An internal audit is cheaper than an inspection, and it is the only way to find gaps while they are still fixable. It is also the thing everyone agrees to do and nobody schedules.
For a company under a hundred people this is a half-day exercise, twice a year. Here is a version that fits that.
Step 1: Decide what you are auditing
Auditing “compliance” produces a vague result. Pick the areas where failure actually costs money, and for an Indian SME that is a short list.
- Statutory filings: PF, ESI, professional tax, TDS
- Registrations: Shops and Establishments, PF and ESI codes, and whether they are current in every state you employ in
- Employment documentation: signed contracts, policy acknowledgements, personnel files
- POSH: committee constituted, policy published, annual return filed
- Employee data: what you hold, who can see it, how long you keep it
Everything else can wait for the next round.
Step 2: Decide who does it
In a small company this is two people: whoever runs HR or payroll, and someone independent enough to ask why. Finance usually works.
The reason for the second person is not suspicion. It is that the person who built the process cannot see the gap in it. They will read the checklist and confirm what they already believe.
Step 3: Build a checklist that names your states
This is where generic templates fail. Professional tax, minimum wages and Shops and Establishments rules follow where the employee works, not where you are registered. A checklist that does not name each state will pass a company that is filing in only one of four.
Some specifics worth putting on the list:
- Are wages paid by the 7th of the following month? Under the Code on Wages, 2019 the concession letting large employers pay by the 10th has been removed.
- Do total deductions stay under 50% of wages in any period?
- Is final settlement issued within two working days of an exit?
- Is minimum wage checked against the current notification for each state?
- Are there workers treated as consultants who function as employees? This is the most common PF exposure in Indian companies.
Step 4: Pull the evidence, not the assurances
The audit is only worth something if you look at documents. Challans with acknowledgement numbers, the actual signed contracts rather than the template, the POSH committee order with names and dates.
Sample rather than review everything. Ten personnel files chosen at random will tell you whether the process works. Reviewing all ninety will tell you the same thing three days later.
Step 5: Separate what is broken from what is missing
Two different problems with two different fixes. A filing that was late is a process problem. A policy you never had is a gap.
Rank by exposure, not by effort. An unfiled PF challan accrues damages every month. A missing equal opportunity policy is a genuine obligation under section 21 of the Rights of Persons with Disabilities Act, 2016, applying at any size with no threshold, and it takes an afternoon to fix.
Step 6: Assign each fix to a person and a date
An audit that ends in a report changes nothing. Each finding needs a name, a date and a way to confirm it was done.
Then diarise the next audit before you close this one. The single biggest predictor of whether a company stays compliant is whether the second audit ever happens.
A lot of HR checklists ask whether you comply with GDPR or CCPA. For an Indian employer those are the wrong reference. GDPR protects EU residents and CCPA protects Californians. Unless you process their data, neither is what you are measured against.
Your statute is the Digital Personal Data Protection Act, 2023. The audit question is simpler than the GDPR version: for each category of employee data you hold, what is it, why do you have it, who can open it, and when do you delete it. Most companies fail on the last one, because ex-employee files sit on a shared drive indefinitely.
If running this twice a year is not realistic, our compliance service includes the audit and the filings across every state you employ in. Send us your headcount and locations.
Every registration, monthly filing and annual return for Indian employers - in one place.
Get it free →