HR Audit

What an HR audit is

An HR audit (تدقيق الموارد البشرية), also written human resources audit, is a structured examination that an organisation carries out on its own HR function. It compares the records, policies, procedures and practices in place with a standard set before the examination begins, and it ends with written findings and recommendations, each with an owner and a deadline. The definition is our own wording and not a quotation from any particular source, since the practice goes by several names in the literature. Bieliaieva’s 2019 article, for instance, puts “HR audit”, “staff audit” and “personnel audit” side by side in its title.

An HR audit is a management practice that an organisation sets for itself. It is not an accounting review of the books, it is not an inspection carried out by a government body from outside the organisation, and it is not an appraisal of an individual employee’s performance. Nor is it a claim that carrying out an audit improves any particular result.

Which sources did we check?

We checked the bibliographic details of seven works in Crossref. The records confirm that the works exist. They do not confirm what the works contain:

• Wheeler. The chapter “HUMAN RESOURCES AUDIT” in the book “Human Resource Development”, Elsevier, 1994, pages 31 to 41.
• Olalla and Castillo. The article “Human resources audit” in International Advances in Economic Research, volume 8, issue 1, 2002, pages 58 to 64.
• Sauser and Sims. The chapter “Human Resources Management Audit” in the book “Legal and Regulatory Issues in Human Resources Management”, Emerald, 2014, pages 27 to 49.
• Balz. The chapter “Human Resources Governance and Compliance: Human Resources Audit and Investigations” in “Handbook of Human Resources Management”, Springer, 2016, pages 1137 to 1152.
• Garg. The article “HR Audit: A Contemporary Issue” in Journal of Advances and Scholarly Researches in Allied Education, volume 15, issue 6, 2018, pages 18 to 23.
• Bieliaieva. The article “International practice of the concepts use of ‘HR audit’, ‘staff audit’, ‘personnel audit'” in Economics. Ecology. Socium, volume 3, issue 3, 2019, pages 94 to 101.
• Rashid, Sirajuddin and Ali Shah. The article “Human Resource (HR) Audit: Compliance of Labor Laws and HR Effectiveness in Pakistan” in Jinnah Business and Economics Research Journal, 2022, pages 34 to 56.

We did not read the text of any of the seven works. We drew on their titles alone for two points: that the practice goes by more than one name, and that at least one work links the audit to compliance with labour laws in a particular country, Pakistan. We attribute no finding and no figure to any of them. The steps of the audit and the limits of the practice are our own formulation, not drawn from these works.

How does an HR audit differ from related concepts?

• Skills audit. It takes stock of employees’ skills and verifies them with evidence, so its subject is the abilities of individuals. An HR audit, by contrast, examines the records, procedures and policies of the function. The detail of taking stock of skills and the evidence behind them is covered under Skills Audit.
• HR analytics. It uses employee data to answer management questions with numbers. It analyses data that already exist, whereas an audit asks a prior question: are the records themselves complete, and is the procedure followed as written? The four levels at which employee data are analysed are set out in HR Analytics.
• Compliance dashboard. It is a consolidated view of where an organisation stands against its regulatory obligations at a single moment. It displays the state of those obligations, whereas an audit is a piece of work with a scope, a start date and an end date. For what a usable dashboard line carries, see Compliance Dashboard.
• Employee file. It is the organised set of documents and data that an organisation keeps on each worker. Employee files may be material that an audit examines, not a substitute for the audit. The contents of an employee record and the way it is kept are the subject of our explanation of Employee File.

A hypothetical example: auditing a sample of 20 employee files

Take a hypothetical organisation with 80 employee files, whose audit team decided to examine a sample of 20, which is 20 ÷ 80 = 25% of the files. The team drew up its own checklist of 5 items that each file should contain: a signed contract, a valid copy of the identity document, a job description, a leave balance record and an emergency contact. That makes 20 × 5 = 100 checks.

The team recorded the results item by item:

• Signed contract: present in 18 of 20 files, or 90%, with 2 missing.
• Valid copy of the identity document: present in 16 files, or 80%, with 4 missing.
• Job description: present in 11 files, or 55%, with 9 missing.
• Leave balance record: present in 17 files, or 85%, with 3 missing.
• Emergency contact: present in 9 files, or 45%, with 11 missing.

Items present total 18 + 16 + 11 + 17 + 9 = 71 of 100, or 71%, and items missing total 2 + 4 + 9 + 3 + 11 = 29, or 29%, so the two percentages add up to 100%. Just two items, the job description and the emergency contact, account for 9 + 11 = 20 of the 29 gaps, or about 69%. All five items were present in 6 of the 20 files, or 30%. That leaves 14 incomplete files carrying 29 gaps between them, an average of 29 ÷ 14 = 2.07, or about 2.1 gaps per file.

The team then wrote each finding in three parts: the condition (the emergency contact is missing from 11 of 20 files), the criterion (the checklist the team drew up) and the required action (the person responsible for the files completes the missing contacts within a month, and the same sample is examined again once that work is finished). Findings were ranked from the largest gap to the smallest, starting with the emergency contact at a gap rate of 55% and then the job description at 45%.

Checking took 15 minutes a file, so 20 × 15 = 300 minutes, which is 5 hours, or 2.5 hours each if two reviewers share the work. All the figures are hypothetical and chosen for illustration, and they represent no organisation and no study.

The 71% describes the sample alone. It carries over to all 80 files only if the sample was chosen in a way that represents them, and 20 files give no more than a rough indication, for which we calculate no margin of error. The checklist measures whether a document is present, not its quality: a signed contract may be out of date or missing clauses and still be counted as present. The results also describe the files as they stood on the day of the examination and say nothing about what came after it.

How is an HR audit carried out in practice?

The sequence of steps is ours and not taken from any particular work:

• Defining the scope. One part of the function, such as recruitment, files or leave, rather than the whole function at once.
• Setting the standard before the examination. It is a written policy of the organisation, a term in a contract, or a statutory provision whose interpretation is referred to a specialist. An examination without a declared standard comes down to an impression.
• Choosing the sample and recording how it was chosen. The record lets the reader of the findings know what the figures represent.
• Collecting evidence. A document, a record in a system, or an observation of a procedure being carried out, and not an oral statement alone. The auditor sees files that hold their owners’ personal data. For the privacy side of an auditor’s access to personal files, the relevant concept is Employee Data Privacy.
• Writing up each finding. The condition, the criterion and the difference between them.
• Ranking the findings and naming an owner and a deadline for each.
• Examining again. A second examination takes place on a declared date, because an audit that nobody follows up is no more than a report.

Who carries out the audit?

An audit can be carried out under one of three arrangements: by the HR team itself, by an internal audit or compliance unit where one exists, or by an outside party such as a consultant. The division into three is ours and does not come from a source. In our view, a team that examines its own work is easier to organise but less independent, while a party further from the daily work is better placed to see what the people doing that work have grown used to, though it needs time to understand the organisation. An organisation is free to choose according to its size and the purpose of the examination.

How can the practice be misused?

• Turning the audit into a hunt for a culprit. It examines the record and the procedure, in our definition, and not the person. In our view, turning it into a search for someone to blame pushes people to hide gaps.
• Settling for a single figure. The 71% on its own does not say which item is missing, who owns it or when it will be completed.
• Leaving findings without an owner or a deadline. A finding that nobody owns stays in the report.
• Auditing once and then forgetting. Without a second examination, there is no way of knowing whether anything has changed.

What is the role of HR in an HR audit?

HR can be both the subject of the audit and a party to it. In that position it defines the scope together with the auditors, prepares the records to be examined, and takes charge of following up the findings that fall within its own work. A judgement that a given procedure matches a statutory provision is a matter for a legal specialist, and it is not drawn from the definition of the practice. Where the HR team audits itself, it is better to record that fact in the report, so that its reader knows the level of independence.

What does the evidence on HR audits allow us to say?

We do not claim that an HR audit raises compliance or improves HR effectiveness, nor that an organisation that carries one out makes fewer mistakes than others. We have not read the text of any of the seven works recorded in Crossref, and in the sources we reviewed we found no Saudi study on the practice in Saudi organisations that we could rely on, so we attribute no effect and no figure to any source. The title of the Pakistani work shows that researchers studied compliance and effectiveness in a particular setting, but we do not know what they found.

We think it is better to regard the practice as a structured pause for comparing what exists with a declared standard, and to judge it by what is visible in the organisation itself: whether the findings that were given an owner were completed, and whether the same gap appeared when the examination was repeated. What is decided after that depends on the size of the organisation and the nature of its work.

This is an explanation of the concept, not legal advice.