HR audit checklist: reviewing your HR function properly

An HR audit is a structured review of whether your people practices match three things: the law, your own written policies, and reality. Companies run them before funding rounds and acquisitions, after rapid growth, or simply annually as hygiene. The checklist below is jurisdiction-neutral and practical — it finds the gaps that actually bite. This is informational, not legal advice; a local professional should confirm the legal specifics for your country.

Records and contracts

• Every current employee has a signed contract on file — and every contract amendment (role, pay, hours) is documented, not just remembered.
• The employee list in your HR system matches payroll and matches who actually works here. Three lists that agree is the audit’s first pass/fail.
• Employment events — promotions, transfers, terminations — have effective dates and supporting documents.
• Former employees’ records are retained per a written schedule, and access to them is restricted.

Policies and acknowledgments

• The core policies exist in writing: hours, leave, conduct, safety, data handling, grievance route.
• Every employee has acknowledged them — in writing, findable per person. A policy without acknowledgments protects no one.
• Policies describe what the company actually does. A policy contradicted by daily practice is worse in a dispute than no policy.

Processes: hiring, onboarding, discipline, exit

• Hiring follows a consistent, documented process — same screening, structured interviews, verification of finalists — and rejected candidates’ data is handled per privacy rules.
• Onboarding is a checklist with evidence: policy acknowledgments, completed training, 90-day review on file.
• Disciplinary actions follow the written procedure, with each step documented at the time it happened.
• Departures produce complete files: resignation or termination documents, access revoked on the end date, exit interview recorded, final settlement documented.

Training, pay, and running the audit itself

Check mandatory-training currency (every required certificate valid today, expiries tracked), and pay documentation (every salary change has an approval trail; like roles have explicable pay differences). Then run the audit properly: sample rather than boil the ocean — pull ten employee files at random and score them against this list; the sample’s gaps are the population’s gaps. Record findings, assign owners and dates, and re-audit the failed sections in ninety days. An audit without a follow-up date is a document, not a control.

Structured systems make most of this checklist automatic: in EmployDB, contracts and acknowledgments live in the employee file, events carry dates and documents, and the audit trail already exists — so the audit becomes reading filtered views instead of reconstructing history from folders.