Statutory Registers & Returns: Employer Guide

Most Indian employers do not fail compliance because they underpaid someone or skipped a contribution. They fail because, when an inspector asks for proof, the paperwork is not there in the form the law expects. Statutory registers and returns are the evidence layer of HR compliance — the muster roll that proves who worked, the wage register that proves what they were paid, the returns that prove you told the authorities. Payroll can be perfect and still indefensible if the register behind it cannot be produced.

This is also the part of compliance that quietly rots. Payroll runs every month whether or not anyone is watching. A register only gets looked at when something goes wrong: an inspection, a due-diligence request, a contractor dispute, a customer's vendor audit. By then the gap is two years wide and the person who ran attendance has left.

This is a working manual on HR compliance documentation for HR managers, compliance officers, founders and payroll teams at Indian SMBs and mid-market companies. One caveat recurs throughout: register names, form numbers, formats, thresholds, filing frequencies and retention periods vary by state, by establishment type, and by which central and state rules are actually notified and in force for you. Everything here is directional — verify specifics against currently notified rules or with legal counsel.

Why Statutory Registers and Returns Are the Most-Failed Part of HR Compliance

Ask an HR team whether they are compliant and you usually get an answer about payments: PF remitted, ESI remitted, professional tax deducted, TDS filed, salaries out on the 30th. All true, all insufficient — because compliance in India is heavily documentary. The statute does not simply require that you pay correctly; it requires that you record it, in a prescribed or substantially equivalent format, produced on demand. Failing that obligation is a distinct exposure, independent of whether the payment was right. There are structural reasons employee records maintenance fails so consistently:

• Nobody's job. Payroll owns payment, HR owns people, Finance owns books. Registers sit in the seam, so they get done in a panic before an audit rather than continuously.
• Data lives in the wrong places. Attendance in a biometric device, wages in payroll, leave in a spreadsheet, documents in an unversioned drive. Nothing reconciles automatically.
• The formats are unfamiliar. A payroll summary is not a statutory wage register; it commonly omits days worked, wage rate, itemised deductions or date of payment.
• Reconstruction feels possible. Rebuilt registers look rebuilt — no contemporaneous acknowledgements, no version history — which undermines credibility exactly when it matters.
• Growth outpaces process. Four states means four sets of shops and establishments rules, four professional tax regimes, four holiday lists — and principal employers routinely treat contractor records as somebody else's problem when the obligations flow back to them.

The fix is not heroic effort before an audit. It is boring, continuous, automated generation of the same records every month, from the same data that runs payroll.

What Consolidation Under the Labour Codes Actually Changes

India's labour law framework has been consolidated from many separate central enactments into four codes covering wages, industrial relations, social security, and occupational safety, health and working conditions. The direction of travel matters more than any single provision.

Historically an establishment could maintain a dozen overlapping labour law registers in India — employment, wages, fines, deductions, advances and overtime under different laws, each with its own form, mostly capturing the same facts about the same people. The codes and the rules under them push toward fewer, broader, combined formats, combined returns, express recognition of digital record keeping, and self-certification for smaller establishments in several states. Two practical points follow.

Consolidation reduces the number of registers, not the amount of data. A combined register still needs every field the old ones needed. If attendance does not capture overtime separately, or payroll does not tag the reason for each deduction, you now have one incomplete document instead of four.

The transition is uneven. Commencement of provisions and notification of central and state rules have not moved in lockstep. Depending on your state and the date you may be under the older enactments, under code-based rules, or a mix. Build your calendar from what is notified and in force for your establishments, not from a blog post — including this one. The defensible posture during transition is to maintain the superset: capture every field either format requires, in a structure you can render into whichever layout is asked for. Data is hard to add retrospectively; layout is easy to change.

The Main Categories of Statutory Registers and Returns

Register names below are descriptive, not form citations. Confirm the prescribed forms applicable to you.

Muster roll and wage register

The muster roll is the most contested record in Indian labour disputes because everything downstream derives from it. Good attendance records are daily rather than monthly summaries; distinguish present, absent, weekly off, holiday, leave type and half-day; capture in/out times where overtime matters; are site-tagged; and become immutable at period close, with later corrections recorded as audit-trailed adjustments rather than silent edits. That last property separates a credible digital register from an editable spreadsheet.

A wage register must show the arithmetic, not just the answer. The most common defect is collapsing deductions into one "total deductions" figure — PF, ESI, PT, TDS, loan recovery and fines each need to be identifiable. The second is no link between register and payment: keep the bank advice reference against each wage period.

Overtime, leave, deductions and advances

• Overtime fails in two directions: hours worked but never recorded, or recorded but not paid at the correct rate. If you run shift, site or hourly staff, review it monthly.
• Leave records must show full movement per leave year, not just balances. Record your leave year definition, carry-forward and lapse rules.
• Fines, deductions and advances need the basis, not just the amount: what happened, was the employee heard, what was decided — plus a recovery schedule and balance that reconciles to full-and-final at exit.

Contractor records, POSH, safety and letters

For contract labour, maintain a contractor master with licence status and validity; deployment records; attendance and wage records for workers on your premises; contribution proofs; invoices showing wages and statutory components separately; and evidence that someone verified it.

For POSH, keep the IC constitution order with member names and terms, complaint files under strict access control, inquiry documentation, the annual report and training records. Where safety obligations apply, keep incident registers, notifications, committee minutes and welfare records — scrutinised after an incident, when reconstruction is not an option. For filings, keep the acknowledgement, not just the challan.

Appointment letters and wage slips are individually small and collectively enormous. Every employee needs a signed letter on file and a slip for every wage period. The failure mode is coverage, so make it a monitored metric with an exception list.

Form, Format and Electronic Maintenance

Does it have to be paper? No — digital record keeping under the labour codes is expressly contemplated, including electronic registers, wage slips and returns. Conditions vary: some rules address format, availability at the establishment, or producing a legible copy on demand. Confirm what applies before going paperless.

Must columns match the prescribed form? Where a form is prescribed, reproduce its structure; where combined formats are notified, use those; where unsure, keep the superset and render on demand. What you cannot do is drop a field because your business does not track it.

Are e-signatures valid? India's IT framework recognises electronic records and certain digital and electronic signatures, and much HR documentation is validly executed electronically. Evidentiary strength varies: a certificate-based digital signature beats click-to-accept, which beats a typed name. Match method to consequence — robust signing with a full audit trail for contracts, settlements and disciplinary outcomes; in-system acknowledgement for wage slips and policy acceptances. Keep the signing evidence with the document.

A PDF exported from a spreadsheet is technically an electronic record and practically weak evidence. Credibility comes from testable properties: provenance (generated from a system of record), immutability (closed periods cannot be silently edited), an audit trail (actor, timestamp, before/after, reason), versioning, completeness (no gaps in the period sequence) and enforced access control. With those, the format conversation becomes easy.

Who Owns What Internally

Ambiguous ownership is the root cause of most register gaps. Assign named people, not departments.

Two rules make this work: every area has exactly one accountable name, and the reviewer is never the owner.

Retention: How Long to Keep What

Retention is where organisations most often invent a number and hope. Different statutes and state variants specify different periods; others are silent, leaving limitation periods and evidentiary need as the guide. Build policy on four principles:

1. Longest applicable period wins where two rules overlap.
2. Where rules are silent, keep records long enough to survive the realistic window for a claim about wages, contributions, gratuity or termination.
3. Legal hold overrides everything. The moment a dispute or inquiry is live or anticipated, suspend deletion and document that you did.
4. Write it down, apply it consistently, log disposals. A documented policy applied consistently is defensible even if a period is later questioned. Ad-hoc deletion is not.

The table is a policy design template, not a statement of statutory periods; the middle column reflects conservative practice. Verify each line against the rules applicable to you.

Set retention in the system, not in a document nobody opens. Labour compliance pushes toward keeping more for longer; data protection pushes the other way. Resolve it by being specific about period and basis.

The Returns and Filings Calendar

Frequencies, due dates, applicability and form names vary by statute, state and establishment type, and they change. Use the table as a structure for your own calendar, confirming every line per establishment.

Building the calendar in seven steps

1. List every registered establishment — entity, state, address, registration numbers, headcount, activity. Without this you are guessing at applicability.
2. Determine applicability per establishment and record the reasoning, not just the conclusion. You will re-test it when headcount changes.
3. Extract every obligation into a line item, one per obligation per establishment per frequency. Register maintenance is a line item too, not just filings.
4. Assign a named owner and a reviewer to every line.
5. Set internal due dates ahead of statutory ones to absorb holidays, portal outages and approval delays.
6. Define the evidence artefact for each line. "Done" without an artefact is not done.
7. Review quarterly, refresh annually. A calendar built once creates false comfort.

Worked example: monthly close for a two-state SMB

All figures illustrative. A services company has 78 employees in one state, 34 in another, plus 12 contract workers from one vendor.

• Day 1–2: Attendance finalised at both sites; managers clear exceptions (illustratively, 23 missed punches and pending leave applications); attendance locked.
• Day 3: Muster roll generated from locked attendance. Overtime register shows 46 OT hours across 9 employees.
• Day 4–5: Payroll processed, wage register generated with itemised deductions, reconciled to the bank file. Illustrative variance: one employee's advance recovery of Rs 4,000 applied twice, corrected before payment.
• Day 6: Wage slips issued electronically; acknowledgement tracking starts, target 100% within seven days.
• Day 7–10: PF, ESI and PT remitted and filed for both states; TDS deposited; acknowledgements attached to calendar lines. Contractor pack received and verified against site gate data — illustratively, the vendor shows 11 workers and gate data shows 12, resolved before invoice release.
• Day 12–15: Registers locked with the lock event logged; dashboard reviewed by HR Head and Finance Controller, open items carried with owner and date.

That cycle takes a fraction of a role when data flows automatically, and about a week of someone's life when it does not.

Single-State vs Multi-State: What Actually Gets Harder

The multi-state trap is not complexity; it is asymmetric complexity. Companies build a strong process where the compliance person sits and a thin one everywhere else, and the satellite office with eleven people and no local owner is exactly where an inspection finds something. Two fixes: standardise the data model and localise only the output, and give every location a named local owner with a short monthly checklist.

Contractor, Gig and Non-Employee Documentation

The workforce most companies document worst is the one not on payroll.

• Contract labour. Obligations typically attach to both contractor and principal employer, and a contractor's default often flows back to you. Keep your own copies; if the relationship ends badly, the contractor's records leave with them. Compliance requests that compete with an accounts payable deadline lose; ones that are the deadline get met.
• Consultants. The risk is characterisation. If someone works fixed hours, under supervision, on company equipment, exclusively, for years, with leave approvals, the paperwork saying "consultant" may not survive scrutiny. Keep a genuine services agreement, invoices and evidence of the actual relationship, and review long-running arrangements — they drift even when contracts do not.
• Gig and platform workers. The social security framework contemplates these as a distinct category with aggregator-linked obligations, subject to notification. Get specific advice rather than assuming the category is unregulated.
• Interns, apprentices and trainees. Each has its own documentation expectations; the common failure is treating them as invisible until someone asks.

Minimum pack for any non-employee: a written agreement with scope, duration and consideration; attendance or deliverable records; payment records with correct deductions; POSH and confidentiality acknowledgements.

What an Inspector Typically Asks For

Practice varies by state, authority and trigger. As a general pattern, expect this sequence:

1. Identification and stated purpose — you may record the visit.
2. Establishment documents: registrations, licences, notices displayed, holiday list, working hours notice.
3. Headcount and employee register, often cross-checked against who is visible on the floor.
4. Attendance for a sample period, usually the current and preceding months, and the wage register for the same period cross-checked against it. This is the core test: did days worked produce the wages paid.
5. Wage slips — often asked of employees directly, not only of HR — plus contribution proofs, and overtime, leave and deduction registers where relevant.
6. Contractor documentation if contract workers are on site, and category-specific records: safety and accident registers, POSH constitution and annual report, welfare facilities.
7. Conversations with employees about hours, wages, payment mode and deductions, followed by observations recorded as a note or follow-up communication.

What damages inspection readiness fastest, roughly in order: records that cannot be produced at all; records that contradict each other (attendance says 24 days, wages paid for 22); records that look newly created; employees whose account differs from the register; contract workers with no documentation; and missing notices — small, visible and immediately noted.

The Inspection-Day Runbook

Write this down and make sure more than one person knows it — inspections do not schedule themselves around your compliance lead's leave.

Standing preparation: nominate a primary and backup responder per location; keep a "day one pack" ready (registrations, licences, three months of muster roll and wage register, latest filings, POSH IC order, holiday list).

On the day:

1. Receive professionally. Note name, designation, department and purpose; politely ask for identification. Tone matters more than people expect.
2. Notify immediately — compliance lead, HR head, and counsel per your policy. Do not wait until the visit ends.
3. Do not leave the officer unaccompanied. The responder stays throughout as a host, not an obstacle.
4. Log every request — document, period, time requested, what was provided. This becomes your record of the visit.
5. Provide what is asked, and only that. Do not volunteer extra periods, registers or entities.
6. Say "I will confirm" rather than guessing. A confident wrong answer is far worse than a documented follow-up.
7. Produce digitally, print if asked, and keep an identical copy.
8. Never create or backdate a record during a visit. If something does not exist, that is a gap to remedy properly. Fabrication turns a compliance issue into something far more serious.
9. Read anything before signing it. If a memo contains something you disagree with or cannot verify, say so before signing and record your position.
10. Debrief within 24 hours, convert observations into a tracked action plan with owners and dates, respond to written communications within the time given, and feed every gap back into the calendar as a permanent control.

Quarterly Self-Audit: An HR Audit Checklist for 2026

The point is to find gaps before an inspector does, while there is time to fix them properly.

1. Fix the scope — usually the preceding quarter, every establishment, including contract workers.
2. Sample rather than test everything. Cover full-timers, probationers, shift workers, recent joiners and exits. Oversample joiners and exits; errors concentrate there.
3. Trace each sampled person end to end: appointment letter on file → employee master complete → attendance for every day → total matches wage register days → components match the letter → deductions itemised and within limits → net matches the bank record → wage slip issued → contributions filed. Any break is a finding.
4. Test the registers as artefacts, not just the data. Can you generate each one for the period, in a defensible format, with no missing periods?
5. Test the calendar and the controls — every filing line done on time with an acknowledgement, plus stale access after exits and records held past retention.
6. Score, report, remediate with owners and dates, and re-test failed items specifically next quarter.

Inspection-readiness scorecard

Score each line 0 (absent), 1 (partial or inconsistent), 2 (complete and defensible). Maximum 30.

A working guide, not a standard: 26–30 is strong; 20–25 has a sound core with weak points to fix this quarter; 12–19 is material exposure, so prioritise attendance, wage register, contractor documentation and filings; below 12 is a project, not a task. Track the trend — it tells you more than the number.

Common Mistakes

• Treating payroll output as the wage register. Check the columns against what your rules require.
• Monthly attendance summaries with no daily record. "22 days present" is a conclusion, not a register.
• Editable spreadsheets as the system of record, and reconstructing registers before an audit — visible, damaging, and one short step from backdating.
• Ignoring exits. Final attendance, encashment, F&F statement, advance recovery, access revocation. Exits generate a disproportionate share of disputes.
• Forgetting the second, third and fourth state, and assuming contractor compliance is the contractor's problem.
• No named owner. "HR handles it" means nobody handles it.
• Copying another company's retention policy, or keeping everything in one open shared drive with POSH complaints and medical records visible to the whole HR team.
• Never re-testing applicability after growth, and keeping challans but not acknowledgements. Payment is not filing.

When a Self-Audit Finds a Gap

Finding gaps is the point; handling them badly turns a compliance issue into a credibility issue.

1. Do not backdate anything — not a form, a signature or an entry. Whatever the gap costs, fabrication costs more.
2. Establish the facts first, then size the exposure: how many people, which periods, which establishments, what amount.
3. Classify it: documentation-only (substance right, record missing), substantive (something was wrong), or systemic (the process guarantees recurrence).
4. Take advice on material items, especially where corrective filing or voluntary disclosure may be available.
5. Remediate as of today, clearly labelled as a corrective action with today's date and the reason.
6. Document the remediation honestly. A file recording date identified, cause, scope, action, completion and approver evidences a working control environment. Regulators and acquirers distinguish organisations that find and fix their own problems from those that never look.
7. Fix the cause, then re-test that specific item next quarter.

Worked example (illustrative). A quarterly audit at a 60-person company finds wage slips were generated but never issued to 14 employees at a branch for one month, because the coordinator was on leave and the task had no backup owner. Payment was correct, contributions were filed, the register reconciles. Handling: classify as documentation-only; issue the slips today with a covering note; log the finding with cause, scope and approver; automate issuance on payroll close; name a backup owner for every branch task; add coverage to the monthly dashboard with a 48-hour alert; verify it next quarter. Total effort, a few hours — against considerably more, from a worse position, if an inspector finds it two years later.

Automation and HRMS Integration

All of this is achievable manually, but almost nobody sustains it beyond about 50 people across more than one location, because manual register maintenance competes every month with work that feels more urgent. What automation should do:

• One source of truth — attendance, leave, wages and employee master connected, so registers come from live data rather than assembled exports.
• Automatic register generation on period close, with period locking and audit trails so corrections are recorded as adjustments carrying actor, timestamp, before/after and reason.
• Versioned document storage with signing evidence attached, and a compliance calendar with alerts covering internal and statutory due dates, evidence upload and escalation.
• Retention automation with clocks that start on the right event, legal-hold override and a disposal log.
• Role-based access scoped by location and sensitivity, exportable audit trails, and coverage dashboards that surface exceptions instead of making you search for them.

Before you buy, ask: does attendance flow into payroll automatically? Are registers generated from the same data payroll used? Can it produce state-specific formats? Is there a real edit audit trail or just a "last modified" field? And can you export everything if you leave — records outlive vendor relationships.

Data Privacy and Access Control for Employee Records

Employee records are personal data, and much of an HR file — health information, disciplinary matters, POSH complaints, background checks, bank and identity details — is sensitive by any standard. India's data protection framework raises the bar on collection, storage, security, retention and breach handling; obligations depend on notification, so take specific advice. Regardless, these controls are defensible:

• Collect only what you need. Every field you hold is one you must protect, justify and eventually dispose of.
• Scope access by role and location. A manager sees their team's attendance and leave, not compensation history or medical records.
• Ring-fence sensitive categories — POSH files, investigations, medical records and verification reports need narrower access, often two or three named people.
• Log access, not just changes, and review access quarterly, revoking on exit or transfer the same day. Stale access is the most common finding in any access audit.
• Encrypt at rest and in transit, restrict bulk exports, and keep a breach response plan with named owners.
• Publish an employee privacy notice, and hold payroll processors and verification agencies to the same standard by contract.

Keeping everything forever is not a safe default; it is an expanding liability.

FAQ

Can we keep all our statutory registers and returns digitally, with no paper?

Broadly yes — electronic maintenance is expressly contemplated under the codes and rules framed under them. Conditions vary by state and rule: some address format, availability at the establishment, or producing a legible copy on demand. Confirm what applies to you and keep the ability to print on request. What matters more than the medium is whether the record comes from a system of record, is immutable once closed, and carries an audit trail.

How long do we actually have to keep employee records?

There is no single answer. Different statutes and state variants prescribe different periods, some measured from the date of the last entry; others are silent, leaving limitation periods and evidentiary need as the guide. Write a policy on the longest-applicable-period principle, be conservative for long-tail records such as contributions, gratuity and service records, suspend disposal when a dispute is anticipated, and log every disposal.

Who should own statutory registers internally?

Split by data source and name individuals. HR Operations owns the employee master, attendance and leave. Payroll owns the wage register, overtime, deductions, advances and bonus. Compliance owns the calendar, contractor documentation, registrations and retention. Every area needs a reviewer who is not the owner. Small companies can collapse the roles, but preserve independent review for at least the wage register, contractor documentation and filings.

What if a self-audit finds we have been missing a register for two years?

Do not backdate. Establish the facts, size the exposure, and classify the gap. If the substance was correct and only the record is missing, generate the register from source data now, clearly dated as a corrective action with the reason recorded. If something substantive was wrong — underpayment, unfiled contributions — take legal advice first, since corrective filing routes may apply. Then fix the cause and document the remediation; a well-documented self-correction evidences a working control environment.

How much responsibility do we carry for our contractors' records?

More than most principal employers assume. Depending on applicability, obligations frequently flow back to the principal employer when a contractor defaults, and an inspection at your premises will look at contract workers on your floor. Keep your own copies of licences, deployment records, attendance and wage records and contribution proofs; make the monthly pack a condition of invoice release; verify it rather than filing it unread.

Do employees have a right to see their own records?

Employees have a clear entitlement to certain documents — wage slips being the obvious example — and data protection principles generally support individual rights over personal data, subject to how the framework applies to you. Beyond that, a self-service portal showing attendance, leave balances, wage slips and tax documents is good practice: it reduces queries and catches errors early, because people notice mistakes about themselves faster than HR does.

What is the single highest-return thing to fix first?

The attendance-to-wage-register chain. Capture daily attendance for every employee at every location, lock it at period close, generate the wage register from that locked data, and reconcile it to your bank file monthly. That chain is what an inspector tests first, what most disputes turn on, and what every other register depends on. Once it is automatic, everything else becomes incremental work rather than a rebuild.

Conclusion

Statutory registers and returns are not overhead beside the real work of HR. They are the record of whether the real work was done correctly. An organisation that pays people properly but cannot prove it is, in the only forum that matters, indistinguishable from one that did not.

The shape of the solution is well understood. Know which establishments you have and what applies to each. Capture data at the right granularity, especially attendance. Generate registers automatically on a fixed monthly rhythm and lock them. Keep a calendar with named owners and evidence for every line. Enforce retention in the system, control access to sensitive records, audit yourself quarterly, and fix causes rather than symptoms. Never backdate anything. And do the verification no article can do for you: formats, thresholds, frequencies and retention periods vary by state and establishment type, so confirm specifics against currently notified rules or with qualified counsel, and re-confirm annually.

If maintaining all of this by hand keeps slipping to next month, CozyHR is built to take it off your plate — registers generated automatically from live attendance and payroll data, versioned document storage, retention reminders, role-based access and exportable audit trails. Start a free trial and see what last quarter's registers look like when they build themselves.