HR audit checklist for India: statutory, policy and data

An HR audit is a structured review of whether a company's people practices meet the law, follow its own policies and are backed by records. In India, a complete HR audit checks five areas: statutory compliance (registrations, returns, Labour Code registers, POSH, maternity, gratuity, bonus, minimum wages, contract labour), HR policies, employee records, payroll controls and data protection under the DPDP Act. Each check should name the evidence the auditor will look at, not just ask "are we compliant?".

This checklist is the broad audit framing. For the monthly payroll filing routine, see our payroll compliance checklist, and for vendor-supplied workers, contract labour compliance for principal employers.

The legal backdrop for an audit in 2026

The four Labour Codes (the Code on Wages, the Industrial Relations Code, the Code on Social Security and the OSH Code) have been in force since 21 November 2025. They subsume most of the older central labour laws, including the Minimum Wages, Payment of Wages, Payment of Bonus, EPF, ESI, Payment of Gratuity, Maternity Benefit and Contract Labour Acts. State rules are being notified progressively, and older state rules continue where they are not inconsistent with the Codes. That matters for an audit because register formats, returns and some thresholds depend on the state rules that apply to each location. Check the current position with the Ministry of Labour and Employment and each state's labour department.

How should you scope an HR audit?

Decide three things before the first document request.

• Entities and locations. Every legal entity and every state you operate in, because PT, LWF, Shops and Establishments and minimum wages differ by state.
• Period. Usually the last completed financial year plus the current year to date.
• Depth. Full population checks for high-risk items (PF and ESI deposits, minimum wages), and samples for the rest, for example 25 personnel files or 10% of exits.

Checklist 1: registrations and licences

Check	Evidence to check	Risk
EPF establishment code for each entity	Coverage letter, portal login, establishment details	High
ESI employer code where applicable	Registration certificate, branch codes for other locations	High
Professional tax registration in every PT state	Registration and enrolment certificates, by state	Medium
Labour welfare fund registration where applicable	State board registration	Medium
TAN and correct deductor details	TAN allotment, TRACES profile	High
Shops and Establishments or factory registration per location	Certificates, renewal status, headcount declared	Medium
Contract labour registration and contractor licences where the OSH Code thresholds apply	Registration, contractor licence copies	High

See Shops and Establishments Act registration and labour welfare fund state-wise for location-level detail.

Checklist 2: statutory payments and returns

Check	Evidence to check	Risk
PF ECR filed and paid by the 15th for every month	ECR files, challans with TRRN, payment receipts	High
PF on the correct wage base, including the 50% wages test	Salary structure, sample wage calculations	High
PF wage ceiling of ₹25,000 applied from 17 September 2026	Payroll configuration and September and October 2026 ECRs	High
ESI contributions on gross wages up to ₹21,000, at 0.75% and 3.25%	Contribution files, contribution-period handling for crossers	High
PT deducted at the right state slab and deposited	PT challans and returns by state	Medium
LWF deducted and deposited in the right periods	LWF challans	Low
TDS deposited by the 7th; quarterly Form 24Q (Form 138) filed	Challans, return acknowledgements, TRACES default report	High
Form 16 (Form 130) issued by 15 June	Distribution log	Medium
Statutory bonus paid within 8 months of year-end to eligible employees	Bonus computation, payment proof, registers	Medium
Gratuity paid within 30 days of becoming payable	Exit register, payment dates	High

Checklist 3: Labour Code registers, notices and committees

Check	Evidence to check	Risk
Registers of employees, wages, attendance and deductions, in the format the applicable rules prescribe	Registers (often electronic) for a sample of months	Medium
Wage slips issued to every employee	Payslips for a sample month	Medium
Wages paid before the 7th of the following month	Bank transfer dates	High
Final wages paid within 2 working days of separation	Exit dates against F&F payment dates	High
Minimum wages met for every category, including revised variable DA	Current state notifications against the lowest-paid employees	High
Equal pay for the same or similar work, irrespective of gender	Pay by role and gender	Medium
Overtime paid at twice the ordinary rate where due	Overtime register, payroll	Medium
Standing orders certified where the IR Code threshold (300 or more workers) applies	Certified standing orders, or adoption of model standing orders	Medium
Grievance redressal committee where there are 20 or more workers	Constitution, meeting minutes	Low
Annual returns and notices under the applicable rules	Acknowledgements, displayed notices	Medium

Because register formats and annual returns depend on the state rules, record which rules you audited against. For background, see minimum wages in India and wage payment deadlines and deductions.

Checklist 4: POSH, maternity and other employee protections

Check	Evidence to check	Risk
Internal Committee at every office or unit with 10 or more employees	IC constitution order, presiding officer is a senior woman, external member, at least half women	High
IC annual report to the employer and the District Officer	Report and submission proof	Medium
POSH policy, display of consequences and IC details	Policy, posters at each location, intranet	Medium
Awareness sessions and IC member training	Attendance records	Medium
Complaints closed within statutory timelines	Complaint register (restricted access)	High
Maternity benefit of 26 weeks for up to two children, with eligibility applied correctly	Leave records, payroll for women on maternity leave	High
Creche facility or arrangement where 50 or more employees	Arrangement or agreement	Medium
Written intimation of maternity benefits at appointment	Appointment letters or onboarding acknowledgement	Low
Gratuity eligibility, including fixed-term employees after one year under the Code on Social Security	Exit sample, gratuity computations	High
Nominations for PF and gratuity on file	Nomination forms or e-nomination status	Low

See POSH Act compliance, the Maternity Benefit Act for employers and gratuity in India. Use the gratuity calculator for sample recalculations.

Checklist 5: policies

Check	Evidence to check
Employee handbook current and acknowledged	Handbook version, acknowledgement records
Leave policy consistent with state Shops and Establishments minimums	Policy against each state's entitlement
Attendance, overtime and comp off policy	Policy, and whether attendance data matches it
Code of conduct, disciplinary procedure and whistleblower policy	Policies and case records
Expense, travel and loan policies	Policies and a sample of claims and loans
Exit and notice period policy	Policy against sample exits
Policies reviewed in the last 12 months	Version history

A policy that exists but is not followed is often worse in an inspection than no policy, because it shows the company knew the standard.

Checklist 6: employee records and documentation

Check	Evidence to check
Offer and appointment letters for every employee	Sample of personnel files
Identity, address and education proofs; background verification where your policy requires it	Sample files, verification reports
Statutory details: UAN, ESI number, PAN, bank account	Master data completeness report
Probation, confirmation and promotion letters	Sample, matched to payroll changes
Effective-dated history of salary, grade and manager changes	System history against letters
Exit documents: resignation acceptance, clearance, F&F, relieving letter	Sample of exits
Retention of records for the period the law requires	Retention schedule, oldest records available

Checklist 7: payroll controls

Check	Evidence to check
Separation of duties between computing, approving and paying	Role assignments, approval logs
Every salary change backed by an approved document	Sample of changes against letters
Joiners and leavers reconciled to payroll each month	Headcount reconciliation
Payroll register reconciled to bank and the general ledger	Monthly reconciliation
Investment declarations and proofs verified before allowing deductions	Sample of old-regime employees
Access to salary data limited by role	User access review

See our payroll reconciliation guide.

Checklist 8: data protection

The DPDP Act, 2023 applies to employee and candidate personal data. Under the DPDP Rules, 2025, the substantive obligations (notice, consent, security safeguards, breach notification and data principal rights) apply from 13 May 2027. An audit now is a readiness check.

Check	Evidence to check
Inventory of the personal data HR holds, and why	Data map
Privacy notice to employees and candidates	Notice, acknowledgement
Role-based access to sensitive fields (salary, bank, health)	Access review
Retention and deletion rules for ex-employees and rejected candidates	Retention schedule, deletion logs
Breach response plan	Plan and contact list
Vendor contracts covering personal data	Agreements with payroll, verification and insurance vendors

See the DPDP Act for HR teams.

How often should you run an HR audit?

Cadence	Scope	Who
Monthly	Statutory deposits, payroll exceptions, joiner and leaver reconciliation	Payroll and HR operations
Quarterly	TDS returns, minimum wage revisions, contract labour verification, POSH complaint status	HR compliance lead
Annually	Full audit of all eight checklists	Internal audit or an external firm
Event-based	Before a funding round, acquisition, new state or new entity	External firm

How do you score an HR audit?

Score each check 2 (compliant, with evidence), 1 (partly compliant or evidence incomplete) or 0 (not compliant). Weight by risk: high 3, medium 2, low 1. The section score is the weighted total divided by the maximum possible.

Worked example

A company audits Checklist 2 (statutory payments), which has 10 checks: 6 high-risk, 3 medium-risk and 1 low-risk.

Risk	Checks	Weight	Maximum	Actual score	Weighted actual
High	6	3	6 × 2 × 3 = 36	5 at 2, 1 at 1 = 11	33
Medium	3	2	3 × 2 × 2 = 12	2 at 2, 1 at 0 = 4	8
Low	1	1	1 × 2 × 1 = 2	1 at 2 = 2	2
Total	10		50		43

The section scores 43 ÷ 50 = 86%. On a common rating scale (90% and above green, 75% to 89% amber, below 75% red) that is amber, though any high-risk item at 0 should make the section red regardless of the percentage. Put a ₹ value on each gap where you can: for example, PF short-paid on ₹2,40,000 of wages a month for six months is ₹2,40,000 × 12% × 6 = ₹1,72,800 of employee-share arrears alone, with a matching employer share, plus interest and damages.

Common mistakes

• Auditing only head office, when PT, LWF, minimum wages and registrations differ by state.
• Asking "do we comply?" instead of collecting evidence.
• Treating the old central Acts as the current law without checking the Labour Codes and state rules.
• Leaving POSH as a policy on the intranet with no functioning Internal Committee.
• Ignoring contractor workers, who can create principal employer liability.
• Producing findings with no owner or deadline, so the same gaps appear next year.

FAQs

What is an HR audit? A structured review of HR compliance, policies, records and controls, with evidence, to find gaps before an inspector, auditor or acquirer does.

Is an HR audit mandatory in India? There is no general law requiring one. Statutory inspections, financial audits and due diligence make a regular internal HR audit sensible.

Who should conduct an HR audit? Monthly and quarterly checks can be internal. An annual audit is often done by internal audit or an external firm for independence.

What documents are needed for an HR audit? Registrations, challans and returns, registers, payslips, personnel files, policies, POSH records, contractor records and system access reports.

How long does an HR audit take? For a 500 to 2,000 employee company, a full annual audit typically takes several weeks, depending on how many states and entities are covered and how easily evidence can be retrieved.

What is the difference between an HR audit and a payroll audit? A payroll audit checks pay, deductions and statutory deposits. An HR audit covers those plus policies, records, employee protections and data protection.

How NeevHR helps

NeevHR compliance keeps an obligation register of every PF, ESI, PT, LWF and TDS filing with due dates, status and late-charge estimates, and a filing calendar of what is due, filed and overdue. Payroll runs compute, verify, approve and publish as separate steps with an exception report, and employee records keep every change on an effective-dated timeline. Documents tracks expiry and policy acknowledgements, and reports let auditors drill from a chart to the underlying records. To see the audit trail, book a demo.

This article provides general information for educational purposes. Statutory rules, thresholds, rates and filing requirements may change; verify with the relevant authority or a qualified professional. Last reviewed: 17 Oct 2026.