HR Compliance Is an Operating System, Not a Checklist
An HR compliance program for a small business is a set of owned routines (written policies, records, training, postings, and audits) matched to the federal, state, and local laws that apply to your headcount, industry, and locations. Treat it as a system you maintain. No program removes legal risk entirely, so keep yours documented and current.
Some compliance duties start with your first employee
Several federal duties begin with your first hire, while others begin only when headcount or revenue crosses a coverage test.
On Form I-9, the employee completes Section 1 no later than the first day of employment, and the employer completes Section 2 within three business days after the first day (by the first day for hires of under three business days), per the USCIS Instructions for Form I-9.
Employers also report each newly hired or rehired employee to a designated state agency within 20 days of hire. Some states require it sooner, and the report goes to the state rather than the IRS, per HHS Administration for Children and Families new-hire reporting.
As of October 2026, these are among the federal HR compliance coverage tests, and the list is not complete.
Law
Coverage test
Source
Fair Labor Standards Act (FLSA) wage and hour rules
No employee-count minimum. Covers an enterprise with employees engaged in commerce and annual gross business of at least $500,000, and any employee individually engaged in commerce
29 U.S.C. 203, 29 U.S.C. 207
Title VII, the Americans with Disabilities Act (ADA), and GINA
15 or more employees who worked for at least 20 calendar weeks in the current or preceding year
EEOC
Pregnant Workers Fairness Act (PWFA)
15 or more employees; requires reasonable accommodation for known limitations related to pregnancy, childbirth, or related medical conditions
EEOC
Age Discrimination in Employment Act (ADEA)
20 or more employees for 20 or more calendar weeks
EEOC
Family and Medical Leave Act (FMLA)
A private-sector employer is covered with 50 or more employees in 20 or more workweeks in the current or preceding calendar year. Employee eligibility is a separate test, with 12 months of service, 1,250 hours, and a worksite with 50 or more employees within 75 miles
DOL Fact Sheet #28
Affordable Care Act (ACA) employer shared responsibility
Applicable large employer means at least 50 full-time employees, including full-time equivalents, on average during the prior year
IRS
Equal Employment Opportunity (EEO-1) workforce reporting
Private-sector employers with 100 or more employees; federal contractors with 50 or more employees that meet certain criteria
EEOC
Five domains hold the obligations you need to track
This guide organizes HR compliance requirements for small business into five domains.
Hiring and onboarding. For covered employers, equal employment opportunity rules apply at the application stage, and the EEOC says employers are explicitly prohibited from making pre-offer inquiries about disability, so check your application and interview questions.
Wage and hour. FLSA overtime for nonexempt employees is 1.5 times the regular rate for hours over 40 in a workweek, and the federal rule is weekly, with no daily overtime except under the optional 8-and-80 system for hospitals and residential care establishments (29 U.S.C. 207, DOL overtime page). Risks to check are exempt versus nonexempt classification and overtime calculations.
Benefits administration. Track full-time status, because under the ACA test a full-time employee averages at least 30 hours of service per week or 130 per month (IRS).
Timekeeping and leave. The FLSA does not require meal or rest periods or sick pay (DOL FLSA Advisor), so break and sick pay rules depend on state law, which varies by state. Under the FMLA, an employer cannot count FMLA leave against an employee under an attendance policy (DOL Fact Sheet #28A). Risks to check are attendance-point systems and inconsistent leave decisions.
Employee relations and termination. Title VII covers race, color, religion, sex including pregnancy, and national origin (EEOC). The ADA requires reasonable accommodation for a qualified individual with a disability unless it causes undue hardship (EEOC), and the PWFA requires reasonable accommodation for known pregnancy-related limitations unless it causes undue hardship.
State and local laws add requirements on top of federal law
Federal law is a starting point, and state and local laws can add duties or set higher standards. Multi-law compliance in regulated workplaces means federal, state, local, and industry rules can apply at once.
The FLSA does not excuse noncompliance with a federal, state, or municipal law that sets a higher minimum wage, a lower maximum workweek, or a higher child labor standard (29 U.S.C. 218(a)). DOL, State Minimum Wage Laws lists rates above the federal rate in many states, and some local governments set rates above their state’s.
California requires overtime for nonexempt employees for hours over eight in a workday, over 40 in a workweek, and the first eight hours on the seventh consecutive day (California DIR).
OSHA covers most private-sector employers, the General Duty Clause requires a workplace free of serious recognized hazards, and standards exist for construction and general industry (OSHA, Help for Employers).
As of October 2026, Chicago’s Fair Workweek Ordinance covers employees earning up to $33.85 per hour or $64,945.55 per year in seven industries, including healthcare, hotels, manufacturing, restaurants, and retail, at employers with 100 or more employees globally (restaurants have a separate test), and gives them advance schedule notice and one hour of predictability pay for any shift change within 14 days (Chicago BACP).
A compliance program needs an owner for each domain
A compliance program stalls when no one is accountable for each domain’s upkeep. Three ownership gaps can cause that. Diffuse ownership can leave responsibility shared so widely that no one holds it. Owner-as-default can mean the owner holds the rules in their head, and the program does not survive delegating to a bookkeeper or office manager. Tool-as-owner can mean a payroll or HR platform is assumed to enforce compliance with no person accountable for configuration, updates, and exceptions.
When a business outsources payroll tax duties, the employer stays responsible for federal deposits and payments, per IRS, Outsourcing payroll duties.
Run the program as a system with a named owner for each domain, a review schedule, and a place where records and changes are logged.
* Write policies for each domain and review them when a law or headcount changes.
* Keep records for the required periods. FLSA payroll records must be kept at least three years and time cards at least two years (DOL Fact Sheet #21), employment tax records at least four years (IRS Publication 15), and Form I-9 for three years after hire or one year after employment ends, whichever is later (USCIS Form I-9).
* Train managers and employees where the law requires it. California requires sexual harassment prevention training at employers with five or more employees, two hours for supervisors and one hour for other employees every two years (California Civil Rights Department). Other states vary.
* Post the notices that apply, including the OSHA Job Safety and Health Workplace Poster and the EEOC Know Your Rights poster. Check your state labor agency for state posting requirements.
* Audit the program with counsel on a set schedule.
AsureWorks is a managed service and a PEO alternative with no co-employment. Asure specialists handle day-to-day HR administration, and you remain the employer of record and keep control of workforce decisions. Statutory responsibility stays with you.
Run an internal audit with counsel and keep the program current
An internal audit shows where your records and practices differ from the rules that apply today. Where FLSA minimum wage or overtime violations exist, an employee or DOL can recover back wages and an equal amount in liquidated damages, and the limitations period is two years, or three years for willful violations (DOL, Handy Reference Guide to the FLSA). New duties begin each time headcount crosses a coverage test in the table, and state thresholds can be lower, as the California training rule shows, so audit at each crossing.
What you need first
An employment attorney to direct the audit, your headcount by state, and your policies, I-9s, payroll and time records, training logs, and postings.
1. Engage an employment attorney before you begin, and have counsel direct the audit. In Upjohn Co. v. United States, 449 U.S. 383 (1981), the Supreme Court held that attorney-client privilege covers employee communications to company counsel made at corporate superiors’ direction so counsel can give legal advice, and protects the communications but not the underlying facts (Supreme Court opinion). Whether privilege applies depends on the facts, so counsel decides how the audit is structured and shared.
2. Define the scope as current headcount, each state where employees work, and each of the five domains.
3. Pull the records for each domain.
4. Compare practices and records against the federal tests above and each state agency’s requirements, routing questions and sensitive findings through counsel.
5. Assign every finding to a named owner and a due date.
What a correct result looks like
Every domain has a named owner, every open item has a date, records are kept for the required periods, and counsel has decided how findings are documented and shared.
Keep the program current. As of October 2026, the federal standard exempt salary level is $684 per week ($35,568 per year) under 29 CFR 541.600, and duties tests also apply. Federal courts vacated the 2024 DOL rule that would have raised it in November and December 2024, and DOL restored the earlier regulation text on May 15, 2026 (DOL salary levels page, Federal Register notice). USCIS lists the 01/20/25 edition of Form I-9, expiring 05/31/2027, as current, so check the USCIS Form I-9 page before onboarding anyone. Put a recurring review date on the calendar and check DOL, EEOC, USCIS, and state labor agency pages for changes.
Frequently asked questions
What does HR compliance include for a small business?
HR compliance includes five domains (hiring and onboarding, wage and hour, benefits administration, timekeeping and leave, and employee relations and termination). The specific duties within each domain depend on your headcount, industry, and the states where you have employees.
Which federal laws shape HR compliance for small businesses?
The FLSA, Title VII, the ADA, the ADEA, the Equal Pay Act, the PWFA, the FMLA, and the ACA shape federal HR compliance. For private employers, the FMLA and the ACA employer mandate apply only above size tests.
What is the difference between HR and HR compliance?
HR is the whole people-operations function, while HR compliance is the subset that tracks and documents legal obligations. Strong HR practices, such as onboarding, do not by themselves show that legal requirements are being met.
How do HR compliance requirements change as a company grows?
Federal tests add duties as headcount rises. As of October 2026, they include 15 employees for Title VII and the ADA, 15 for the PWFA, 20 for the ADEA, 50 employees in 20 workweeks for FMLA coverage, 50 full-time employees including full-time equivalents for the ACA employer mandate, and 100 for EEO-1 reporting. State thresholds can be lower, so re-audit at each crossing.
What does an HR compliance function do for employees?
An HR compliance function helps ensure employees receive the protections the law gives them, including equal pay, a safe workplace, protected leave, protection from discrimination, and accurate wages, depending on coverage tests.
Talk to an expert at Asure
Asure HR Compliance gives employers with active compliance exposure on-demand access to certified HR professionals. The Strategic HR and Total HR tiers add proactive reviews and manager training programs. It is an add-on to AsureCentral or AsureWorks and does not guarantee a compliance outcome. Talk to an expert at Asure about which tier fits.
