimer, and we will repeat it: thresholds, contribution rates, wage ceilings, form numbers, filing dates and applicability tests change, and many of them vary by state. Nothing here is legal advice. Treat every checklist item as a prompt to verify the current position with the relevant authority, the applicable state rules, or a qualified labour law advisor before you act.

What an HR compliance audit actually covers

People use "HR audit" loosely. It helps to separate three different exercises that are often bundled together:

• Statutory compliance audit. Are we registered where we must be, deducting and remitting correctly, filing returns on time, maintaining prescribed registers, and displaying required notices? This is the audit this guide is about.
• Process audit. Are our HR processes — hiring, onboarding, appraisal, exit — consistent, documented and free of discretion that creates legal exposure?
• Culture or engagement audit. How do employees experience the organisation? Valuable, but a different instrument entirely.

A statutory HR compliance audit answers a narrow, testable question for every obligation: does it apply to us, are we doing it, and can we prove it with a document? Everything else is commentary.

Why run a self-audit rather than waiting

• Inspections are no longer purely random. Risk-based and web-based inspection schemes, computerised allocation of inspectors, and increasing data-matching between PF, ESI and income-tax filings mean that mismatches surface without anyone visiting your office.
• Non-compliance compounds silently. A misclassified allowance or an unregistered branch office does not produce a bill in month one. It produces an assessment covering several past years, plus interest and damages, at the worst possible moment.
• Due diligence is unforgiving. Every funding round, acquisition or large enterprise customer contract now includes a labour-compliance annexure. Findings discovered by a buyer's counsel cost you valuation or an indemnity holdback; findings discovered by you cost you a weekend.
• The codes are a forcing function. Register consolidation and a statutory wage definition will require you to restate salary structures and rebuild records anyway. An audit done now becomes the baseline for that migration.
• Directors and officers carry personal exposure. Several labour statutes attach liability to the person in charge of the establishment, not just to the company. Founders should care about this personally.

Scope, frequency and who owns the audit

Deciding scope

Define scope in writing before you start, or the exercise sprawls. A workable scope statement fixes four dimensions:

1. Entities. Every registered legal entity, including dormant subsidiaries and LLPs that still have a PAN and a bank account.
2. Locations. Head office, branches, warehouses, retail outlets, factories, co-working desks and registered addresses where nobody actually sits. Each location may attract its own Shops and Establishments registration, professional tax registration and state-specific rules.
3. Worker categories. Full-time employees, probationers, fixed-term employees, interns and apprentices, contract workers through vendors, consultants on professional-fee contracts, and gig or platform workers.
4. Period. Typically the current financial year plus the preceding two or three, since assessments and inspections routinely look back.

Frequency

Who owns it

In an SMB, the honest answer is usually "one person who also does five other things". Make that explicit rather than accidental:

• Audit owner: typically the HR head or HR ops lead. Accountable for completion and for the findings register.
• Payroll owner: runs the wage, deduction and remittance sections. Often the finance manager or an outsourced payroll partner.
• Evidence custodians: whoever holds the source documents — offer letters, attendance data, challans, vendor invoices.
• Reviewer: an independent pair of eyes. A finance colleague, a board member, or a retained labour advisor. Self-audits that nobody reviews tend to grade themselves generously.

Before you start: build the compliance register

Do not open a checklist and start ticking. Build a compliance register first — a single master list of every obligation that applies to your organisation. Everything else in this HR compliance audit hangs off it.

Each row of the register should carry:

• The statute or rule (by name)
• The specific obligation (register, remit, file, display, constitute, retain)
• Applicability test and whether you meet it
• Jurisdiction (central or which state)
• Frequency (monthly, quarterly, annual, event-based)
• Due date or timeline
• Internal owner
• Evidence type and where it is stored
• Current status and last verified date

Building this register is the single highest-value output of a first-time audit. In year two, the audit becomes a refresh rather than an excavation.

Assembling the evidence pack

Ask evidence custodians for these before fieldwork begins. Requesting documents mid-audit is what turns three weeks into three months.

A practical tip: create one folder per bundle, per financial year, with a strict naming convention. An audit that produces an organised evidence archive is worth more than one that produces a report.

The ten-phase HR compliance audit framework

Run the audit in phases, in this order. Each phase depends on the one before it: you cannot test payroll deductions properly until you know which registrations apply, and you cannot test registers until you know your headcount by category.

Phase 1: Entity, applicability and registrations

This phase answers the deceptively hard question: which laws actually apply to us, right now, at each location?

Applicability in Indian labour law usually turns on some combination of headcount, the nature of the establishment (shop, commercial establishment, factory, hazardous process), the state, and wage levels. Headcount tests can include contract workers, apprentices and workers of contractors, depending on the statute — which is why many growing companies cross a threshold without noticing.

Step-by-step:

1. List every location where work is performed, including employees' homes if you have a fully remote workforce registered against a head office.
2. For each location, record the state, the number of persons employed (by category), the date the location opened and the date each threshold was first crossed.
3. Map each location against the registrations that state requires — Shops and Establishments registration is the usual baseline for offices; factories and certain manufacturing units need a separate licence.
4. Check that every registration certificate is current, correctly reflects the employer name, address, nature of business and headcount, and has been renewed where renewal is required.
5. Reconcile the address on each registration against the actual address in use. Office moves are the most common source of stale registrations.
6. Confirm EPFO and ESIC coverage. Verify the date of coverage, the establishment code, whether all branches are covered under the same code or need separate ones, and whether any exemption or sub-code applies.
7. Verify professional tax registration (as employer) and enrolment (for the entity) in every state that levies it, and labour welfare fund registration where applicable.
8. Confirm contract labour registration if you engage contract workers above the applicable threshold as a principal employer.
9. Verify TAN, and that TDS on salaries is being deposited under the correct TAN for each entity.

Red flags in this phase: a registered office address that nobody has occupied for two years; a second city opened by the sales team with no local registration; PF coverage taken late, after the threshold was crossed; a registration in the name of a predecessor entity after a conversion from LLP to private limited.

Note that the labour codes are expected to move several of these toward common registration and a single licence in some scenarios, with state rules doing much of the operational work. Verify the current position in each state you operate in rather than assuming either the old or new regime applies.

Phase 2: Employment documentation

This phase tests whether the relationship you think you have with each worker is the relationship your paperwork proves. Documentation gaps are the quiet cause of most misclassification disputes.

Step-by-step:

1. Pull the full active headcount from your HRMS and reconcile it against the payroll register and the PF/ESI monthly filings. Three numbers, one figure — if they differ, find out why before anything else.
2. Sample at least twenty per cent of employees across grades, locations and joining years. Sample one hundred per cent for senior hires and anyone on a non-standard contract.
3. For each sampled file, confirm the presence of a signed offer letter, a signed appointment letter or employment agreement, and acknowledgement of the employee handbook and key policies.
4. Check that the appointment letter states the essentials: designation, date of joining, place of work, reporting, remuneration structure, probation and confirmation terms, notice period, leave entitlement reference, confidentiality and IP terms, and the governing policy framework.
5. For fixed-term employees, verify that the contract genuinely specifies a term, that the terms of work — hours, wages, allowances and statutory benefits — are not inferior to those of comparable permanent employees, and that renewals are documented rather than assumed. The labour codes formalise fixed-term employment, including pro-rata gratuity treatment; verify the operative rules currently applicable to you.
6. For consultants on professional-fee arrangements, apply a substance test. If the person works fixed hours, uses your equipment, reports into your hierarchy, has no other clients and cannot delegate, the "consultant" label is fragile. Document the rationale where you are confident, and reclassify where you are not.
7. Verify statutory identity and eligibility records: PAN, Aadhaar-linked UAN, bank details, date of birth proof, nomination forms for PF and gratuity, and where applicable, age proof for young workers.
8. Confirm background verification was completed to your policy standard, that reports are stored securely, and that consent for verification was obtained.
9. Check exit documentation: resignation acceptance, notice period treatment, relieving letter, experience letter, full-and-final settlement statement, gratuity computation where applicable, and return of assets.

Red flags: employees confirmed by silence rather than by letter; offer letters issued but appointment letters never signed; a cohort of "interns" doing production work for months; contracts referencing policies that no longer exist.

Phase 3: Payroll structure and wage definition

This is the phase where the labour codes bite hardest, and where a payroll compliance audit earns its keep.

The codes introduce a common statutory definition of wages across social security, wages and industrial relations legislation. The mechanics matter more than the label: the definition includes basic pay, dearness allowance and retaining allowance, excludes a specified list of components such as certain allowances, bonus payable, employer contributions to provident fund and pension, conveyance, house rent allowance, overtime and gratuity — and then applies a critical proviso. If the excluded components exceed a prescribed proportion of total remuneration, the excess is deemed to be wages.

The practical consequence for Indian employers is straightforward to state and expensive to ignore: you can no longer suppress statutory liability by keeping basic pay artificially low and loading the rest into allowances. For many SMBs with 30-40 per cent basic structures, this implies a higher wage base for provident fund, gratuity, bonus, leave encashment, retrenchment compensation and maternity benefit calculations.

Step-by-step:

1. Extract your current CTC template for every grade and location. List every component and classify it as included in wages, excluded, or uncertain.
2. Compute, for a representative sample of employees at different salary levels, what proportion of total remuneration sits in excluded components today.
3. Model the impact of the statutory wage definition: recalculate PF contributions, gratuity accrual, bonus eligibility and leave encashment on the restated wage base.
4. Quantify the cost. Express it as a monthly cash impact, an annual P&L impact and a balance-sheet impact for gratuity provisioning. Take this number to your CFO before you take it to a board.
5. Decide the restructuring approach: raise basic pay, collapse ad-hoc allowances, or hold total cost constant and adjust take-home. Each has employee-communication consequences. None should be done silently.
6. Check minimum wages. For each state and each category of skill and employment, verify that gross wages meet or exceed the applicable minimum, including any variable dearness allowance revisions. Minimum wage schedules are revised periodically and vary by state, zone and skill category — verify the current notification for every state you operate in.
7. Test overtime. Confirm that overtime is identified, approved, computed at the statutory premium rate and paid — not silently absorbed as "flexible working".
8. Verify wage payment timelines. Check the actual credit dates for the last twelve months against the timeline applicable to your establishment, and confirm the wage period is fixed and does not exceed a month.
9. Confirm payment mode. Verify that wages are paid through bank transfer or another permitted mode, with an auditable trail.
10. Review payslips. Every employee should receive a payslip showing wage components, deductions with reasons, days worked or paid, leave balance and net pay.
11. Review deductions from wages other than statutory ones. Fines, damages, recoveries and advances are regulated — check that they are permitted, documented, within limits, and recorded in the prescribed register.

Red flags: a "special allowance" that is the largest single line in the salary structure; interns and trainees paid a stipend below the applicable minimum wage; overtime that appears in attendance data but never in payroll; salary credited on a different date each month.

Phase 4: Statutory deductions and remittances

Deduction errors are the most frequently detected form of non-compliance, because the money trail is visible to multiple authorities and reconciles poorly when something is wrong.

Step-by-step:

1. For each month in the audit period, reconcile three figures per statute: the amount deducted in payroll, the amount shown in the return or ECR, and the amount actually remitted per the challan. All three should tie.
2. Investigate every difference, however small. Rounding differences are acceptable; unexplained differences are findings.
3. Check the remittance date against the applicable due date for each month. Note that due dates and any grace periods change — verify current dates with the relevant authority.
4. Test the coverage population. Every employee who should be covered must be covered. Excluded employees must have a documented basis for exclusion.
5. Verify wage-base correctness. Confirm that the base used for each deduction matches the applicable statutory wage definition and any applicable ceiling — not simply "basic + DA" by habit.
6. Check that arrears, bonus payments, leave encashment and settlement payments were treated correctly for each deduction.
7. For TDS on salaries, verify computation of taxable salary, the regime elected by each employee, proof of investment declarations and actual proofs collected, perquisite valuation, and issuance of annual salary certificates.
8. Reconcile TDS deducted against TDS deposited, and both against the quarterly statements filed. Check for any short-deduction or late-deposit notices and their resolution.

Red flags: employees enrolled in PF from the month after joining rather than the date of joining; ESI deducted for an employee who has crossed the wage threshold mid-contribution-period without applying the correct rule for the remainder of that period; professional tax deducted at the head-office state's slab for employees working in another state; an employer who deducts LWF but has never remitted it; TDS deposited late and the interest never paid.

Phase 5: Returns and filings

Deducting and remitting correctly is only half the obligation. Returns close the loop, and they are what an inspector asks for first.

Step-by-step:

1. Build a filing calendar listing every return you are required to file, its frequency, its due date and the authority.
2. For the audit period, obtain the acknowledgement for every filing. Not the draft, not the working file — the acknowledgement with a reference number and date.
3. Flag every late filing, note the reason, and record whether any late fee, interest or damages was assessed and paid.
4. Check for revised or corrective filings and confirm they were accepted.
5. Reconcile annual returns against the sum of monthly filings.
6. Confirm annual and half-yearly returns under state Shops and Establishments rules, where the state requires them.
7. Confirm the annual return under the POSH Act framework — the internal committee's annual report must be submitted to the prescribed authority and reflected in the company's board report where applicable.
8. Confirm annual filings under bonus, contract labour and any other statute applicable to you.
9. Check inbox and portal notices. Many employers have unanswered notices sitting in a shared mailbox that nobody owns.

A note on the codes: one of the stated objectives of consolidation is combined and simplified returns, with electronic filing and unified portals. If and when combined returns apply to your establishment, your filing calendar changes — but your evidence discipline should not. Keep filing acknowledgements the same way regardless of the form number.

Phase 6: Registers, records and retention

Registers are where the labour codes are already changing employer behaviour, and where SMBs are least prepared. The consolidation project pushes toward a smaller number of combined registers — broadly, a register of employees, a register of wages and related particulars, and a limited set of others — maintained electronically. That is welcome, but it only helps if the underlying data exists.

Step-by-step:

1. List every register you are currently required to maintain, per statute and per state.
2. For each, confirm it exists, is up to date, contains all prescribed particulars, and is available at the establishment or electronically accessible.
3. Confirm the form or format used matches what the applicable rules prescribe, and whether electronic maintenance is permitted in your state.
4. Test data completeness by sampling: pick five employees and trace them through every register they should appear in.
5. Confirm retention. Records must be kept for prescribed periods, and different statutes prescribe different periods. Where periods differ, retain for the longest applicable.
6. Confirm notice displays. Abstracts of applicable Acts, working hours, weekly holiday, wage period, IC details and grievance contacts are typically required to be displayed at the workplace. Photograph each display with a date, per location.
7. Check backup and access. If registers are electronic, confirm backups, access controls and the ability to produce a readable, printable extract on demand.

Red flags: a wage register generated afresh from payroll software only when someone asks; attendance data that exists only in a biometric device with 90 days of storage; leave balances tracked in a spreadsheet that has been "temporarily" in use for three years; no notice board at a leased co-working location.

Phase 7: Leave, working hours and holidays

Leave and hours are governed largely by state Shops and Establishments rules and, for factories, by the Factories Act — which means the answer is different in every state you operate in.

Step-by-step:

1. Compile the leave entitlements prescribed by each state where you have employees: earned or privilege leave, sick or casual leave, accrual rules, carry-forward limits and encashment rules.
2. Compare your policy against the statutory floor for each state. Your policy may be more generous; it may not be less.
3. Check national and festival holidays. Most states mandate certain holidays and a minimum number of festival holidays. Confirm your holiday calendar is issued in advance and meets the state requirement.
4. Verify weekly off, daily and weekly hour limits, spread-over limits, and rest interval requirements.
5. Test overtime against statutory caps on overtime hours for the relevant period.
6. Check maternity benefit compliance: paid leave duration, adoption and commissioning mother provisions, work-from-home where mutually agreed and feasible, crèche obligations where the applicable headcount threshold is met, nursing breaks, and the prohibition on dismissal during the protected period. Verify the current thresholds and durations.
7. Check paternity, bereavement or other contractual leaves for internal consistency, and ensure they are administered as documented.
8. Verify leave encashment on exit is computed on the correct wage base — a place where the wage definition change is directly relevant.
9. For remote and hybrid employees, document how hours and leave are recorded. "We don't track hours for remote staff" is a records finding, not a culture choice.

Phase 8: Contract labour, vendors and gig workers

For most SMBs, this is the highest-risk phase relative to the attention it receives. As a principal employer, your liability for a contractor's failures is not theoretical.

Step-by-step:

1. Build a complete inventory of every third party supplying labour to your premises or your work: housekeeping, security, facilities, drivers, staffing partners, IT contractors, field sales agencies, delivery partners and BPO vendors.
2. For each, determine whether the arrangement is contract labour (workers under your supervision or on your premises) or a genuine outsourced service.
3. Where contract labour applies and the threshold is met, verify your registration as principal employer and the contractor's licence, and confirm both cover the actual number of workers deployed.
4. Collect, every month, before releasing payment: the contractor's worker list, wage register or wage sheet, proof of wage payment, PF ECR and challan, ESI contribution and challan, and evidence of any other applicable deduction.
5. Reconcile the worker list against your gate register or access logs. Ghost workers and headcount mismatches are common and are your problem too.
6. Verify that contract workers are paid at least the applicable minimum wage and, where required, wages not less than those of comparable directly employed workers.
7. Confirm that contractors are meeting facility obligations — canteen, restrooms, drinking water, first aid — where applicable, and that your contract allocates responsibility clearly.
8. Check your contracts. They should include compliance warranties, monthly evidence obligations, a right to audit, indemnity for statutory defaults, and a right to withhold payment against non-submission of proof.
9. Confirm the process for principal-employer substitution: if a contractor fails to pay wages or contributions, you may be required to pay and recover. Have a documented process, not a panic.
10. For gig and platform workers, review your engagement terms, the social security framework applicable to aggregators under the social security code as implemented, any registration or contribution obligation, and whether your commercial model creates an employment relationship in substance.

Red flags: a housekeeping vendor invoicing a lump sum with no wage breakup; a staffing partner whose PF number never appears on any challan you have seen; long-tenured "vendor" staff sitting at your desks with your email addresses; contracts renewed by purchase order with no compliance clauses.

Phase 9: Mandated committees, policies and workplace obligations

Committees and policies are cheap to fix and embarrassing to miss, because their absence is visible on day one of any inspection or diligence.

Step-by-step:

1. POSH. Confirm you have a written policy against sexual harassment, an Internal Committee constituted for each office that meets the applicable headcount threshold, with the prescribed composition including a presiding officer who is a woman, the required number of members, and an external member from an NGO or with relevant experience.
2. Verify IC members' appointment orders, tenure limits and reappointment where tenure has lapsed. Lapsed ICs are extremely common.
3. Confirm IC members have received training, that complaint procedures are documented, that a complaints register is maintained confidentially, that the annual report has been prepared and submitted, and that IC details and the policy are displayed conspicuously.
4. Where an office falls below the threshold, confirm employees know how to reach the Local Committee.
5. Grievance redressal. Confirm a grievance mechanism exists, with named contacts, timelines and escalation. Certain statutes and the industrial relations code framework contemplate grievance committees at prescribed headcounts — verify what applies to you.
6. Standing orders / service rules. Check whether your establishment is required to have certified standing orders or model standing orders, and whether your service rules are consistent with them.
7. Code of conduct and disciplinary process. Confirm a documented process with charge-sheet, enquiry, natural justice safeguards and proportionate outcomes. Test it against actual disciplinary cases in the audit period.
8. Other policies to test for existence, currency and acknowledgement: leave, attendance and remote work; maternity and parental support; equal opportunity and anti-discrimination; whistleblower; conflict of interest; travel and reimbursement; information security and acceptable use; social media; anti-bribery; and separation.
9. Confirm each policy has a version number, an approval record, an effective date, and evidence of employee acknowledgement.
10. Check safety and welfare obligations applicable to your premises: first aid, fire safety, emergency exits and drills, drinking water, restrooms, and accessibility obligations.

Phase 10: Employee data privacy and records handling

HR holds the most sensitive personal data in most organisations, and India's data protection framework has moved this from an IT concern to an HR obligation.

Step-by-step:

1. Map employee personal data: what you collect, why, where it is stored, who can access it, how long you keep it, and which third parties process it — payroll vendors, background verification agencies, insurers, benefits platforms.
2. Confirm you collect only what you need. Copies of Aadhaar, family details and health records should have a stated purpose.
3. Confirm notice and consent practices at hiring and during employment, in plain language.
4. Review vendor contracts for data processing terms, security obligations, breach notification and deletion on termination.
5. Confirm access controls: who in HR can see salary, medical and disciplinary records, and whether access is logged.
6. Define retention and deletion for ex-employee data, balanced against statutory retention obligations — you cannot delete records you are legally required to keep.
7. Document a breach response process, including who notifies whom and within what timeline.
8. Confirm special handling for sensitive categories: health records, disability disclosures, POSH complaint files and background verification reports.

Scoring and risk-rating your findings

A list of two hundred findings with no priority is not a report; it is a stress source. Rate every finding on severity and likelihood, then act on the product.

Severity — the consequence if the gap is discovered or crystallises:

• Critical: unremitted statutory dues, no PF/ESI coverage where required, no POSH IC, no registration for an operating location, systematic underpayment of minimum wages.
• High: late remittances or filings, incorrect wage base, missing registers, contract labour without licence, missing employment contracts for a class of workers.
• Medium: incomplete registers, missing acknowledgements, stale policies, incomplete nomination forms.
• Low: formatting and documentation hygiene, missing photographs of displays, naming inconsistencies.

Likelihood — the realistic probability of detection or crystallisation, considering inspection frequency in your state, data-matching between authorities, employee grievance risk and upcoming diligence events.

Alongside the matrix, give each domain a simple compliance score — for example, the percentage of applicable checklist items fully evidenced. Domain scores let you show a board a one-page picture: registrations 95 per cent, payroll 78 per cent, contractor compliance 41 per cent. Trends across audits matter more than absolute numbers.

Quantify exposure where you responsibly can — for example, the arithmetic of contributions not made on a restated wage base for the period concerned. Do not invent penalty figures; instead, describe the categories of consequence (arrears, interest, damages, prosecution risk, reputational and diligence impact) and get a qualified advisor to quantify anything you intend to provide for in your accounts.

Building the remediation plan

Every finding becomes a row with a named human and a date. Nothing else works.

Sequencing advice that holds up in practice:

1. Stop the bleeding first. Anything that accrues daily — unremitted contributions, unpaid wages, uncovered employees — gets fixed before anything cosmetic.
2. Fix the source, not the symptom. If wage register data is wrong, correcting the register without correcting the payroll master guarantees a repeat finding.
3. Take advice on historical exposure. Voluntary regularisation of past periods can be the right call, but the approach — what to disclose, to whom, in what sequence — should be decided with a qualified advisor.
4. Bundle by owner. Twenty findings assigned to the payroll manager should be one workplan, not twenty tickets.
5. Close with evidence. A finding is closed when the proof is filed, not when someone says it is done.
6. Re-test after closure. Sample the fixed items in the next quarterly spot-check.

How an HRMS reduces audit effort

Most of the pain in a first HR compliance audit comes from reconstruction: hunting for offer letters in email, rebuilding attendance from three sources, matching challans to months. A properly configured HRMS turns the audit from an excavation into a query.

• Single source of truth for headcount. Employee master, payroll and statutory filings drawing from one record eliminates the three-different-numbers problem.
• Document vault. Offer letters, appointment letters, contracts, ID proofs, nominations and policy acknowledgements stored against each employee, with issue and acknowledgement timestamps.
• Registers generated, not maintained. Wage, attendance, leave and overtime registers produced on demand from live data, in a printable format.
• Payroll engine aware of wage definitions. Component-level classification lets you model the statutory wage definition and see the cost impact before you restructure.
• State-aware configuration. Professional tax slabs, LWF cycles, leave rules and holiday calendars set per location rather than per company.
• Statutory outputs. ECR files, contribution statements and TDS inputs generated from the same data that produced the payslip, which is what makes reconciliation trivial.
• Compliance calendar and alerts. Due dates with owners and escalation, so a missed filing is caught in days rather than at audit.
• Audit trails. Who changed a salary, when, and with whose approval — the question every diligence process eventually asks.
• Access control and retention. Role-based access to sensitive HR data and configurable retention aligned to statutory periods.
• Contractor module or register. A place to record vendor compliance submissions monthly, linked to invoice release.

The measurable benefit is not glamour; it is time. Teams that move registers and payroll into a single system typically find that the annual audit shifts from weeks of document-hunting to days of testing and judgement — which is where HR time is actually worth spending.

Preparing for an external inspection

Assume an inspection will happen at a time you have not chosen. Preparation is mostly about being able to produce documents calmly.

1. Nominate a single point of contact and a backup, and tell reception who they are. Nobody else engages substantively.
2. Keep an inspection-ready folder — physical and digital — with registrations, licences, the last twelve months of challans and returns, current registers, policies, IC constitution and notice-board photographs.
3. Verify identity and authority. Record the inspector's name, designation, office and the statute under which the visit is made.
4. Record the visit in the inspection book or visit register where required, and take contemporaneous notes.
5. Provide what is asked for, accurately. Do not volunteer unrelated documents, and never provide a document you have not read.
6. If you do not have something to hand, say so and commit to a timeline instead of improvising an answer.
7. Ask for observations in writing and take a copy of anything signed.
8. Debrief the same day. Log requested documents, commitments made and deadlines, and route them into the remediation tracker.
9. Involve your advisor early where the visit concerns coverage disputes, wage classification or contractor liability.
10. Follow up in writing with what was submitted and when. A clean correspondence trail is worth a great deal later.

A quarterly compliance rhythm

Annual audits fail when the other eleven months are unmanaged. Put compliance on a cadence.

Set calendar reminders with named owners for every due date. A compliance calendar with no owner is a wish list.

Common gaps SMBs miss

Patterns repeat across small and mid-sized Indian employers. Check these first — they are where most self-audits find their earliest wins.

• The second office nobody registered. A sales team of four in another city, working from a co-working space, with no local Shops and Establishments registration, no state PT registration and no local holiday calendar.
• Professional tax by head office. PT deducted at the registered office state's slab for employees who actually work elsewhere.
• Basic pay set at 30 per cent by default. A structure designed for low PF cost that becomes a restatement problem under the statutory wage definition.
• Interns doing employee work. Long "internships" with production responsibilities, stipends below minimum wage, and no PF assessment.
• Consultants who are employees in substance. Fixed hours, company laptop, single client, reporting manager, and a professional-fee invoice.
• Contractor evidence collected annually, not monthly. By the time you check, the workers have rotated and the records are unavailable.
• A lapsed POSH IC. Constituted three years ago, half the members have left, and no reconstitution order exists.
• Nomination forms never collected. PF and gratuity nominations missing across the population, which becomes acute at exactly the wrong moment.
• PF enrolment from the wrong date. Coverage started from the first payroll month rather than the date of joining.
• Attendance and overtime invisible. Especially for field staff, warehouse shifts and remote employees.
• Leave policy written for one state. Applied uniformly across states with different statutory minimums.
• Exits without full-and-final discipline. Settlements delayed beyond the applicable timeline, gratuity computed on the wrong wage base, relieving letters issued without asset recovery.
• No inspection book, no notice board. Especially at leased and shared premises.
• A consultant who "handles compliance" with no documented register, no acknowledgements shared, and no visibility for the company.
• Records with no retention policy. Either deleted too early or hoarded indefinitely, both of which create risk.

Frequently asked questions

How often should we run an HR compliance audit? A full statutory audit once a year is the baseline, supported by quarterly payroll and register spot-checks and monthly contractor evidence collection. Run an additional audit whenever you cross a headcount threshold, open a location in a new state, restructure salaries, change payroll providers, or prepare for a fundraise or acquisition.

Can a small startup do this without a consultant? Largely yes, for the first pass. Building the compliance register, collecting evidence and testing checklist items is work that an organised HR or finance person can do. Where you should bring in a qualified labour law advisor is on applicability questions, historical exposure and regularisation strategy, wage restructuring decisions, contractor liability, and anything involving a notice or dispute. Doing the groundwork internally makes advisory time cheaper and sharper.

What does the labour code consolidation change for our records and registers? The stated direction is fewer and simpler combined registers, common definitions across statutes, electronic maintenance and combined returns. The practical effect is that your data has to be cleaner, because a consolidated register exposes gaps that four separate registers used to hide. Implementation is staggered and state rules matter, so verify the current position for each state you operate in rather than assuming a single national switch-over date.

Why does the definition of wages matter so much for payroll? Because it determines the base for provident fund, gratuity, bonus, leave encashment and several other entitlements. The statutory definition includes core pay elements, excludes a specified list of components, and then deems the excess to be wages if the excluded components cross a prescribed proportion of total remuneration. Salary structures built to minimise the wage base by inflating allowances do not survive that test. Model the impact on your own numbers and verify the operative rules before you restructure.

What are the most common findings in a first HR compliance audit? Missing or stale registrations for secondary locations, incomplete employment documentation, incorrect professional tax by state, registers that exist only as ad-hoc reports, contractor compliance evidence collected irregularly, a lapsed or improperly constituted POSH internal committee, and missing nomination forms. None of these are exotic, and all are fixable.

How do we handle historical non-compliance we discover during the audit? Do not conceal it and do not act unilaterally. Document what you found and the period involved, quantify the arithmetic exposure, and take advice from a qualified advisor on the correct route — voluntary payment of arrears with applicable interest, corrective filings, or a formal representation. Fix the forward-looking process at the same time, because regularising the past while continuing the same practice is the worst of both worlds.

Are we responsible for our contractor's PF and ESI defaults? As a principal employer, your exposure is real. The framework generally contemplates that the principal employer may be required to pay amounts a contractor has failed to pay, with a right of recovery from the contractor. That is why monthly evidence collection linked to invoice release, compliance warranties, audit rights and withholding clauses matter more than any annual certificate. Verify the specific obligations applicable to your arrangements.

Do fully remote employees change our compliance obligations? They can. Where an employee works may affect professional tax, state leave and holiday entitlements, and in some cases registration questions. Working hours and leave still need to be recorded. Set a policy that defines the employee's place of work for statutory purposes, keep attendance and leave records for remote staff, and review the position with an advisor if you have employees spread across many states.

What should we keep, and for how long? Different statutes prescribe different retention periods for wage records, registers, contribution records and returns. The safe operating rule is to retain each record for the longest applicable statutory period, keep it retrievable in readable form, and only then apply deletion. Balance this against data-minimisation expectations: retain what the law requires, not everything you have ever collected.

Turning the audit into a system

The value of an HR compliance audit is not the report. It is the shift from a reactive posture — scrambling when a notice arrives — to a system where obligations are known, owned, calendared and evidenced. The organisations that handle the labour code transition well will not be the ones with the largest compliance budgets; they will be the ones whose employee, wage and attendance data is already clean enough that a change in register formats or wage definitions is a configuration exercise rather than a reconstruction project.

Start small if you must. Build the compliance register. Run one phase this month and another next month. Assign owners and dates. Re-test in the next quarter. Within two cycles you will have something most SMBs do not: a defensible, evidenced picture of where you stand.

If you would like the record-keeping side of this handled by software rather than spreadsheets — employee master and document vault, payroll with state-aware statutory configuration, auto-generated registers and payslips, a compliance calendar with owners and alerts, and audit trails that survive diligence — CozyHR is built for exactly this kind of Indian SMB and startup HR team. Try CozyHR and see how much of your next HR compliance audit the system can answer for you.

This article is general information for HR and payroll practitioners in India and is not legal or tax advice. Statutory thresholds, contribution rates, forms, due dates and applicability tests change and vary by state. Always verify the current position with the relevant authority or a qualified professional advisor before acting.