HR Audit Preparation Checklist for Growing Organisations

An HR audit tests whether people processes, records and controls match approved policy, employment terms and current requirements. Preparation should improve the underlying evidence, not manufacture documents for an auditor.

Define scope and criteria

Identify entities, locations, workforce, period and topics: employee records, wages, social security, attendance, leave, contractors, safety, recruitment, POSH, data protection or exits. Map applicable central, state and sector requirements with qualified advice.

Create an evidence index

List the requirement, control, owner, system, sample and evidence location. Use current policies, approvals, registers, filings, payment records, committee records, training, contracts and reconciliations. Restrict sensitive files.

Reconcile populations

Compare HR master data, payroll, attendance, benefits, access and contractor lists. Investigate active employees missing from payroll, exited workers with access, duplicate IDs and mismatched locations.

Test operation, not document existence

A leave policy may exist while managers approve through uncontrolled messages. Sample transactions from request to payroll. Check dates, approval, calculation, system entry and correction.

Review statutory calendars

Confirm current filings, payments, registers, licences, committees and notices for the covered establishment. The 2025–26 Labour Code transition requires checking the current Ministry Codes, rules and notifications before applying an audit criterion; do not reuse a pre-transition checklist without review.

Manage findings

Classify by impact and cause, identify immediate containment, owner and due date. Separate missing evidence from actual non-compliance. Do not close a finding merely because a new policy was drafted.

Example sample

For ten joiners, compare appointment documentation, identity data, payroll inclusion, statutory onboarding, access and first-month payslip. One end-to-end sample reveals gaps hidden by separate departmental checklists.

Audit-day control

Name a coordinator, log requests and provide controlled copies. Do not send full personnel files when a limited extract answers the request.

This is general preparation guidance. Audit scope and legal requirements must be verified for the organisation’s current establishments and workforce.

Interview control owners

Ask the person who performs the control to demonstrate it. A payroll reviewer should show the variance and sign-off, not only a procedure. Compare what happens during leave or peak workload.

Sampling strategy

Include normal cases, exceptions, joiners, exits, transfers and high-risk changes. Random sampling supports coverage; targeted sampling tests known risk. Record why the sample was selected.

Root cause and remediation

A missing approval may reflect training, unclear authority, system design or deliberate bypass. Fix the cause, retest transactions and preserve evidence. Assign a senior owner when several functions contribute.

Readiness questions

• Can each reported population be reconciled?
• Are current legal sources identified?
• Do system permissions match roles?
• Are overdue findings visible?
• Can employees correct material record errors?

Use a pre-audit review early enough to repair operations. Backdating evidence or creating retrospective approvals is not remediation.