Auditing Your HR Department

Page Content

Like most taxpaying citizens, human resource professionals often recoil at the "A" word—"audit."

"You can get really stressed about the fact that the auditor is visiting you," says Beverly A. Widger, SPHR, senior vice president, human resources, at Claremont Savings Bank in New Hampshire.

Having gone through an HR audit two years ago designed to scrutinize current practices, review compliance capabilities and identify process improvement opportunities, however, Widger views the process differently today. "It's actually very helpful," she says. For example, the auditor, who works for an external firm with specific HR and payroll expertise, showed Widger how to confirm that the bank's outsourced payroll provider was submitting federal tax payments as required by law. "As nerve-wracking as an audit might be, it winds up being very reassuring," she adds. "After the first time I went through it, I realized that the process helped protect us from potential regulatory risks."

Claremont Savings now conducts HR audits every three years, in addition to the annual HR reviews that the bank's internal audit function conducts. Widger, like many HR professionals, believes that external expertise is crucial to the success of the audit. HR auditors are well-versed on compliance requirements, risks and current best practices.

"Obtaining the results of your HR audit will give you factual information about where you are and where you could be," notes Patricia Maley, first vice president, human resources manager, for CoBiz Financial Inc., a Denver-based financial services company. HR professionals can transform information into action by sharing the audit results with HR staff and executive management, creating specific action plans, and designing longer-term plans for continuous improvement.

Triggers and Types

There are different types of, and approaches to, HR audits, as demonstrated by Maley's and Widger's experiences.

CoBiz Financial, a public company with 560 employees, conducts three separate HR audits: an internal audit; a compliance audit that focuses on relevant regulatory requirements; and a processes- and practices-focused audit that external provider Denver-based Mountain States Employers Council Inc. conducts every two to three years.

Claremont Savings, with about 110 employees, conducts an annual internal audit of HR as well as an external audit that includes compliance and process improvement elements.

David de Wetter, a Dallas-based senior consultant in Towers Watson's talent management and organization alignment practice, identifies two types of reviews: "risk mitigation" HR audits and "value creation" HR audits.

Risk mitigation HR audits, which may or may not be triggered by a specific compliance violation or another major problem related to the violation of an HR rule or principle, are designed to ensure that existing policies and procedures are effective and followed. For example, an HR auditor may discover that an average of 45 days elapses between the day that a company selects a candidate and when the new hire actually starts work, due to background checks and other pre-employment protocols. If the industry average for this hiring metric is 15 days, the company may risk losing new hires to competitors while failing to meet the business's talent needs. But the metric's real impact, notes Diane Youden, a principal inPricewaterhouseCoopers' people and change practice, is that it "can have a negative impact on a company's employment brand."

Value creation audits look more broadly at how HR's activities correlate with business priorities and how these activities might be performed more effectively and efficiently.

Many organizations' leaders regard the auditing exercise "as a source of continuous improvement," de Wetter says. CoBiz Financial, for example, uses many of the recommendations identified in the audit report produced by Mountain States Employers Council "to determine a more clear-cut, effective, efficient and beneficial way to provide an enhanced perspective to an already acceptable process," according to Maley.

Claremont Savings' approach of integrating risk mitigation and value creation elements into its HR audit makes sense, given its size.

"With small or single-person HR departments pedaling as fast as they can week in and week out, it isn't easy to stay abreast of ever-changing regulatory compliance and human resource best practices," says Marc Lubline, SPHR, manager, HR professional staffing and career services, for Mountain States Employers Council. "Audits bring HR expertise into the picture and can jump-start needed discussions and process changes for small companies."

Larger companies frequently opt for a more comprehensive audit initially, Maley reports, before refining subsequent audits to focus on more-specific areas.

Claremont Savings' comprehensive HR audit included reviews of the company's affirmative action plan, equal employment opportunity plan, 401(k) plan, I-9 documentation, pension plan, and many other aspects of compensation and benefits, payroll, and more. For example, the auditor reviewed which benefits employees had signed up for and then confirmed that the correct amount of money was being deducted from their paychecks.

"The auditor also spent a significant amount of time on payroll," reports Widger, who counts payroll as a functional responsibility. "He told me that I would be amazed at how many times he finds issues with people inappropriately taking money through payroll."

Payroll frequently represents a major component of HR audits, says Protiviti Executive Vice President and Head of Global Internal Audit Bob Hirth, because it represents the single largest expense in many organizations.

HR audit vendors include public accounting firms with HR practices, HR consulting firms, and other professional services firms with HR and risk management expertise. Most vendors offer a range of different audits and can tailor the audit's scope to address an organization's structure and needs.

For example, Mountain States Employers Council provides the following types of audit services:

Compliance audit. Covers federal and state regulations that impact recordkeeping, reporting and HR program administration.

Benefits program audit. Reviews plan design, regulatory compliance, benefits processing and administration, and reporting.

I-9 audit. Reviews active I-9 forms, terminated I-9 forms or both.

HR program or function audit. Covers a review of any individual HR-related functional area.

Full HR audit. Covers a review and evaluation of areas noted above as well as an audit of all other HR functional areas, including staffing and recruitment, job analysis and descriptions, compensation and benefits programs, performance management, training and development, employee relations and policies, and HR metrics.

Some audits or their focal points arise as a result of regulations or business trends. Given the rise of data privacy rules in Europe as well as the growing risks around information security, Hirth reports that more audits now scrutinize data and privacy controls related to HR records. Additionally, Hirth notes that more audits include verification of dependents under the 2010 U.S. health care reform law, which allows children up to age 26 to be covered by a working parent's medical insurance.

Audits in Action

HR professionals should be prepared for the long hours an audit requires.

"We pretty much have to clear our schedule," Widger says about the annual three-day HR audit. The auditor "gave us a checklist of the items that he wanted ready ahead of time. But you have to be available the entire time because he always needs more information."

Maley agrees that the on-site phase of the audit is intense. "They said that they would need two days of 'pure, concentrated time' in a conference room, and they were right on," she recalls. "We took breaks for lunch and a couple of other short breaks, but it was two very full days."

The specific steps of the HR audit that Maley describes are nearly identical to the steps set forth by the Society for Human Resource Management:

1. Determine the scope and type of audit.
2. Develop the audit questionnaire.
3. Collect the data.
4. Benchmark the findings.
5. Provide feedback about the results.
6. Create action plans.
7. Foster a climate of continuous improvement.

Audit experts say the first step is particularly important because it influences each of the subsequent steps. Youden estimates that the planning phase typically represents 20 percent to 30 percent of the entire effort.

"It is critical to set clear objectives for each audit at the outset," Hirth notes. "Ask questions such as, 'Why are we doing this audit? What risk or other information placed this type of audit on our radar screen in the first place? What do we intend to achieve? And, is there any information available that might confirm the need for this audit, or indicate that it is not necessary?' "

In Maley's case, the auditor presented a rough outline of the process and the types of hard-copy and digital documents his team would request once they were on site. Widger received a much more detailed checklist of document requests.

In both cases, the external auditor spent several weeks preparing the audit report immediately after the on-site visits concluded.

Claremont Savings' auditor first presented his findings to Widger and her boss, the bank's president, before writing his report. "We were given the opportunity to clarify anything that was not clear," Widger says.

CoBiz Financial's two-person audit team took six weeks to produce a final report and have it reviewed by the internal legal function. They then returned and sat down with Maley to present their findings.

More audits include verification of dependents under the 2010 U.S. health care reform law.

Follow-Through

Both Maley and Widger say the audit findings prompted changes.

"There needs to be a genuine commitment to make these changes," Hirth says. "This includes specifically identifying who is responsible for the change, what exactly needs to be changed and when that change will be made. Then, there should be some follow-up to verify that the recommendations have been properly and effectively implemented."

This type of follow-through distinguishes an effective audit practice, Hirth and others say. Another leading practice involves incorporating reports of post-audit process improvements in what de Wetter describes as a "State of HR Report" that tracks and reports on ongoing changes, improvements and relevant benchmarks related to the audit over the long term.

Some chief HR officers share these findings with their team and key partners on a regular basis, says de Wetter, who notes that the reports typically are presented annually.

By knowing what to expect and being open to changes, HR leaders can smile, rather than panic, when they hear the "A" word.

The author is a business writer in Austin, Texas, who covers human resource, finance and social marketing issues.