How I Run a Basic Compliance Check in a Company

When a company asks for a “compliance check”, the useful version of that request is not “tell me whether we are legal”. Nobody outside the company can answer that from a desk. The useful version is: are the documents, records, and practices you claim to follow actually in place, consistent, and findable?

That question can be answered in a week, and the answer is usually a list of gaps — not a disaster.

This is the process I follow for a first-pass HR compliance review in a small or mid-sized Nepali organisation. It is written as a walkthrough, including the parts that are uncomfortable.

Scope note: This is an operational review, not a legal opinion. Labour law, social security rules, and sector requirements change, and they differ by organisation and workforce. Verify current requirements with the Department of Labour and Occupational Safety, the Social Security Fund, and a qualified adviser before treating any finding as final.

Step 1: Agree the scope before touching a file

Before opening anything, I write down:

• What is being reviewed : HR records only, or payroll and safety too?
• Which period : the current fiscal year, or the last two years?
• Which locations or departments: head office, branch, site, contractors?
• Who receives the report : managing director, HR head, or both?
• What will happen with findings : corrective action, or an information-only review?

A review with no agreed scope becomes either a fishing expedition or a performance attack. Both waste everyone’s time.

Step 2: Ask for the document set

I request a defined list, in writing, with a deadline. In a typical company this is:

1. Company registration, PAN/VAT, and applicable licences or permits
2. Employment contracts and appointment letters for the current workforce
3. Job descriptions, if they exist
4. Attendance, leave, and overtime records for the review period
5. Payroll sheets and salary slips, plus bank-payment evidence where used
6. Provident fund and social security registration and contribution records
7. HR policy manual, code of conduct, and the list of acknowledged policies
8. Disciplinary and grievance records
9. Health and safety records, first-aid log, and safety training records
10. Insurance documents where applicable
11. Contractor or labor-supply agreements, where workers are engaged indirectly
12. Exit and final-settlement documents for recent departures

Anything not produced is itself a finding. If a register has never existed, that is more important than an error inside it.

Step 3: Test documents against a simple standard

For each document type, I test four things: existence, completeness, consistency, and currency.

Test	Question	Typical failure
Existence	Does the document exist for every employee?	Two or three new joiners with no signed contract
Completeness	Are all required fields, dates, and signatures present?	Contract missing salary or notice-period clause
Consistency	Do the documents agree with each other?	Attendance says 26 working days; salary slip paid 22
Currency	Is it up to date?	Minimum wage change not reflected; expired insurance

Then I sample. For 40 employees, I review 10 complete files: two senior, two recent joiners, two long-serving, two with a recent salary change, two with a departure in the period. Sampling reveals system problems far better than reading everything quickly.

Step 4: Walk the floor, not just the cabinet

Documents describe intent. The floor describes practice. Three checks that have never failed me:

1. Ask two employees, separately, how they apply for leave. If the answer differs from the written process, the process exists on paper only.
2. Look at the first-aid box and the fire extinguisher tag. The inspection date tells you whether the safety routine is real.
3. Ask who handles a grievance. If the answer is “the boss, I think”, the grievance mechanism is not functioning.

Neither of those is a legal conclusion. Both are hard evidence about whether the system works.

Step 5: Record findings properly

A finding needs four elements, or it cannot be fixed:

1. Observation — what was seen, factually. “Three of ten personnel files had no signed appointment letter.”
2. Criteria — what it should be, and from where. Company policy, contract, or the applicable legal or contractual requirement.
3. Risk — what could happen if it is not fixed. Disputes, penalties, audit failure, worker dissatisfaction, and — in overseas recruitment — licence risk.
4. Action — the recommendation, an owner, and a date.

I record findings in a simple sheet with a column for risk rating (high, medium, low), because a report with thirty unranked findings gets ignored, whereas a report with five high-risk items gets fixed.

Step 6: Present the report without starting a fight

Three habits make a compliance report land well:

• Lead with what is working. If attendance records are complete and payroll is consistent, say so. It makes the rest credible.
• Separate system gaps from individual errors. “The leave process is verbal” is a system problem. “One supervisor approved leave by SMS” is an example of the system problem, not a personal failure — unless it keeps happening after the gap is closed.
• Never present a finding without a recommendation. “No signed contracts for three employees” is a problem. “Obtain signatures within 14 days using the attached template, and add the contract to the joining checklist” is a fix.

Step 7: Follow up

A compliance review without a follow-up date is a document, not an improvement. I set a date four to six weeks later and re-test only the open findings. Over time this creates a small, honest trail showing what was found and what was fixed — which is exactly what a real auditor looks for.

The eight findings I see most often

1. Missing signed contracts or appointment letters, usually for recent joiners.
2. Salary or wage rates not updated after a statutory change.
3. Attendance and payroll figures that do not reconcile.
4. Leave records kept informally, with no balances.
5. Policies handed over but never acknowledged in writing.
6. Personal files that are incomplete because documents were never collected at joining.
7. Safety equipment present but not inspected or recorded.
8. Contractor workers engaged with no document trail at all.

None of these require expensive software. They require a checklist, a calendar, and someone whose job it is.

Where to start this week

If you want to run a first check yourself, take the free 10-point compliance audit checklist and work through one section per day for two weeks. Fix the high-risk items first, and record everything you cannot fix yet in a simple register with an owner and a target date.

Related reading

• How to Prepare for an Internal Audit: A Four-Week Plan
• Compliance Risk Register: How to Track Risks in a Simple Excel Sheet
• HR Documentation Checklist: The Records Every Employer Should Keep