Most employers do not discover a wage and hour problem when the time clock fails. They discover it when a former employee complains, the U.S. Department of Labor (DOL) sends a letter, or a plaintiff's lawyer shows up with a spreadsheet. By then, the question is not whether the error can be fixed; it is whether the employer knew, or should have known, about it.
A smart wage and hour audit changes that timing. It is a recurring review of payroll, timekeeping, scheduling, and human resource information system (HRIS) data designed to surface Fair Labor Standards Act (FLSA) and state law exposure while the organization still has choices. Namely, fix the process, pay what is owed, address recordkeeping gaps, confirm compliance with child labor rules, and keep a small mistake from becoming a pattern with costly consequences.
The DOL has expressly recognized self-audits as a legitimate compliance tool. A self-audit is not an admission that something is wrong. It is evidence that the employer is actively looking.
Start with Counsel
The audit should be initiated, directed, and supervised by inside or outside employment counsel, with HR, payroll, information technology, compensation, and HRIS teams supplying facts and carrying out decisions. Doing so helps keep the organization’s legal analysis and litigation-oriented work product protected by the attorney-client and attorney work product privilege, and prevents it from becoming a roadmap for plaintiffs.
Privilege has limits, however. Payroll records, time entries, and back-wage payments may not be protectable. The legal analysis, risk assessments, and strategic recommendations arising from those facts are what the privilege and work-product doctrines protect.
When counsel interviews managers, supervisors, payroll staff, or HR, counsel should give what is known as an Upjohn warning, informing those interviewed that the attorney represents the organization, not the individual. The organization controls the privilege, and the conversation is for the purpose of obtaining legal advice. Employees should answer candidly and preserve relevant records. Interview notes, findings, and circulation should be controlled by counsel from the outset. An audit built as a legal review from day one is far more defensible than one relabeled after the first troubling spreadsheet surfaces.
The Cost of Getting It Wrong
Under the FLSA, unpaid wages can be paired with an equal amount in liquidated damages, effectively doubling financial exposure, and state laws may provide similar or more generous liquidated damages and other relief, in addition to attorney fees and costs owed to the plaintiff’s attorney.
Repeated or willful minimum-wage and overtime violations can also bring civil money penalties per violation. Willful violations can expose responsible persons to criminal prosecution and a longer statute of limitations on claims of FLSA violations, and the DOL may seek injunctive relief to stop ongoing violations. A payroll mistake is rarely just a payroll mistake once it repeats across a workforce.
Consider, too, possible reputational damage to an organization if the legal violations result in a public lawsuit for not properly paying workers.
Don’t Overlook Child Labor Rules
The DOL and states, including New York, have sharply increased enforcement and penalties for child labor violations. Even when there is no payroll error, noncompliance with work-hour restrictions for minors can produce staggeringly large civil penalties — up to $16,035 per child — and the maximum penalty for violations causing death or serious injury is $72,876. Civil penalties can be doubled if the violation is repeated or willful.
A smart audit should verify records reflecting the age of every minor employee, confirm work permits are on file, and cross-check hours and dates worked against federal and state restrictions. In fiscal year 2025 enforcement, the DOL resolved 976 cases, penalized the illegal employment of more than 5,200 minors, and assessed $37.2 million in civil penalties.
Build a Full-Population Picture
Pull payroll, timekeeping, scheduling, badge or login data, and HRIS classifications into a common view. The data set should cover:
- Hours worked each day and each workweek; whether the employee is a minor; the workweek’s start day and time (including whether shifts fall on school days, weekends, or summer breaks for minors); pay-period dates; and total wages paid.
- Regular hourly rates, including nonexcludable compensation; straight-time earnings; overtime premiums; and any additions to or deductions from wages.
- Exempt or nonexempt status, the claimed exemption basis, and the basis-of-pay records required by 29 C.F.R. Section 516.3.
- Time cards, wage-rate tables, schedules, and fixed-schedule deviations, with basic payroll records retained for three to six years (depending on the state’s statute of limitations on wage and hour claims).
Test What the Systems Tell You
Run full-population tests, not a handful of employee files.
Flag the following:
- Workweeks over 40 with no overtime pay.
- Regular-rate calculations that omit shift differentials, nondiscretionary bonuses, or other nonexcludable compensation.
- Fluctuating workweek arrangements that misapply the half-time method.
- Missed meal-break clock-outs.
- Gaps between badge or login activity and recorded hours, a classic off-the-clock warning sign.
Then test the claimed exemptions from overtime pay laws against reality. Compare each exempt employee’s salary to current federal and state EAP (executive, administrative, professional white-collar exempt category) thresholds, compare job descriptions to actual duties, and confirm required basis-of-pay records. An exemption that was sound at hire may not survive the job as it exists today.
Make the Audit Operational
Technology should automate the routine tasks, such as pulling data from payroll, timekeeping, and HRIS systems, applying customizable rules, producing detailed exception reports, and tracking fixes through completion. Start with a full-population review of nonexempt timekeeping and exempt classifications. Then run automated tests quarterly, conduct a comprehensive review annually, and trigger a fresh review after any acquisition, reclassification, policy change, or system migration.
Remediation should be equally deliberate. Correct current or recent underpayments in the next payroll cycle when possible. Under counsel’s direction, calculate historical back pay for the applicable limitations period: two years, or three, when willfulness is at issue. Fix the policy, system configuration, or process that produced the error. Keep a remediation log showing what was found, what was paid, and what changed.
Don’t Delay Audit
Do not wait for a visit from the DOL, which may initiate an investigation at any time, inspect records, and interview workers without a complaint as a predicate.
Start now to revisit worker classifications, salary thresholds (federal and state), and job descriptions annually. Make sure employee policies squarely address overtime pay, off-the-clock work, and provide a clear mechanism for reporting pay errors, worker misclassifications, and, in the case of minors, variances from federal and state rules on legally permitted hours and schedules.
Train managers every year on:
- Federal and state wage and hour requirements, including time spent before and after scheduled hours.
- Federal and state wage notice of pay rate and recordkeeping requirements.
- What “regular rate of pay” means (as opposed to hourly rate).
- Meal and/or rest break requirements.
- Overtime pay requirements.
- Employment-of-minors rules at both the federal and state levels.
- Variances between federal and state wage and compensation requirements.
- The importance of updating job descriptions and reviewing — and updating, as needed — policies on work hours, meal and rest breaks, reporting errors in pay, and worker classification.
- The importance of enforcing wage and hour as well as break policies, and the consequences of failing to do so.
Review labor postings and time records for all workers, including minors, ensuring minors are working only the hours permitted and performing age-appropriate work. Above all, get counsel in the room before anyone pulls the first payroll report to ensure your audit has attorney-client privilege.
Lisa M. Brauner is a partner in the Labor and Employment Law Department at the law firm of Whiteford, Taylor & Preston LLP in New York City.
Was this resource helpful?
Validate your HR expertise
Earning your SHRM-CP credential makes you a recognized expert and leader in the HR field.
Related Content
Transform HR with mobile technology to streamline workflows, enhance communication, and boost employee engagement across distributed teams.
A new study found that talent development practitioners believe performance-based assessments are more effective at measuring employee learning outcomes than knowledge tests.
As AI makes deeper inroads into organizations, employee concerns about the technology continue to grow. Here's how HR leaders can address the fear of AI among their own staff, as well as in the wider organization.