Introduction

In todays competitive climate, companies must operate within the confines of a heavily-regulated employee environment. This includes dealing with a myriad of complex laws and regulations, including ERISA, COBRA, EEOC, OSHA, ADA, FMLA, FLWA/FLSA, Title VII, exempt and nonexempt compensation, unemployment, age discrimination, sexual harassment, immigration reform and control, right to privacy and workers compensation, just to name a few. Other HR responsibilities and functions, such as employee documentation, workplace violence, stress management, substance abuse, corporate policy, interviewing and hiring, organizational development, job descriptions, problem resolution, performance evaluation, discipline, termination, interim/contingency staffing, training programs, team building, payroll management and a burgeoning number of employee benefit administration issues, are also equally important. Given the fact that many HR departments are both understaffed and overworked, it is only in retrospect that many companies learn the monetary costs of ignoring these hot HR legal buttons. Noncompliance problems can be, and frequently are, the basis for significant financial risk. To minimize these risks, many organizations purchase employment practices liability insurance. While this is a sound strategy, there are other proactive measures that companies can take as a preemptive strike against these types of problemsand chief among these measures is undertaking a voluntary HR compliance audit. These types of audits are a vital part of a comprehensive strategy to help a company avoid legal liability. Though time-consuming, such audits help protect companies by identifying those areas of concern that need immediate attention before an employee files a lawsuit or governmental regulators come knocking at the companys door. HR audits can also identify gaps in practices that can be addressed to help a company achieve and maintain world-class competitiveness in key HR practice areas.

HR Audit Defined
What exactly is an HR audit? It really is a matter of taking the time out of busy schedules to take an intensely objective look at the companys HR policies and practices. The objective review of the companys current state can help evaluate whether or not specific practice areas are adequate, legal and/or effective. The results obtained from this focused and intense review can provide decision makers with the information necessary to decide what policies or practices need to be revised and/or improved. An HR compliance audit generally consists of two main parts: 1. An evaluation of the companys operational HR policies, practices and processes, with a focus on key HR department delivery areas (e.g., recruiting and selection, employee retention, compensation, employee benefits, performance management, employee relations, training and development, etc.).

2. A review of current HR indicators (e.g., number of unfilled positions, number of days to fill a new position, turnover, employee satisfaction, internal grievances filed, number of legal complaints, absenteeism rates, etc.). An audit is usually conducted by using a questionnaire that asks for the evaluation of specific practice areas. This document helps guide the audit team in scrutinizing all critical areas of a companys HR practices. The audit may also include interview of selected HR employees and other departmental managers in order to calculate if certain policies and procedures are understood, practiced and accepted successfully.

The HR Audit Process: A Model

The general process of conducting an audit includes the following key steps: 1. Determine the Scope of the Audit In order to uncover the needed information, it is important to determine exactly what areas should be targeted for this review. If the organization has never audited its HR function or if there have been significant organizational or legal changes in recent months, the audit team may want to conduct a comprehensive review of all HR practice areas. Conversely, if there simply are concerns about the adequacy of a specific process or policy, the audit focus should be limited to a review of that particular area. 2. Develop the Audit Questionnaire When conducting a comprehensive function audit, it is important to spend the upfront time to develop a comprehensive document that identifies the key areas served by the HR department (e.g., recruiting, selection, compensation, benefits, training and development, performance management, etc.). The same is true if the audit of a specific practice area is conducted. A list of specific questions must be developed to ensure that the questionnaire is comprehensive. Spending the necessary time to identify the areas that need to be explored will ensure that the audit results in collecting as much information as possible. 3. Collect the Data The next phase includes the actual process of reviewing specific areas to collect the data about the company and its HR practices. Audit team members will use the audit questionnaire as a roadmap to review the specific areas identified within the scope of the audit review. 4. Benchmark the Findings In order to fully assess the results of the audit findings, they must be compared with HR benchmark standards. This comparison will offer insight into how the audits results compare against other similarly-sized firms, national standards and/or the internal company data. Typical information that might be internally benchmarked includes the companys ratio of total employees to HR professionals, ratio of dollars spent on HR function relative to total sales, general and administrative costs, cost per new employee hired, etc. National standard benchmarking might include the number of days to fill a position, average cost of annual employee benefits, absenteeism rates, etc. 5. Provide Feedback About the Results Summarize the data and provide feedback to the companys HR professionals and senior management team in order to highlight the findings and recommendations of the audit team.

6. Create Action Plans It is critical to actually do something with the information that is identified as a result of the audit review. The company must create action plans for implementing the changes suggested by the audit, with the findings separated by order of importance: high, medium and low. 7. Foster a Climate of Continuous Improvement At the conclusion of the audit, it is important to engage in constant observation and continuous improvement of the companys policies, procedures and practices so that the organization never ceases to keep improving. This will ensure that the company achieves and retains its competitive advantage. Some have referred to an HR audit as listening outside the box. Whatever the definition, an HR audit really boils down to identifying problems and finding solutions in an attempt to address problems before they become unmanageable. It is an opportunity to assess what an organization is doing right, as well as how things might be done differently, more efficiently or with reduced costs.

Rationale for Conducting an HR Audit

The changing nature of HR management demands that HR professionals participate and contribute fully to their companies as true strategic business partners. Conducting regular HR audits can help HR practitioners achieve this goal. When planned and conducted effectively, an HR audit should help department managers to:

Keep the HR departments mission and goals in sync with the organizations needs and long-term business strategy. Ensure legal compliance (which should decrease settlement expenses and legal fees). Identify and prioritize opportunities for improvement, as well as areas of potential future risk. Improve efficiency and productivity so that the department can better serve employees and customers. Identify root problem areas and fix them before they become more widespread. Find cost reduction opportunities. Improve employee communications and morale and help establish better credibility and perceptions of top management. Implement and stay current with world-class practices by comparing results with other businesses. Measure and improve performance across the organization. Measure results from key projects or initiatives. Provide a reality check in order to identify and correct any gaps between what is intended and what is actually being delivered. Increase the commitment of professionals within the HR department to seek change and focus on continuous improvement in all aspects of their work.

The HR audit will help the HR department understand whether or not its HR practices are helping, hindering or having little impact on the business goals of the organization and the department. It also helps quantify and measure the results of the departments initiatives and

provide a roadmap that will help prioritize future actions and changes that need to be made. Audits can also help the organization achieve and maintain world-class HR practices. But the bottom line is this: conducting regular HR compliance audits will help the company avoid potential legal liability and its related costs, time and distraction to management and the organization.

Most Likely Problem Areas

Most lawsuits can be traced to four distinct stages of the employment relationship: 1. Hiring (e.g., job descriptions, application forms, employment contracts, references). 2. Employee evaluation (e.g., performance appraisals and promotions). 3. Employee discipline (e.g., rule infractions, evidence, poor performance). 4. Termination (e.g., comparison with other similar situations, proper warnings, adherence to the complaint procedures, etc.). As a result, it is important to audit these areas of the business on a regular and systematic basis to see if the programs and procedures are working. Besides these four stages of the employment relationship that are most likely to create conflict, there are some additional areas where companies seem to be the most vulnerable to making a mistake. These include: Misclassification of exempt and nonexempt jobs Almost every company has job positions that have been misclassified as exempt from overtime requirements. Due to the complexity of wage and hour laws and regulations (and new Part 541 regulations which have caused an uproar in the business community), it is not difficult to characterize a job as exempt, thereby exposing the company to liability for past overtime. Inadequate personnel files A review of sample personnel files often reveals inadequate documentation of performance. For example, disciplinary warnings are frequently informal, vague and/or inconsistent. Personnel evaluations are indefinite, inaccurate or outdated. Medical information is often found in personnel files, despite laws requiring that such data be kept separate. Accurate and detailed records are essential for employers to defend any type of claim brought by an employee, particularly unemployment compensation or wrongful discharge claims. Prohibited absentee policies Controlling excessive absenteeism is a big concern for most employers. However, the complexity of family and medical leave laws, with sometimes conflicting state and federal protections, has made many formerly acceptable absentee control policies unacceptable. Absences impact workers compensation, family and medical leave, disability and pregnancy laws. Companies often have policies that either do not comply with relevant laws and regulations or grant employees more protections than the laws require.

Inaccurate time records Many employers allow employees to fill out time sheets that indicate they have worked a certain number of hours each week. Most employee records would reflect a full week of work; however, such entries are rarely completely accurate since employees often leave early or come in late. If an issue was to arise about whether or not an employee had worked more time than reflected on the time sheet, the Department of Labor would likely discount the time sheets and give credence to the employees account of the hours actually worked. Insufficient documentation Reviews of employer hiring practices often uncover inadequate documentation, such as missing or incomplete I-9 Forms. Employers can be fined between $100 and $1,000 for each failure to accurately complete an I-9 Form. Fines for these violations can easily add up, with reported cases of repayment totaling over $100,000. Auditing these areas will allow the company to identify weaknesses or vulnerabilities in its systems and help identify issues that need to be updatedeither to comply with new laws and regulations or simply to be more comprehensive. HR practitioners should consider keeping a log of issues that have arisen but are not covered in the companys procedures or policies. This will provide an insight into areas of potential exposure that can be addressed during the annual review process (if the issues do not need to be addressed immediately, depending on their significance).

Determining the Type and Scope of the Audit

It is important to strategically assess what type of information is being sought in the audit before deciding which type of audit will best suit the companys needs. For a simple big picture overview of a certain issue, a climate assessment like the one in Appendix I may be appropriate. However, if the goal is to obtain very detailed and specific information, the company must select the type of audit that will yield the needed information. There are a number of types of audits available for use, and each type is designed to accomplish different objectives. Examples of some of the more common forms include: Compliance These types of audits are focused on how well the company is complying with current federal, state and local laws and regulations (e.g., ADA, COBRA, IRCA, FMLA, etc.). Best Practices These types of audits help the organization maintain or improve a competitive advantage by comparing its practices with those of companies that have been identified as having exceptional practices (e.g., hiring and termination processes, performance evaluation, sexual harassment policies, compensation practices, training and development of employees, benefit programs, etc.). Strategic These types of audits focus on strengths and weaknesses of systems and processes to determine whether or not they are in line with the strategic plan of the HR department and/or the company as a whole (e.g., diversity, employee turnover, length of time to fill an open position, number of employee complaints to assess the employee relations climate, communication with employees, etc.)..

Function-Specific These audits focus on a specific area in the HR function (e.g., wage and hour administration, immigration, affirmative action, payroll, benefits, recordkeeping practices, etc.). Clearly, a full-scale legal compliance audit is going to cover a great deal of territory and will take longer to complete than a best practices audit where only one specific practice is being compared with another companys approach or a function-specific audit where only one key area of the companys HR practices is reviewed.

What to Expect
A compliance audit is not a one-day project. It is a time-consuming and intensely focused review of a companys HR policies and practices, and it generally touches all areas of HR. It may require the review of numerous documents and policies, as well as interviewing HR staff, selected employees and managers from other areas of the company. The amount of time involved and the effort required will depend on the size and type of the company, the type of information the company hopes to glean from the audit, the scope of the audit and the number of people included on the audit team.

When to Audit
Given that a full-scale audit can be very time-consuming, most companies will not want to go through this process more than once a year; however, mini-audits that allow for some course correction can be completed without too much departmental pain approximately every six months. Companies that have the most success with audits tend to schedule annual checkups to maintain the discipline of a regular review rather than fall prey to only occasional or panic audits (e.g., those that take place only when a potential problem is brewing). In addition to the regular annual review, any time one of the following events occurs, it would be an opportune time to undertake a review:

There are significant organizational changes (e.g., merger, acquisition, sale of business, additions or departures of key senior management, etc.). Major regulations or legal changes are announced. A business reaches 15 employees, 20 employees, 50 employees and 100 employees (these are the threshold employee numbers where various regulations and laws become applicable). A business grows to the point of supervisors making hiring, discipline, promotion, demotion, transfer or termination decisions without direct supervision of the HR department. An employee handbook is created or modified. A company opens new facilities in another state or country. A new personnel manager is hired.

Employee morale, high turnover, attendance or excessive discipline problems become key issues. A company becomes a government contractor or subcontractor.

What to Audit
Once the appropriate type and scope of the audit is determined, the audit will generally begin with a review of written personnel policies, procedures, handbooks, retained records and any documents related to prior interactions with regulatory agencies or the courts with regard to HRrelated issues. The list of laws and regulations that impact the HR function is long. Though not intended to be all-inclusive, some of the key laws that should be included in an audit review include:

Fair Labor Standards Act (FLSA), including minimum wage, overtime and child labor laws. Occupational Health and Safety Act (OSHA). National Labor Relations Act (NLRA). Consolidated Omnibus Budget Reconciliation Act (COBRA). Health Insurance Portability and Accountability Act of 1996 (HIPPA). Employee Retirement Income Security Act (ERISA). Americans with Disabilities Act (ADA). Age Discrimination in Employment Act (ADEA). Title VII of the Civil Rights Act (prohibits discrimination on the basis of race, color, sex, religion or national origin). Equal Pay Act (EPA). Pregnancy Discrimination Act (PDA). Family and Medical Leave Act (FMLA). Immigration Reform and Control Act (IRCA). Executive Order 11246 and the Rehabilitation Act of 1973. Worker Readjustment and Retraining Notification Act (WARN). Workers compensation laws. State antidiscrimination laws. Recordkeeping, posting and reporting requirements. Fair Credit Reporting Act (FCRA). Employee Polygraph Protection Act. Drug-Free Workplace Act. State laws on workplace safety, violence and the employment relationship.

Any full-scope HR audit should include an examination of a wide scope of practices, plans, procedures and policies. Though not intended to be all-inclusive, most reviews include an examination of the following areas of HR practice:

Recruiting and employment. New employee orientation. Employee communications.

Employee manual. HR policies and procedures. Employee surveys. Exit interviews. Employee files and recordkeeping. Legal compliance. Job descriptions. Salary and wage administration. Compensation policies and procedures. Employee development. Performance appraisals. Training programs. Discipline and work rules. Termination procedures. Employee benefit programs and administration. Reward and recognition programs.

For a more comprehensive overview of the key areas which are generally included in a fullscope compliance audit, please see Appendix II for additional information.

Who Should Conduct the Audit

The companys HR professionals can perform the audit in-house if they have the expertise, the extra time, a willingness to objectively acknowledge inadequacies in current procedures and, most importantly, the clout to make the necessary organizational changes. However, if the audit is conducted with internal resources or even with an outside consultant who is a non-lawyer, everything connected with the audit is subject to discovery in litigation relating to employment practices. Even if a company uses its outside employment law firm to conduct the audit, the facts of the audit and the actions taken as a result of the audit are subject to discovery and will not be protected. However, the attorney-client privilege will likely protect the communications that occur between the company and its attorney by shielding the legal analysis, recommendations and conclusions provided by the attorney. Although it is not a requirement to retain a lawyer to conduct your HR audit, the company should consider doing so. A key reason for this suggestion is due to the fact that reliance on an attorneys expertise can reduce a companys future potential damages. For example, in wage and hour litigation, to avoid double damages, employers must prove that they had a good faith and reasonable belief that they were in compliance with the law. In order to meet this requirement, a company has to have consulted with someone who is reasonably knowledgeable. While a wellinformed HR practitioner can often meet this requirement admirably, the laws have become very complex and the case law changes frequently. As a result, it is often difficult for a typically understaffed and overworked in-house HR professional to stay completely current, despite his or her best efforts to do so.

There is, however, a possible downside to using legal counsel for these types of projects. If the same counsel ordinarily defends the business in employment litigation, the companys own lawyer may be a fact witness if the audit becomes evidence in the case. Because of this possibility, an audit should be performed with full recognition that its results (and, under some circumstances, information accumulated during the audit) may be discoverable and admissible as evidence in a future case against the company. However, there are valid and legitimate reasons to accept this risk and regularly conduct these types of audits in an effort to do the right thing as soon as possible.

Audit Feedback
At the conclusion of the review, findings are typically reduced to a written report with recommendations that are prioritized based on the risk level assigned to each item (e.g., high, medium and low). From this final analysis, a roadmap for action can be developed that will help determine the order in which to address the issues raised in the audit review. It is critically important to share the results of the audit with employees in the HR department as well as the senior management team. Communicating openly and honestly with the staff will help demystify the audit process and, hopefully, put them at ease. Department audits can create a lot of anxiety and stress for employees who oftentimes secretly fear that the results will be used to eliminate positions or be a cause for disciplinary actions. The discussions about the results will also provide an opportunity to do some intradepartmental training that can be beneficial to everyone involved. Many companies use their annual retreat to focus on what the department does well and areas where it can improve. The audit findings and recommendations can be the backbone of this type of continuous improvement attitude and discussion. For the management team, discussing the highlights of the HR audit findings will help them understand developing trends and problems. It may also help bolster HRs case for additional funds or staffing since the audit results should help them more clearly see the rationale for such requests. To the extent that significant changes need to be made as a result of the audit findings, the management should be encouraged to make the required decisions quickly. The changes must also be announced to the employeesdoing so will confirm that the company takes people-related issues seriously.

Follow-Up and Tracking Systems

Similar to the audit procedures, it is important to continually monitor other HR systems to ensure that they are up-to-date. It is also necessary to have follow-up mechanisms built into every one of them. HR practitioners may consider designating someone on their staff (or an outside consultant) to monitor legal developments so that HR policies and practices are kept current.

Likewise, it is important to keep track of the audit findings, hotline issues, employee survey results, and results of grievances filed and resolved in order to identify trends in the companys employment-related issues. Identifying problematic issues, growth areas or declining problem spots can help in the decision of where to allocate time, money and preventive training resources. This will allow the company to more strategically work on reducing employee problems in the future.

Costs of an Audit
The actual cost of an HR audit depends on the scope of the review as well as the number of people interviewed and the size of the audit team. As a result, it is not possible to easily quantify the expense as it will vary greatly by company depending on its goals for the review and its approach. Suffice it to say, though, that the cost of conducting a full-scale HR compliance audit will be far less than defending (let alone losing) even one lawsuit. Some insurance carriers even provide audits as a part of their compliance programs, so it could actually be free. The HR department can prepare for the cost of conducting periodic HR audits by including this key action item in the annual department budget along with other risk-management expenses.

Safeguarding the Audit Results

If a company has legitimate concerns about what its HR audit may reveal regarding the companys noncompliance with various employment laws and regulations, then the company should follow fairly strict audit procedures and protocols. In doing so, the company may be able safeguard the audit results through the application of at least one of the three legal privileges against disclosure. These include: 1. The Attorney-Client Privilege In general, this privilege protects the confidential exchange of information between the company and its attorneys made during an internal HR audit. The purpose of this privilege is to encourage open and honest discussions to ensure that the law is upheld. The following four very specific prerequisites must be met for the attorney-client privilege to apply: (1) the holder of the privilege is or sought to become a client of the attorney; (2) the communication relates to a fact of which the attorney was informed by his client, without the presence of strangers and for the purpose of securing either an opinion about the law, legal services or the lawyers assistance in some legal proceeding; (3) the communication to the attorney was not for the purpose of committing a crime or tort; and (4) the privilege has been claimed and not waived by the client. This privilege is triggered only by the companys request of the attorney for legal advice, not general business advice. 2. Attorney Work-Product Privilege Most courts protect the discovery of information or documents prepared by counsel (or at counsels direction) in the anticipation of litigation or for trial, unless there is a showing that protection of that information will result in significant hardship to the party seeking it. This privilege will absolutely protect from disclosure the mental impressions, conclusions, opinions or legal theories of an attorney or other representative of a

party concerning the litigation; however, the work-product documents from the audit itself may contain underlying facts that may be discoverable upon a showing of substantial need and undue hardship. For this privilege to apply, the internal audit or investigation must have been undertaken in anticipation of litigation. 3. Self-Evaluative Privilege This privilege may protect documents and evaluations created during an internal audit that is undertaken for the purpose of self-analysis and improvement. This privilege protects only those portions of the evidence that are evaluative and critical, not the underlying facts. This privilege is not officially recognized or enforced in many jurisdictions, and the trend in the case law seems to be away from recognizing it at all, so it is of limited use. It is recommended that practitioners who may be considering the commencement of an HR audit refer to an excellent SHRM Legal Report titled Legal Privileges Against Compelled Disclosure: Safeguarding the Results of HR Compliance Audits (October 2003) for additional suggestions and a more comprehensive discussion of the issues related to protecting audit results.

Conclusions
HR practices can make a significant difference in a companys business results. It is critical for HR practitioners to ensure that we continue to improve the delivery of our services and make sure that our actions are closely linked with the success of the company. We can achieve these objectives by conducting periodic reviews of our HR practices in order to maintain compliance with changing laws and to ensure that we have world-class policies and practices to attract and retain the highest-quality and most talented employees possible. Conducting periodic HR audits is a time-consuming but important part of protecting any company from legal liability. Planning, executing and then regularly auditing are the key steps that will help make the HR department a vital and integral contributor to the companys overall success. To stay both current and competitive with the best of the best, HR practitioners must continually review the companys practices against the changing legal and regulatory landscape, as well as against the best practices of other companies. If the company elects not to allocate the resources necessary to conduct these types of reviews, it is highly likely that some disgruntled employee (or a competitor) will eventually make it paymaybe with nothing more complicated than an anonymous phone call to a friendly regulator.