Statutory Registers and Digital HR Records: 2026 Guide

Statutory Registers and Digital HR Records: 2026 Guide

Most Indian employers discover the true state of their statutory registers on the worst possible day: when an inspector walks in, or when a client's vendor audit lands with a two-week deadline. Until then, the muster roll lives in a spreadsheet someone half-maintains, the wage register is whatever the payroll consultant emailed last quarter, and nobody can say with confidence where the leave records for a contractor who exited two years ago are stored.

This guide is about fixing that permanently. Statutory registers are the formal records that labour and tax law expects an employer to create and preserve — wages, attendance, overtime, leave, muster roll, employee master data, provident fund and ESI contributions, TDS filings, POSH committee records, and contract labour documentation. They exist so that a third party can reconstruct, from your own records, exactly what you paid a worker, when they worked, what was deducted, and whether you followed the rules.

We will cover which registers are generally expected, how long to hold them, how the move to electronic registers under the consolidated labour codes changes day-to-day practice, how to design a compliance document repository that survives staff turnover, and how an HRMS turns register generation from a monthly scramble into a background process.

A note before we begin: labour compliance in India is a mix of central legislation and state-specific rules, and the exact register formats, retention periods, and filing mechanics vary by state, by establishment type, and by headcount. Everything here is directional. Verify the specifics for your registered locations with the applicable state rules, your labour department, or qualified counsel.

Why Statutory Registers Matter More Than Employers Think

It is tempting to treat registers as paperwork — a compliance tax you pay so someone will go away. That framing is why most register systems are broken.

Registers are the evidence layer for every employment claim

When an employee disputes their final settlement, when a worker claims unpaid overtime, when a regulator questions a PF contribution, the argument is settled by records. Not by memory, not by intent, and rarely by a manager's account of what happened.

If your wage register shows a consistent, dated, reconcilable trail from attendance to gross pay to deductions to net pay, most disputes end quickly. If it does not, you are arguing from a weaker position regardless of whether you actually did the right thing.

Registers are increasingly a commercial requirement

Enterprise clients, especially in IT services, BFSI, manufacturing supply chains, and anything touching a listed entity, now run vendor compliance audits. They ask for wage registers, PF and ESI challans, and proof of statutory payments for the staff deployed on their account — often monthly, as a condition of invoice release.

For a services SMB, poor record-keeping compliance stops being an abstract legal risk and becomes a cash flow problem. Invoices sit unpaid because a compliance pack was incomplete.

Registers are also a due diligence artefact

Any funding round, acquisition, or debt raise involves a labour and HR diligence workstream. The diligence checklist reliably asks for registration certificates, wage and attendance registers, PF/ESI records, POSH constitution and annual reporting, and contractor compliance documentation.

Founders who cannot produce these quickly end up negotiating indemnities and escrow holdbacks. Founders who can produce a clean, indexed repository in a day get through diligence without drama.

The cost asymmetry is brutal

Maintaining registers properly costs a few hours a month once systems are in place. Reconstructing three years of records retroactively costs weeks of senior HR and finance time, plus consultant fees, plus the opportunity cost of everything not being done during that scramble.

Digital HR records tilt this asymmetry decisively. Once attendance, payroll, and employee master data live in one system, register generation is a query, not a project.

The Legal Landscape in Plain English

You do not need to be a labour lawyer to run compliant record-keeping. You do need a working mental model of where obligations come from.

Four sources of record-keeping obligations

Central labour legislation and the consolidated labour codes. India has moved toward consolidating a large body of central labour law into four codes covering wages, industrial relations, social security, and occupational safety, health and working conditions. The codes contemplate simplified, common registers and returns, and explicitly allow for electronic maintenance. Implementation has been phased and state rule-making has proceeded at different speeds, so many establishments operate under a mix of legacy Act-based requirements and newer code-aligned formats.

State shops and establishments legislation. If you are a typical startup or SMB office, this is the primary law governing your working hours, leave, holidays, and the registers you keep. It is state law, so a Karnataka office and a Maharashtra office may face different formats, different leave rules, and different display or filing obligations.

Social security and tax administration. EPFO and ESIC prescribe their own record and return requirements. The Income Tax Department prescribes TDS deduction, deposit, and quarterly return obligations, plus Form 16 issuance, plus supporting documentation for employee investment declarations and exemption claims.

Standalone workplace legislation. The law on prevention of sexual harassment at the workplace creates its own record-keeping and reporting obligations — constitution of an internal committee, complaint records, and an annual report. Maternity benefit provisions, gratuity, and bonus obligations each create records too.

What "statutory register" actually means

A statutory register is a record that legislation or subordinate rules expect you to maintain in a prescribed or substantially equivalent form, keep available for inspection, and preserve for a defined period.

Three characteristics distinguish a statutory register from ordinary business records:

• Prescribed content. The rules generally specify the fields — not just "keep attendance records" but which particulars must appear.
• Availability on demand. An inspecting authority can ask to see them, often at the premises or accessible from the premises.
• Defined preservation. You must keep them for a stated period after the last entry, and destroying them early is itself a problem.

The important nuance about formats

Under the older Act-by-Act regime, an establishment might have maintained a separate register under each applicable law, with overlapping data in different formats. The consolidation effort has pushed toward common registers — a single wage register, a single employee register, a single attendance and overtime record — that serve multiple statutes.

In practice, many employers now maintain the combined formats while retaining the ability to produce legacy formats if a specific authority asks. A good HRMS handles this by storing the underlying data cleanly and rendering it into whichever format is required.

The Core Statutory Registers: A Register-by-Register Checklist

Below is a working checklist of the registers and records most Indian employers are generally expected to maintain. Applicability depends on your state, sector, headcount, and whether you employ contract labour. Treat this as a starting inventory to validate against your own footprint.

Reading the checklist correctly

Not every row applies to every employer. A twelve-person SaaS startup in Bengaluru with no contract labour and no ESI-covered employees will not maintain a contractor register or an accident register in any meaningful sense. A 300-person BPO with housekeeping and security vendors will maintain nearly all of them.

The right approach is an applicability mapping exercise, which we cover in the implementation plan later. Do not maintain registers you do not need, and do not assume a register is irrelevant because it feels like it belongs to a factory.

The employee register deserves special attention

Almost every other register derives from it. If your employee master data has inconsistent joining dates, missing statutory IDs, or duplicate records for rehires, every downstream register inherits those errors.

Treat employee master data as the single source of truth and enforce validation at entry: no record created without date of joining, designation, statutory ID capture status, and nominee details.

Muster roll and attendance are where most disputes start

Attendance is the input to wages, overtime, leave, and full-and-final settlement. It is also the record most likely to be maintained loosely — a shared spreadsheet, a WhatsApp group, a supervisor's notebook.

If you fix one thing this quarter, fix attendance capture. A timestamped, immutable, per-employee daily record removes an entire category of downstream problems.

How Long to Keep Records: A Retention Framework

Retention is where employers most often go wrong in both directions — deleting too early, and hoarding everything forever without a policy.

The honest answer about retention periods

Retention requirements in India are scattered across central rules, state rules, and tax law. They are not uniform. Some rules specify a preservation period running from the date of the last entry in a register; others tie retention to the resolution of proceedings; tax law has its own preservation expectations tied to assessment timelines.

Because of this variation, the table below gives general, directional guidance in ranges rather than asserting exact periods. Confirm the applicable number for each register against the specific rules for your state and establishment type before you set a deletion policy.

Four practical retention rules

Rule one: retention starts from the last entry, not from creation. A wage register for an ongoing period is "live" until closed. The clock generally runs from when the register is closed out, not from the first line item.

Rule two: when in doubt, keep longer. Digital storage is inexpensive. The risk of premature deletion far outweighs the cost of an extra few years of retention for most HR records. The exception is genuinely sensitive personal data, where over-retention has its own risks.

Rule three: never delete anything subject to a live dispute or inquiry. If there is a pending case, an ongoing inspection, a POSH inquiry, or a tax proceeding, put a legal hold on the relevant records and suspend the normal retention schedule until it closes.

Rule four: write the policy down and follow it. A documented retention schedule that you actually apply is defensible. Ad hoc deletion looks like spoliation even when it is not.

Building your retention schedule

Create a simple retention register — a single table listing every record type, the applicable rule reference, the retention period you have adopted, the storage location, the owner, and the review date. Have it reviewed by counsel once, then update it annually.

This one document answers most of the questions an auditor will ask about your record-keeping compliance framework, and it prevents the "should we delete this?" conversation from being reinvented every year.

Paper Registers vs Electronic Registers

The shift toward electronic registers is one of the more genuinely useful modernisations in Indian labour compliance.

What the codes changed

The consolidated labour codes and associated rules contemplate maintaining registers and records in electronic form and filing returns electronically. Combined with the push toward unified formats, this means an employer can, in principle, maintain one digital record set that serves multiple statutes rather than parallel paper books.

The direction of travel is clear even where state-level implementation is still catching up. Employers building systems today should build for digital-first with the ability to produce printed, signed extracts on demand.

The comparison

What digital does not solve

Going digital does not fix bad data. A payroll system fed with unreliable attendance produces a beautifully formatted wage register that is still wrong.

It also does not remove the need to know your obligations. Software generates registers in the formats it has been configured for; if your state requires a specific format that has not been configured, the system will happily produce the wrong thing.

Practical guardrails for electronic registers

• Make records tamper-evident. Every edit should be logged with user, timestamp, prior value, and reason. This is what turns a spreadsheet into a defensible record.
• Control who can edit closed periods. Once a payroll month is closed, editing should require an authorised reversal with a documented reason, not a silent overwrite.
• Keep an export path. You should be able to produce a clean PDF or printed extract for any register and period without engineering help.
• Decide your authentication approach. Some authorities expect signed or authenticated records. Decide whether you use digital signatures, a documented approval workflow, or periodically signed printouts — and be consistent.
• Back it up, and test the restore. An untested backup is a hypothesis. Restore a sample quarterly.
• Retain the paper you already have. Do not shred legacy registers when you digitise. Scan them, index them, and keep the originals until their retention period expires.

Handling the transition period

Most employers moving to digital will run a hybrid for a while. Manage this deliberately:

1. Pick a cut-over date per register type, not one global date.
2. Scan and index all historical paper registers before cut-over, with a consistent file-naming convention.
3. Store scanned historicals in the same repository structure as new digital records, clearly marked as archived.
4. Record the cut-over date in your compliance manual so future staff know where the boundary sits.
5. Keep the original paper in a labelled, access-controlled physical archive with a location index in the digital repository.

Structuring a Compliance Document Repository

A repository is not a folder called "HR Docs" on a shared drive. It is a designed structure with naming conventions, access rules, and an index.

The design principles

Principle one: structure by entity, then location, then year, then record type. Compliance obligations attach to a registered establishment at a location. Your folder tree should mirror that reality so a location-specific inspection maps to a single branch.

Principle two: one canonical location per document. If a challan lives in three folders, two of them will go stale. Link, do not duplicate.

Principle three: naming conventions that sort correctly. Dates in YYYY-MM format at the start of relevant filenames means chronological sorting is automatic.

Principle four: separate the sensitive. POSH records, medical documents, disciplinary files, and background verification reports need tighter access than a wage register.

Principle five: an index that a stranger can use. Assume the person searching in three years has never met you.

A reference folder structure

`` /Compliance /01-Entity-Registrations /Certificate-of-Incorporation /Shops-and-Establishment /PF-Registration /ESI-Registration /Professional-Tax /Other-Licences /02-Establishments /Bengaluru-HO /2026 /Registers /Employee-Register /Muster-Roll /Wage-Register /Overtime-Register /Leave-Register /Fines-Deductions-Advances /Returns-and-Filings /Notices-and-Inspections /Displays-and-Abstracts /2025 /Archive-Paper-Scans /Pune-Office /03-Payroll /2026 /2026-04 /Payroll-Register /Payslips /Bank-Advice /Variance-and-Approval /04-Statutory-Payments /PF /ECR-Filings /Challans /Nominations /ESI /Professional-Tax /TDS /Challans /Quarterly-Returns /Form-16 /Employee-Declarations /05-Employee-Files /Active /Exited /06-Contractors-and-Vendors /VendorName /Agreement-and-Licences /Monthly-Compliance-Packs /07-POSH [restricted access] /IC-Constitution /Training-Records /Annual-Reports /Complaints [further restricted] /08-Policies-and-Acknowledgements /09-Retention-Schedule-and-Compliance-Calendar ``

Naming conventions that hold up

Adopt a single pattern and enforce it:

YYYY-MM_Location_RecordType_Version.ext

Examples: - 2026-04_BLR_Wage-Register_v1.pdf - 2026-04_BLR_PF-ECR-Challan.pdf - 2026-Q1_TDS-Return-24Q_Acknowledgement.pdf - 2026_POSH_Annual-Report_Final.pdf

The value of this is not aesthetic. It means a filtered search for 2026-04_BLR returns the entire compliance pack for one location for one month, which is exactly what an inspector or auditor asks for.

Access control tiers

Review access quarterly and immediately on any role change or exit. The most common access failure is not a breach — it is an ex-employee whose permissions were never revoked.

The repository index

Maintain one spreadsheet or system page that lists, for every record type: where it lives, who owns it, how often it is updated, its retention period, and the date of last review. This is the map. Without it, structure decays within two staff changes.

Register-by-Register Deep Dive

Here is what good looks like for the registers that cause the most trouble.

The employee register

Capture at minimum: employee code, full name as per official ID, gender, date of birth, father's or spouse's name where the format requires it, permanent and current address, date of joining, designation and department, nature of employment, UAN, ESIC IP number where applicable, PAN, bank account details, nominee details, and date and reason of exit.

Two disciplines matter. First, no employee is activated in payroll until the register record is complete — make it a hard gate. Second, exits update the register on the exit date, not whenever someone gets around to it.

The muster roll and attendance record

The muster roll should show, per employee per day, whether they were present, absent, on leave, on weekly off, or on holiday — plus in and out times where hours matter.

Common failure modes to avoid:

• Attendance regularised in bulk at month end with no supporting request or approval
• Remote and hybrid employees marked present by default with no positive confirmation
• Field staff attendance captured only in a supervisor's message thread
• No record of the weekly off pattern, making overtime calculation unverifiable

For hybrid teams, a simple daily confirmation — app check-in, geo-tagged where appropriate, or a system-recorded work log — creates the positive record you need.

The wage register

The wage register must let a reader move from days worked to net pay without external information. That means it needs the period, days and hours worked, each wage component separately, gross wages, each deduction itemised, net wages, and the date and mode of payment.

The single biggest quality issue is deductions shown as a lump sum. "Deductions: 6,240" tells an inspector nothing. Break out PF, ESI, professional tax, TDS, and any other deduction as separate columns.

The overtime register

Where overtime applies, record the date, the extra hours, the rate applied, and the amount paid. Two mistakes recur: overtime paid as a flat allowance with no hours recorded, and overtime absorbed into "special allowance" so it is invisible in the register.

Both create the same problem — you cannot demonstrate that extra hours were compensated at the applicable rate, even if you paid generously.

The leave register

Track opening balance, leave earned during the period, leave availed with dates and type, leave encashed, lapses, and closing balance. The register should reconcile: opening plus earned minus availed minus encashed minus lapsed equals closing.

If your leave balances do not reconcile arithmetically, they will not survive scrutiny, and full-and-final settlements built on them will be wrong.

PF and ESI records

Beyond the monthly ECR and challan, keep: registration certificates, the monthly contribution statement showing employee-wise wages and contributions, nomination forms, UAN activation and KYC status, records of international worker status where relevant, and any correspondence with the authorities.

Reconcile three numbers every month: the PF liability in your payroll register, the ECR uploaded, and the challan paid. If they differ, resolve it that month. Differences compound and become very difficult to unwind a year later.

TDS records

Keep employee investment declarations at the start of the year, actual proofs collected before the final quarter, the tax computation sheet per employee, monthly challans, quarterly return acknowledgements, and Form 16 with both parts.

The frequent gap is proofs. Declarations are collected diligently in April; proofs are collected loosely in January. If you allowed an exemption without a proof on file, that is an exposure sitting in your records.

POSH records

Maintain the order constituting the internal committee with member names and the external member's details, evidence of employee awareness and IC training, a complaint register with case identifiers rather than names in the general log, complete inquiry files under restricted access, and the annual report.

Confidentiality is a legal obligation here, not a courtesy. Store complaint files separately from general HR records, restrict access to IC members, and never route them through general shared drives or group email.

Contract labour records

As a principal employer, you are expected to exercise oversight of your contractors' compliance for workers deployed on your premises. Maintain the contract, the contractor's registration and licence where applicable, and a monthly compliance pack.

A workable monthly contractor pack contains: attendance for deployed workers, wage register extract, proof of wage payment through banking channels, PF and ESI challans with employee-wise breakup, and a signed self-declaration of compliance.

Make the pack a condition of invoice processing. Nothing improves contractor compliance faster than linking it to payment.

Worked Examples

Abstract advice is easy to nod at. Here are three concrete scenarios.

Worked example 1: a 40-person services startup in Bengaluru

Situation. A design and engineering services firm, 40 employees, one office, no contract labour except a housekeeping vendor providing two staff. Payroll run by an external consultant on a spreadsheet. Attendance tracked in a shared sheet. A large client has requested a monthly vendor compliance pack.

What was missing. No formal employee register — data was scattered across offer letters and the payroll sheet. No wage register in any prescribed format; the payroll sheet showed net pay with deductions lumped together. Leave balances maintained by the office manager in a separate sheet that did not tie to the payroll sheet. No documented POSH internal committee.

What they did, in order.

1. Built a single employee master with every required field, validated against ID documents. Two employees had different dates of joining in different documents; both were resolved with corrected records and a file note.
2. Moved attendance into an HRMS with daily check-in, so the muster roll became a system output rather than a manual sheet.
3. Restructured the payroll output into a proper wage register with itemised deductions, generated monthly and archived as PDF.
4. Rebuilt leave balances from joining date, reconciled them to the leave policy, and got each employee to confirm their balance in writing once — creating a clean baseline.
5. Constituted the POSH internal committee, ran an awareness session, and filed the constitution order.
6. Created the folder structure and a monthly compliance pack template mapping exactly to the client's checklist.

Result. The monthly client pack went from a two-day scramble to a 45-minute assembly job, most of which is exporting and checking. The leave baseline exercise surfaced a cumulative over-accrual that would have cost real money at settlement time.

Worked example 2: reconciling a PF mismatch

Situation. A 120-person company discovers during an audit that the PF liability in its payroll register for a given month does not match the amount in the ECR filed for that month.

Diagnosis process.

1. Pull the payroll register for the month and total the employer and employee PF columns.
2. Pull the ECR file uploaded for the same month and total the same fields.
3. Pull the challan and confirm what was actually remitted.
4. Compare employee-by-employee, not just in total. Totals can match while individual records are wrong, and individual mismatches are what surface in a member's account.
5. Identify the pattern. Common causes: a mid-month joiner included in payroll but omitted from the ECR; an exited employee included in the ECR after their last working day; a wage revision applied in payroll but not reflected in the ECR base; an employee moved between establishments.

Resolution. Correct the underlying master data first, then file the correction through the appropriate mechanism, document the reason in a reconciliation note, and store the note alongside that month's records. The note matters — in two years, nobody will remember why the numbers differed, and an unexplained difference looks worse than a documented correction.

Prevention. Make the payroll-to-ECR-to-challan reconciliation a mandatory monthly checklist item with a named owner and a sign-off. In an HRMS, this reconciliation can be automated and flagged as an exception rather than being someone's manual comparison.

Worked example 3: preparing for an unannounced inspection

Situation. An inspecting officer arrives at a 200-person operations centre without prior notice and asks for wage, attendance, and leave records for the previous twelve months, plus registration certificates and PF/ESI payment proof.

What a prepared employer does.

The compliance lead is called, opens the repository, and filters for the location and period. Registers are exported as PDFs and printed. Registration certificates are pulled from the permanent file. PF and ESI challans for twelve months are already stored month-wise. The whole assembly takes under two hours, and the officer is given a clearly indexed set of documents with a covering list.

What an unprepared employer does.

Calls the payroll consultant, who is unavailable. Searches email for old attachments. Finds registers for eight of twelve months. Discovers the wage register format in use does not itemise deductions. Asks for time, which creates an impression of disorganisation regardless of whether payments were correct.

The difference between these two outcomes is entirely preparation. The underlying compliance may be identical.

Inspection and Audit Readiness

Readiness is a state you maintain, not an activity you perform when something happens.

The inspection-day readiness checklist

Fill the "last verified" column monthly. An unverified checklist is decoration.

How to handle an inspection professionally

1. Have a protocol at reception. Whoever greets visitors should know to record the officer's name, designation, and identification, and to immediately notify the designated compliance contact.
2. Designate a single point of contact. Multiple people answering questions produces inconsistent answers. One named person handles the interaction; others provide documents to that person.
3. Be cooperative and factual. Provide what is asked for. Do not volunteer unrelated documents, and do not speculate about matters you have not verified.
4. Record what was provided. Maintain a list of every document handed over, with dates and page counts, acknowledged where possible.
5. Note observations accurately. If observations are recorded, get a copy. Do not sign anything you have not read and understood.
6. Escalate appropriately. Loop in your HR head, founder, and counsel per your protocol — before making commitments.
7. Close the loop in writing. Follow up on any commitments with dated written responses, and file the entire correspondence chain.

Running an internal audit

Twice a year, audit yourself with the same rigour an external party would.

Sampling approach. Pick three months at random from the last eighteen. For each month, select five employees across different bands — a new joiner, an exit, a high earner, an employee who took leave, and an employee with overtime if applicable.

For each sampled employee, verify the chain: appointment letter terms → employee register entry → attendance for the month → leave register movement → wage register computation → payslip issued → PF/ESI contribution → TDS deducted → bank payment record.

If the chain holds for fifteen employee-months, your system is probably sound. If it breaks in three, you have a systemic issue worth fixing rather than fifteen individual corrections.

Document the audit. Record the scope, sample, findings, corrective actions, and closure dates. An internal audit trail demonstrates good faith and a functioning control environment, which matters in both regulatory and commercial contexts.

The Compliance Calendar

Record-keeping fails most often not because anyone decided to skip it but because nobody owned a date.

Making the calendar stick

Put every recurring item into a shared task system with a named owner and a due date, not into a document nobody opens. Escalate overdue items to the HR head automatically. Review the calendar in a monthly compliance standup that takes fifteen minutes.

The calendar is also your handover document. When your payroll executive resigns, the calendar plus the repository index is what lets a replacement pick up in days rather than months.

Common Mistakes in Statutory Register Maintenance

These are the recurring patterns that turn manageable obligations into audit findings.

Mistake 1: treating payslips as the wage register

A payslip is a communication to an employee. A wage register is a consolidated record across employees for a period, in a prescribed structure. Having twelve months of payslips does not mean you have a wage register.

Fix: generate and archive a proper consolidated wage register every month, separately from payslips.

Mistake 2: lumping deductions together

A single "deductions" figure defeats the purpose of the register. Every deduction must be identifiable and traceable to its statutory basis.

Fix: itemise PF, ESI, PT, TDS, and any other deduction in separate columns.

Mistake 3: attendance regularised in bulk at month end

When a month's attendance is filled in during the last two days from memory, the record is not evidence of anything. It also tends to hide genuine overtime and absence patterns.

Fix: daily capture with an approval trail for exceptions, and lock the period at cut-off.

Mistake 4: leave balances that do not reconcile

If opening plus earned minus availed does not equal closing, the register has been edited outside the calculation logic — usually as a favour to someone.

Fix: run leave through a system with enforced arithmetic; log any manual adjustment with an approver and a reason.

Mistake 5: assuming the consultant has it

Many SMBs outsource payroll and assume registers are being maintained. Often the consultant maintains what they need to process payroll — not the statutory registers, and rarely in your custody.

Fix: ask explicitly which registers they maintain, in which format, and demand a monthly copy delivered into your repository. Custody matters. If it lives only on the consultant's laptop, you do not have it.

Mistake 6: no principal employer oversight of contractors

Engaging a manpower vendor and never checking their compliance is one of the most common exposures for growing companies.

Fix: monthly compliance packs as a condition of invoice release, with spot verification of a sample of workers.

Mistake 7: registers maintained but never archived

Data sitting live in a system is not the same as a preserved record. Systems get migrated, vendors get changed, and periods get recalculated.

Fix: archive an immutable PDF of each register monthly into the repository. If you switch HRMS vendors in three years, your historical registers still exist independently.

Mistake 8: sensitive records in general folders

POSH complaints, disciplinary files, and medical documents in a shared HR drive is a confidentiality failure waiting to happen.

Fix: separate restricted storage with named access and an access log.

Mistake 9: no documented retention policy

Without one, retention decisions are made by whoever is cleaning up storage, usually badly.

Fix: one retention schedule, reviewed by counsel, applied consistently, with legal hold procedures.

Mistake 10: registers that do not exist for locations you forgot about

A second office opened last year, or a small team registered under a different state's rules, often falls outside the main compliance process entirely.

Fix: annual applicability re-assessment triggered by any new location, new registration, or headcount threshold crossing.

Mistake 11: exit records left open

Full-and-final settlements processed without closing the employee register entry, the leave register, and the PF/ESI records leaves dangling records that surface awkwardly later.

Fix: an exit checklist that explicitly closes every register, with sign-off.

Mistake 12: no owner

The single most predictive factor for register quality is whether one named person is accountable. Shared responsibility means no responsibility.

Fix: name a compliance owner in writing, give them the calendar, and review it in a recurring meeting.

How an HRMS Automates Register Generation

The reason digital HR records outperform manual ones is not storage. It is that registers become derived outputs of data you already capture, rather than documents someone assembles.

The data flow that makes it work

1. Employee master data is captured once at onboarding, with validation on mandatory statutory fields.
2. Attendance flows in daily from check-in, biometric integration, or approved work logs.
3. Leave is applied for, approved, and deducted through enforced balance arithmetic.
4. Payroll consumes attendance and leave, applies the salary structure, computes statutory deductions, and produces the payroll register.
5. Statutory outputs — PF ECR files, ESI contribution files, PT workings, TDS computations — are generated from the same payroll run rather than rebuilt separately.
6. Registers are rendered from this dataset into the required format for any period and location on demand.

Because every register draws from one dataset, they are internally consistent by construction. The wage register cannot disagree with the payslips, because they are the same numbers rendered differently.

What good automation actually does

• Generates registers on demand for any month, quarter, or year, filtered by location or entity
• Locks periods after payroll closure so historical registers do not silently change
• Maintains audit trails of every change with user, timestamp, and prior value
• Flags exceptions before payroll — missing attendance, negative leave balances, employees without UAN, salary changes without approval
• Reconciles automatically between payroll liability, statutory file, and challan
• Archives immutably each month's register set to the repository
• Applies access controls so payroll and POSH records are visible only to the right roles
• Tracks retention and flags records approaching disposal dates
• Produces compliance packs as a bundled export for a client audit or inspection

The manual work that remains

Automation does not eliminate judgement. Someone still needs to:

• Confirm applicability of each register for each location
• Configure the correct state-specific formats
• Review the pre-payroll exception report and resolve genuine issues
• Handle contractor compliance verification, which involves external parties
• Manage POSH inquiries, which are inherently human processes
• Review the retention schedule and approve disposals
• Interface with authorities during inspections

Aim to automate the assembly and preserve human attention for the judgement calls. That is the correct division of labour.

Choosing a system: what to actually check

When evaluating an HRMS for record-keeping compliance, ask for demonstrations rather than feature lists:

• Show me the wage register for a past month, exported, with itemised deductions.
• Show me the audit log for a change made to a closed period.
• Show me how a state-specific register format is configured.
• Show me the reconciliation between the payroll register and the PF file.
• Show me the access control settings for POSH records.
• Show me how I export everything if I leave your platform.

That last question is the most revealing one. A vendor who cannot cleanly export your historical registers is holding your compliance records hostage.

A 30-60-90 Day Implementation Plan

This plan assumes an SMB with existing but disorganised records. Adjust for scale.

Days 1-30: assess and stabilise

Week 1 — Map applicability.

1. List every registered entity, every physical location, and headcount at each.
2. For each location, identify the applicable state shops and establishments rules and any sector-specific requirements.
3. List every registration you hold and check expiry dates.
4. Confirm PF, ESI, and PT applicability at each location.
5. Note whether contract labour is engaged anywhere.
6. Have this mapping reviewed once by counsel or a competent consultant. This single step prevents most downstream errors.

Week 2 — Inventory what exists.

1. For each register on the checklist, record whether it exists, for what periods, in what format, and who holds it.
2. Get written confirmation from any external payroll consultant about what they maintain and where.
3. Identify gaps: periods missing, formats non-compliant, registers not maintained at all.
4. Rank gaps by risk — wage, attendance, and statutory payment records first.

Week 3 — Fix the highest-risk gaps.

1. Rebuild or reformat the last twelve months of wage register from available payroll data.
2. Reconcile PF and ESI payments to payroll for the same period; document any differences.
3. Complete the employee master with any missing statutory fields.
4. Constitute or verify the POSH internal committee if it is absent or lapsed.

Week 4 — Build the repository skeleton.

1. Create the folder structure and naming convention.
2. Set access tiers and assign permissions.
3. Move existing documents into the structure. Do not attempt perfection; get the structure right and the current year populated.
4. Create the repository index page.

End-of-month deliverable: an applicability map, a gap register, a populated repository skeleton, and twelve months of reformatted wage records.

Days 31-60: systematise

Week 5 — Fix attendance at source.

1. Implement daily attendance capture appropriate to your workforce — app check-in for office and hybrid staff, biometric or app for site staff.
2. Define the exception workflow: who requests regularisation, who approves, what evidence is needed.
3. Set the monthly attendance lock date.

Week 6 — Automate register generation.

1. Configure the HRMS to produce employee register, muster roll, wage register, overtime register, and leave register in the formats your locations require.
2. Run a parallel month: generate registers from the system and compare against your manual version line by line.
3. Resolve every difference before going live. Differences are almost always data quality issues worth finding.

Week 7 — Reconcile and baseline leave.

1. Recompute leave balances from policy and joining dates.
2. Publish balances to employees and ask for written confirmation within a set window.
3. Freeze the confirmed baseline and run all future movement through the system.

Week 8 — Contractor compliance.

1. Define the monthly compliance pack contents.
2. Communicate the requirement to every vendor with a deadline and a template.
3. Link pack submission to invoice processing in your AP workflow.

End-of-month deliverable: system-generated registers matching manual records, a reconciled leave baseline, daily attendance in place, and a contractor pack process running.

Days 61-90: harden and prove

Week 9 — Write the retention schedule.

1. Draft the schedule covering every record type with periods, owners, and locations.
2. Have counsel review it once.
3. Define the legal hold procedure.
4. Publish it and add the annual review to the calendar.

Week 10 — Build the compliance calendar.

1. Load every recurring activity into a shared task system with owners and dates.
2. Set escalation rules for overdue items.
3. Schedule the monthly compliance standup.

Week 11 — Run an internal audit.

1. Sample three months and five employees per month.
2. Trace the full chain from appointment letter to bank payment for each.
3. Document findings and assign corrective actions with dates.

Week 12 — Prepare for inspection.

1. Complete the inspection-day readiness checklist and verify every line.
2. Write the inspection protocol and brief reception and office managers.
3. Do a dry run: ask someone to request twelve months of wage, attendance, and leave records for one location and time how long assembly takes. If it exceeds two hours, find the bottleneck and fix it.
4. Test a backup restore.

End-of-month deliverable: a documented retention schedule, a live compliance calendar, a completed internal audit with closed actions, and a verified inspection readiness position.

Beyond 90 days

Move into maintenance mode: monthly archival, quarterly access reviews and backup tests, half-yearly audits, annual applicability re-assessment and retention review. The heavy lifting is done in the first quarter; sustaining it costs a few hours a month.

Scaling Considerations

What works at 40 people needs adjustment at 400.

Multi-state operations

Each new state can bring different registers, different leave rules, different holiday lists, and different filing mechanics. Build state as a first-class dimension in your systems from the start — location on every employee record, location-wise register generation, and a state-wise applicability matrix in your compliance manual.

The failure mode here is a single national process applied uniformly, which quietly under-complies in some states and over-complies in others.

Multiple legal entities

Registers attach to registered establishments. If you operate through multiple entities, keep records strictly separated by entity even where teams work together. Shared services arrangements and cross-entity deputations need documentation.

Distributed and remote workforces

Employees working from home across several states raise questions about which establishment they attach to and which state's rules apply. The conservative approach is to attach each employee to a registered establishment, document that attachment, and maintain attendance and leave records accordingly.

Get advice on this if you have a materially distributed workforce; it is an area where practice is still settling.

Growth thresholds

Several obligations are triggered by headcount. As you grow, requirements that did not previously apply may begin to. Build a trigger review into your hiring process: when headcount at any location crosses a round number, re-run the applicability assessment.

Handling an HRMS migration

When you change systems, historical registers are at risk. Before migration:

1. Export every register for every period from the outgoing system as PDFs and as raw data.
2. Store them in the repository, clearly marked with the source system and export date.
3. Verify a sample against known correct values.
4. Only then decommission.

Never rely on the outgoing vendor retaining your data after the contract ends.

Frequently Asked Questions

Are electronic registers acceptable, or do we still need physical registers?

The direction of Indian labour law, particularly under the consolidated codes, is clearly toward permitting electronic maintenance of registers and electronic filing of returns. Many employers now maintain digital-first records.

That said, implementation and state-level rule-making vary, and some authorities may still expect signed or printed records to be produced during an inspection. The practical approach is to maintain records digitally, ensure you can generate authenticated printouts on demand, and confirm the position for each state where you operate with your labour department or counsel.

How long do we actually need to keep statutory registers?

Retention periods vary by statute, by state rules, and by record type — there is no single number that applies across the board. Some registers have preservation periods running from the date of the last entry; tax records align with assessment and reopening timelines; social security records often have practical relevance for far longer.

Build a written retention schedule that maps each record type to the applicable rule for your locations, verify the periods with counsel or your labour department, and when the guidance is ambiguous, retain longer rather than shorter. Never dispose of records connected to a live dispute or proceeding.

We outsource payroll. Are our statutory registers the consultant's responsibility?

The compliance obligation sits with the employer, regardless of who performs the processing. A consultant can maintain records on your behalf, but you remain accountable for their existence, accuracy, and availability.

Two practical steps: get a written schedule of exactly which registers the consultant maintains and in what format, and insist on a monthly copy delivered into your own repository. Records that exist only in a vendor's system are records you may not have when you need them.

What is the difference between a muster roll and an attendance register?

In practice the terms are often used interchangeably, and many modern combined formats merge them. Traditionally, a muster roll records daily presence and absence for each worker, while attendance records may extend to in and out times and hours worked.

What matters more than the label is the content: a per-employee, per-day record showing presence, absence, leave, weekly offs, holidays, and, where hours are relevant, actual working hours. If your record captures all of that, it will serve both purposes.

Do small startups with fewer than ten employees need statutory registers?

Applicability depends on the specific law and your state. Some obligations are triggered by headcount thresholds, and a very small establishment may fall outside certain requirements. Others, including registration under state shops and establishments legislation, commonly apply from the first employee.

Even where a formal register is not mandated, maintaining employee, attendance, wage, and leave records is strongly advisable. It costs almost nothing at small scale, and reconstructing early-stage records later — during diligence, or when the first dispute arises — is painful. Verify your specific position for your state.

How do we maintain attendance records for fully remote employees?

Create a positive daily record rather than assuming presence. Options include app-based check-in and check-out, system-recorded work logs, or a daily confirmation workflow. What you want to avoid is a record that simply marks everyone present by default with no underlying evidence.

Also document your remote work policy, including expected working hours, and record which registered establishment each remote employee is attached to. Where hours matter for overtime or statutory limits, capture actual hours rather than assumed ones.

What records does POSH compliance require, and who can access them?

Generally: the order constituting the internal committee with member details including the external member, evidence of awareness and training activity, a record of complaints received and their status, complete inquiry files, and an annual report.

Access must be tightly restricted. Confidentiality is a legal obligation, and complaint and inquiry records should be stored separately from general HR files with access limited to committee members and specifically authorised individuals. Do not route these documents through shared drives or group mailboxes.

As a principal employer, what contractor records do we need to hold?

At minimum: the contract itself, the contractor's registrations and licences where applicable, and a monthly compliance pack covering the workers deployed at your premises. A workable pack includes attendance, a wage register extract, evidence of wage payment through banking channels, PF and ESI challans with employee-wise breakup, and a signed compliance declaration.

Collect this monthly rather than annually, verify a sample rather than accepting declarations at face value, and make submission a precondition for invoice processing. Principal employer responsibility means gaps in your contractor's compliance can become your problem.

Bringing It Together

Statutory registers are not an administrative afterthought. They are the evidence base for every claim about how you employ people — what you paid, when they worked, what you deducted, and whether you followed a fair process.

The employers who handle this well are not the ones with the biggest compliance teams. They are the ones who captured attendance daily, generated registers from a single dataset, archived them monthly, wrote down a retention schedule, named an owner, and put every recurring obligation on a calendar. Those six habits handle most of the risk.

The move to electronic registers and digital HR records makes all of this dramatically easier than it was a decade ago. When employee master data, attendance, leave, and payroll live in one system, register generation stops being a monthly project and becomes an export. Inspection readiness stops being a fire drill and becomes a filtered search.

Start with the applicability map, because everything else depends on knowing which registers actually apply to you. Then fix attendance capture, because it feeds everything downstream. Then automate generation and archival. Then document retention and build the calendar. Ninety days of focused effort buys you years of not worrying about it — and remember to verify state-specific formats, thresholds, and retention periods with your labour department or counsel as you go.

If you would rather not assemble registers by hand every month, CozyHR generates statutory registers, payslips, and statutory filing outputs from your attendance and payroll data automatically, with audit trails, role-based access, and monthly archival built in. Try CozyHR and see how much of your record-keeping compliance can simply run in the background.