HR Documentation Checklist: The Records Every Employer Should Keep

Ask five different offices what a personnel file should contain and you will get five different answers. Then ask an auditor. The answer becomes much more specific, and much shorter: the documents that prove what was agreed, what was paid, and what was recorded.

This is the checklist I use to build and audit HR files. It is written for small and mid-sized offices that do not have an HR information system.

Record-keeping requirements depend on the law, the sector, and the organisation. Use this as a working structure, check current requirements, and take qualified advice on retention periods before destroying any record.

The master file structure

Keep one folder per employee, plus a small set of registers that sit outside the individual files:

Per employee

1. Application, CV, and interview evaluation
2. Offer letter and signed appointment letter or contract
3. Personal details form and emergency contact
4. Identity and qualification copies, with verification noted
5. Joining report and induction acknowledgement
6. Policy acknowledgements (conduct, IT, confidentiality, safety)
7. Job description, and revisions
8. Salary and designation change letters
9. Appraisal forms and objective records
10. Training records and certificates
11. Warning letters, show-cause notices, and replies
12. Leave records or a reference to the leave register
13. Medical or insurance documents where applicable
14. Exit documents: resignation or termination, clearance, final settlement, experience letter

Registers kept separately

• Attendance and overtime
• Leave balances
• Payroll and salary slips
• Statutory contributions (provident fund, social security, insurance)
• Training and certifications
• Disciplinary register
• Grievance register
• Contract expiry and renewal calendar

What each document must actually contain

A document is only useful if it answers the question an auditor or a departing employee will ask.

Document	Must contain
Appointment letter	Name, position, department, reporting line, salary and allowances, working hours, probation, notice period, leave entitlement, signature of both parties, date
Job description	Purpose, main duties, authority, reporting line, version date
Personal details form	Current address and phone, emergency contact, identification details, next of kin
Policy acknowledgement	Policy name, version or date, statement that it was read, employee signature, date
Appraisal form	Period covered, objectives, results, ratings with definitions, employee comments, signatures
Warning letter	Date, specific incident, reference to the policy breached, previous discussions, expected correction, signature received
Salary revision letter	Effective date, old and new amounts, reason, signature
Exit clearance	Assets returned, advances settled, final settlement amount, clearance signatures

Two habits make the difference: every document is dated, and every document states what it is.

Paper, digital, or both?

Paper is still normal for signed originals — contracts, warnings, and settlement documents. Keep them in a locked cabinet with restricted access.

Digital copies make audits and daily work much easier. If you scan documents:

• Name files consistently: 2026-04-15_contract_ram-sharma.pdf. Date, document type, name.
• Keep one folder per employee, with subfolders: 01-contract, 02-joining, 03-changes, 04-appraisals, 05-disciplinary, 06-exit.
• Back up to two places, and check the backup actually restores. An untested backup is a belief, not a safeguard.
• Restrict sharing. Personnel data should not live in a general shared drive where the whole office can browse it.
• Keep a register of who has access and why.

Retention: the practical rule

Retention periods depend on legal requirements, limitation periods, and the purpose of the record. A few principles that hold up in practice:

• Attendance, leave, and payroll records are normally kept well beyond the current year — often several years — because they support claims, audits, and statutory checks. Check the period that applies to your organisation before clearing anything.
• Statutory contribution records should be kept for the period required by the relevant fund or law, and generally longer than the current financial year.
• Contract and personnel files are usually retained for the employment period plus a defined period after exit.
• Disciplinary and grievance records are often kept longer than ordinary HR records because claims can surface later.
• Medical records need extra care and should be separated from the general file and shared only on a need-to-know basis.

When a retention period expires, do not simply dump documents. Use a disposal log: what was destroyed, when, by whom, and under which policy.

Security rules worth writing down

1. Only HR, and the manager who needs it for a decision, should see a personnel file.
2. No personal data on personal phones, USB drives, or home computers without permission.
3. Printed documents with personal data must be collected from the printer immediately and shredded when no longer needed.
4. Access rights are removed on the day an employee leaves, including shared folders and email.
5. A person leaving HR does not take the file cabinet with them — physically or digitally.

Common findings in internal audits

• A contract signed by the employee but not by the employer.
• Missing policy acknowledgements for people who joined two or three years ago.
• Salary increases applied but never documented.
• Warning letters with no proof they were received.
• Leave records that do not reconcile with the attendance register.
• Two files for the same person because the employee changed department.
• Personal data in an open shared folder, accessible to everyone.

Every one of those is fixable with a checklist, a naming convention, and a monthly half-hour review.

A monthly 30-minute routine

• Last day of the month: file the month’s attendance, leave, overtime, and payroll documents.
• Check that every new joiner has a complete file.
• Check the contract expiry calendar for the next 90 days.
• Confirm that backups ran.
• Note anything missing on the compliance calendar with an owner and a date.

That routine is unglamorous and it prevents most audit findings I have seen.

Related reading

• How to Prepare for an Internal Audit: A Four-Week Plan
• Employee Contract Documentation: What to Check Before a File Is Closed
• Free 10-Point Compliance Audit Checklist