Auditing Your HR Department

Evaluate your practices and policies by getting an independent review.

By Eric Krell
September 1, 2011

Like most taxpaying citizens, human resource professionals often recoil at the "A" word—"audit."

"You can get really stressed about the fact that the auditor is visiting you," says Beverly A. Widger, SPHR, senior vice president,
human resources, at Claremont Savings Bank in New Hampshire.

Having gone through an HR audit two years ago designed to scrutinize current practices, review compliance capabilities and
identify process improvement opportunities, however, Widger views the process di erently today. "It's actually very helpful,"
she says. For example, the auditor, who works for an external rm with speci c HR and payroll expertise, showed Widger how
to con rm that the bank's outsourced payroll provider was submitting federal tax payments as required by law. "As nerve-wracking as an audit might
be, it winds up being very reassuring," she adds. "After the rst time I went through it, I realized that the process helped protect us from potential
regulatory risks."

Claremont Savings now conducts HR audits every three years, in addition to the annual HR reviews that the bank's internal audit function conducts.
Widger, like many HR professionals, believes that external expertise is crucial to the success of the audit. HR auditors are well-versed on compliance
requirements, risks and current best practices.

"Obtaining the results of your HR audit will give you factual information about where you are and where you could be," notes Patricia Maley, rst vice
president, human resources manager, for CoBiz Financial Inc., a Denver-based nancial services company. HR professionals can transform information

Feedback
into action by sharing the audit results with HR sta and executive management, creating speci c action plans, and designing longer-term plans for
continuous improvement.

Triggers and Types

There are di erent types of, and approaches to, HR audits, as demonstrated by Maley's and Widger's experiences.

CoBiz Financial, a public company with 560 employees, conducts three separate HR audits: an internal audit; a compliance audit that focuses on
relevant regulatory requirements; and a processes- and practices-focused audit that external provider Denver-based Mountain States Employers
Council Inc. conducts every two to three years.

Claremont Savings, with about 110 employees, conducts an annual internal audit of HR as well as an external audit that includes compliance and
process improvement elements.

David de Wetter, a Dallas-based senior consultant in Towers Watson's talent management and organization alignment practice, identi es two types of
reviews: "risk mitigation" HR audits and "value creation" HR audits.

Risk mitigation HR audits, which may or may not be triggered by a speci c compliance violation or another major problem related to the violation of an
HR rule or principle, are designed to ensure that existing policies and procedures are e ective and followed. For example, an HR auditor may discover
that an average of 45 days elapses between the day that a company selects a candidate and when the new hire actually starts work, due to
background checks and other pre-employment protocols. If the industry average for this hiring metric is 15 days, the company may risk losing new
hires to competitors while failing to meet the business's talent needs. But the metric's real impact, notes Diane Youden, a principal
inPricewaterhouseCoopers' people and change practice, is that it "can have a negative impact on a company's employment brand."

value creation audits look more broadly at how HR's activities correlate with business priorities and how these activities might be performed more
e ectively and e ciently.
Many organizations' leaders regard the auditing exercise "as a source of continuous improvement," de Wetter says. CoBiz Financial, for example, uses
many of the recommendations identi ed in the audit report produced by Mountain States Employers Council "to determine a more clear-cut, e ective,
e cient and bene cial way to provide an enhanced perspective to an already acceptable process," according to Maley.

Improving a Process

Among the bene ts of conducting an HR audit are the recommendations within the ndings that can improve speci c policies and processes.
When Denver-based CoBiz Financial Inc.'s HR audit was completed, the two-person audit team at Mountain States Employers Council
conducted a three-hour debrie ng session with CoBiz Financial First Vice President, Human Resources Manager, Patricia Maley and her
colleagues. The sequence of discussion centered on current practices, ndings and recommendations. What follows is a section of the report
on sta ng processes:

Application Process

Current Practices: CoBiz de nes an "applicant" as anyone whose resume has been reviewed and meets the minimum quali cations.

Recommendations: Consider narrowing the de nition of what the organization considers an "applicant." For example, applicants could be
individuals who apply in response to a request for applicants, are quali ed for a certain position and whose application is retained.

Rationale: This satis es requirements of the federal a rmative action law and may reduce the amount of paperwork kept.

Claremont Savings' approach of integrating risk mitigation and value creation elements into its HR audit makes sense, given its size.

Feedback
"With small or single-person HR departments pedaling as fast as they can week in and week out, it isn't easy to stay abreast of ever-changing
regulatory compliance and human resource best practices," says Marc Lubline, SPHR, manager, HR professional sta ng and career services, for
Mountain States Employers Council. "Audits bring HR expertise into the picture and can jump-start needed discussions and process changes for small
companies."

Larger companies frequently opt for a more comprehensive audit initially, Maley reports, before re ning subsequent audits to focus on more-speci c
areas.

Claremont Savings' comprehensive HR audit included reviews of the company's a rmative action plan, equal employment opportunity plan, 401(k)
plan, I-9 documentation, pension plan, and many other aspects of compensation and bene ts, payroll, and more. For example, the auditor reviewed
which bene ts employees had signed up for and then con rmed that the correct amount of money was being deducted from their paychecks.

"The auditor also spent a signi cant amount of time on payroll," reports Widger, who counts payroll as a functional responsibility. "He told me that I
would be amazed at how many times he nds issues with people inappropriately taking money through payroll."

Payroll frequently represents a major component of HR audits, says Protiviti Executive Vice President and Head of Global Internal Audit Bob Hirth,
because it represents the single largest expense in many organizations.

HR audit vendors include public accounting rms with HR practices, HR consulting rms, and other professional services rms with HR and risk
management expertise. Most vendors o er a range of di erent audits and can tailor the audit's scope to address an organization's structure and
needs.

For example, Mountain States Employers Council provides the following types of audit services:

Compliance audit. Covers federal and state regulations that impact recordkeeping, reporting and HR program administration.

Bene ts program audit. Reviews plan design, regulatory compliance, bene ts processing and administration, and reporting.

I-9 audit. Reviews active I-9 forms, terminated I-9 forms or both.

HR program or function audit. Covers a review of any individual HR-related functional area.
Full HR audit. Covers a review and evaluation of areas noted above as well as an audit of all other HR functional areas, including sta ng and
recruitment, job analysis and descriptions, compensation and bene ts programs, performance management, training and development, employee
relations and policies, and HR metrics.

Some audits or their focal points arise as a result of regulations or business trends. Given the rise of data privacy rules in Europe as well as the
growing risks around information security, Hirth reports that more audits now scrutinize data and privacy controls related to HR records. Additionally,
Hirth notes that more audits include veri cation of dependents under the 2010 U.S. health care reform law, which allows children up to age 26 to be
covered by a working parent's medical insurance.

Audits in Action

HR professionals should be prepared for the long hours an audit requires.

"We pretty much have to clear our schedule," Widger says about the annual three-day HR audit. The auditor "gave us a checklist of the items that he
wanted ready ahead of time. But you have to be available the entire time because he always needs more information."

Maley agrees that the on-site phase of the audit is intense. "They said that they would need two days of 'pure, concentrated time' in a conference
room, and they were right on," she recalls. "We took breaks for lunch and a couple of other short breaks, but it was two very full days."

The speci c steps of the HR audit that Maley describes are nearly identical to the steps set forth by the Society for Human Resource Management:

1. Determine the scope and type of audit.

2. Develop the audit questionnaire.
3. Collect the data.
4. Benchmark the ndings.
5. Provide feedback about the results.
6. Create action plans.

Feedback
7. Foster a climate of continuous improvement.

Audit experts say the rst step is particularly important because it in uences each of the subsequent steps. Youden estimates that the planning phase
typically represents 20 percent to 30 percent of the entire e ort.

"It is critical to set clear objectives for each audit at the outset," Hirth notes. "Ask questions such as, 'Why are we doing this audit? What risk or other
information placed this type of audit on our radar screen in the rst place? What do we intend to achieve? And, is there any information available that
might con rm the need for this audit, or indicate that it is not necessary?' "

In Maley's case, the auditor presented a rough outline of the process and the types of hard-copy and digital documents his team would request once
they were on site. Widger received a much more detailed checklist of document requests.

In both cases, the external auditor spent several weeks preparing the audit report immediately after the on-site visits concluded.

Claremont Savings' auditor rst presented his ndings to Widger and her boss, the bank's president, before writing his report. "We were given the
opportunity to clarify anything that was not clear," Widger says.

CoBiz Financial's two-person audit team took six weeks to produce a nal report and have it reviewed by the internal legal function. They then
returned and sat down with Maley to present their ndings.

More audits include veri cation of dependents under the 2010 U.S. health care reform law.

Follow-Through

Both Maley and Widger say the audit ndings prompted changes.
 "There needs to be a genuine commitment to make these changes," Hirth says. "This includes speci cally identifying who is responsible for the
change, what exactly needs to be changed and when that change will be made. Then, there should be some follow-up to verify that the
recommendations have been properly and e ectively implemented."

This type of follow-through distinguishes an e ective audit practice, Hirth and others say. Another leading practice involves incorporating reports of
post-audit process improvements in what de Wetter describes as a "State of HR Report" that tracks and reports on ongoing changes, improvements
and relevant benchmarks related to the audit over the long term.

Some chief HR o cers share these ndings with their team and key partners on a regular basis, says de Wetter, who notes that the reports typically
are presented annually.

By knowing what to expect and being open to changes, HR leaders can smile, rather than panic, when they hear the "A" word.

The author is a business writer in Austin, Texas, who covers human resource, nance and social marketing issues.

Web Extras

SHRM article: HR and Internal Audit Can Be Better Partners (www.shrm.org/hrdisciplines/bene ts/Articles/Pages/InternalAudit.aspx)(SHRM Online

Bene ts Discipline)

SHRM article: Take Out the Red Pen (www.shrm.org/Publications/HRNews/Pages/TakeRedPen.aspx)(HR News)

SHRMHR Q&A: HR Audit Checklist (www.shrm.org/TemplatesTools/hrqa/Pages/basicstepsinanHRAudit.aspx)

SHRM HR Q&A:

Audit: What should we include in an HR audit? (www.shrm.org/TemplatesTools/hrqa/Pages/WhatshouldweincludeinanHRaudit.aspx)

SHRM how-to guide: How to Conduct an I-9 Audit (www.shrm.org/TemplatesTools/HowtoGuides/Pages/ConductanI-9Audit.aspx)

Feedback
SHRM sample form:
Audit: Personnel Files: Employees’ Personnel File Audit Checklist
(www.shrm.org/TemplatesTools/Samples/HRForms/Articles/Pages/AuditFilesample.aspx)

HR DAILY NEWSLETTER
News, trends and analysis, as well as breaking news alerts, to help HR professionals do their jobs better each business day.

Email Address

CONTACT US (WWW.SHRM.ORG/ABOUT-SHRM/PAGES/CONTACT-US.ASPX) | 800.283.SHRM (7476)

© 2020 SHRM. All Rights Reserved

SHRM provides content as a service to its readers and members. It does not o er legal advice, and cannot guarantee the accuracy or suitability of its content for a particular purpose.

Disclaimer (www.shrm.org/about-shrm/Pages/Terms-of-Use.aspx#Disclaimer)
Feedback