An HR audit is a structured review of your HR function, its policies, records, processes, and compliance posture, run to find risk and gaps before they become expensive. A working HR audit checklist walks ten areas, from hiring and I-9s through offboarding and data privacy, and a good one ends not in a binder but in a ranked list of what to fix first. This guide gives you the checklist by area, the six-step process, the 2026 compliance items that changed, and a faster way to turn the findings into a benchmarked score.
What an HR audit actually checks
Think of an HR audit the way a mechanic thinks of an inspection: a systematic pass over every part of the HR function to catch problems while they are still cheap. Audits usually come in three shapes. A compliance audit checks whether you meet federal and state law, the highest-stakes version, since the fines and lawsuits live here. A best-practices audit compares how you run HR against what strong companies do, so you catch things that are legal but weak. And a function-by-function audit walks each area in turn, which is the most thorough and the format most checklists follow. Most teams run some blend of the three once a year.
The HR audit checklist, by area
Below is the core of a function-by-function HR audit. Work each area, note whether it is in place, missing, or out of date, and flag anything that looks like legal exposure for a closer look.
| Area | What to review |
|---|---|
| Recruiting and hiring | Job descriptions, application forms, interview practices, background-check consent, offer letters, and whether any AI hiring tools have bias-audit documentation. |
| Onboarding and I-9s | I-9 completion within three business days, a separate I-9 file (not the personnel file), E-Verify records if used, and a consistent onboarding process. |
| Employee records | Personnel files, medical files stored separately, retention schedules, and who has access. Confirm nothing that should be confidential sits in the general file. |
| Policies and handbook | An up-to-date handbook, signed acknowledgments, at-will language, anti-harassment and leave policies, and required federal and state postings. |
| Wage and hour | Exempt vs non-exempt classifications, overtime, minimum wage by location, meal and rest breaks, and independent-contractor tests. |
| Benefits | Eligibility rules applied consistently, ACA reporting if applicable, COBRA notices, and accurate plan documents. |
| Performance and pay | A documented review process, pay ranges, pay-equity checks, and whether pay transparency rules in your states are met. |
| Training and development | Required compliance training (harassment, safety), records of completion, and a plan for closing skills gaps. |
| Offboarding | A consistent termination process, final-pay timing rules by state, exit interviews, and access removal. |
| Data privacy | How employee data is collected, stored, and secured, and whether state privacy laws that now cover employee data apply to you. |
The checklist tells you what to look at. It does not tell you which gap matters most, which is why the last section of this guide is about scoring rather than ticking boxes.
What changed for 2026
The compliance surface has moved faster than most handbooks. Pay transparency laws now cover more than a dozen states, and several require posting salary ranges in job ads, so an old template can put you out of compliance the day you publish a role. Rules on the use of AI in hiring have arrived in places like Colorado and New York City, which in some cases require a bias audit and candidate notice. Paid-leave mandates keep expanding, and worker-classification enforcement has tightened. If your last audit predates 2025, treat the compliance section as needing a full re-review, not a skim. Keeping up with shifting federal and state requirements is a job in itself, which is why some teams lean on a system that tracks their compliance obligations rather than a spreadsheet that ages out.
The six-step HR audit process
A checklist is the what. This is the how.
- 1. Define the scope. Decide whether this is a full audit or a focused pass on one risky area. A first audit should be comprehensive; later ones can target what changed.
- 2. Get buy-in. Tell leadership what you are doing and why. An audit surfaces problems, and you want the finding treated as a fix list, not a blame list.
- 3. Decide who runs it. Internal HR knows the context; an outside auditor brings objectivity and legal depth. Many companies do internal reviews yearly and bring in a specialist when the exposure is real.
- 4. Gather the data. Pull files, policies, postings, and process documentation, and survey the people who actually run each area. Records tell you what is written down; people tell you what actually happens.
- 5. Analyze and rank. Sort findings by risk and effort. A missing I-9 is not the same size problem as a stale training log, and your plan should say so.
- 6. Act and document. Fix the top gaps, write down what you changed, and set a date to re-check. An audit with no follow-through is just anxiety on paper.
Common findings
Across most first audits, the same handful of issues show up: I-9s stored in the personnel file instead of separately, an employee handbook that is two or three years stale, misclassified contractors or exempt employees, missing or outdated required postings, and inconsistent documentation of performance and discipline. None of these are exotic. They accumulate because HR is busy and nobody owns the periodic review, which is exactly the gap a regular audit closes. Inconsistent performance documentation in particular tends to trace back to a weak feedback process, so it is worth reading how 360 degree feedback is meant to work before you rebuild that part of the file. The same drift shows up outside HR, which is why many leadership teams pair the audit with a wider business health check once a year rather than reviewing one function in isolation.
Turn the checklist into a score
A checklist gives you a pile of yes-and-no answers. What leadership actually needs is a prioritized read: which parts of the HR function are weak, how weak, and compared to what. That is the difference between an audit that sits in a drawer and one that drives a budget conversation. A scored assessment answers those questions by rating each area on a consistent scale and, better still, benchmarking it against your industry, so "our onboarding feels slow" becomes "process maturity is 14 points below your peers."
Assessmentcloud runs the diagnostic half of an HR audit and scores it across the areas it can measure: culture and engagement, the maturity of your people processes, skills gaps, and compliance readiness, each 0 to 100 against the industry median, combined into one number with the gaps ranked. One honest boundary: it is a diagnostic self-assessment, not a certified legal audit. It does not inspect your I-9 folder or confirm you meet a specific statute, which is still a job for an employment attorney when the exposure is real. What it does is tell you where the function is weakest so you can point a deeper audit at the right place. See the HR audit self-assessment to score your own function, and the compliance readiness assessment for the compliance dimension in depth. The compliance readiness checklist covers the regulatory side item by item.
Frequently asked questions
What is an HR audit?
An HR audit is a structured review of a company's HR function, its policies, processes, records, compliance, and people practices, done to find risk and improvement opportunities before they become expensive. It can focus on legal compliance, on best practices, or on a function-by-function walk from hiring to offboarding. The goal is to replace "we think HR is fine" with evidence of where it is strong, where it is exposed, and what to fix first.
What should an HR audit checklist include?
A complete HR audit checklist covers recruiting and hiring, onboarding and I-9s, employee records, the handbook and required postings, wage and hour and classification, benefits administration, performance and pay equity, training, offboarding, and data privacy. In 2026 it should also cover pay transparency compliance and any rules on AI in hiring that apply in your states. The checklist defines what to review; scoring the results tells you which gaps are urgent.
How often should you conduct an HR audit?
Run a full HR audit once a year, plus a focused check whenever something significant changes: a merger, rapid headcount growth, expanding into a new state, or a major regulation taking effect. Annual cadence catches drift before it compounds, and a scored self-assessment makes it cheap to repeat, because you can re-run it in a week and watch the number move instead of commissioning a new engagement each time.
Can you do an HR audit in-house?
Yes, for the diagnostic half. An internal team using a structured checklist and a scored self-assessment can find where the HR function is weak and how far it sits from industry norms, which is enough to prioritize. Bring in outside help for a formal legal compliance audit, since confirming you meet a specific federal or state statute is a job for an employment attorney or specialist. A benchmarked baseline makes that engagement cheaper because you arrive knowing where to point it.
RUN IT, NOT JUST READ IT
Score this dimension for your company
The interactive sample readout on the homepage shows exactly what you get: scored dimensions, industry benchmarks, and a prioritized action plan. Flat pricing from $49 a month.