The human resources audit: adding HR to the regular audit cycle can help ensure major risks aren't overlooked.

TRENDS IN HUMAN RESOURCES (HR) management often find their way into the headlines, forcing organizations to take notice of their potential risks. Some recent issues include executive management ethics, skyrocketing health-care costs, employee fraud, and HR outsourcing.

Other risks associated with HR include noncompliance with employment laws, inadequate compensation and benefit plan design, not maintaining appropriate staffing levels, and poor record keeping. Despite all of these risks, internal auditors have only recently begun to consider regularly auditing the HR function.

Auditors may be surprised at the broad scope of HR issues to review. A comprehensive HR audit includes the main functional areas of workforce planning, employee development, compensation and benefits, employee and labor relations, and risk management.

WORKFORCE PLANNING

A common definition of workforce planning is "to have the right number of people, with the right skills, at the right time to perform the required work." An auditor reviewing workforce-planning efforts should focus on whether HR is performing adequate analyses and developing action plans to ensure the organization is not left with a shortage of qualified workers.

HR departments often spend significant time recruiting and selecting job candidates. Auditors should assess whether HR is documenting applicant information accurately and timely and whether records are current. Auditors should also verify that HR is using suitable recruiting sources that are capable of furnishing adequate numbers of qualified applicants.

Risks associated with the interview process include permitting untrained managers to ask illegal questions, requiring applicant tests that are invalid or illegal, and documenting inappropriate reasons for selection or nonselection. Supervisors should not be asking applicants questions related to their race, gender, religion, marital status, disabilities, ethnic background, or country of origin. U.S. organizations should be careful not to develop hiring tests that violate the Equal Employment Opportunity Commission's 4/5ths rule in minorities hired.

In reviewing the organization's structure, auditors should look for red flags such as first-line supervisors with spans of control too great to be practical; middle managers with lines of authority over only one other manager, and chains of command that are not clearly designated or that reflect multiple, conflicting reporting relationships. Problems in this area can result in conflicts between departments, inefficiencies, inability to keep up with customer demands, and low employee morale.

In organizations that hire contractors, auditors should ensure controls are in place to monitor these individuals or providers. In the United States, contractor duties should be routinely monitored to ensure they meet Internal Revenue Service requirements for contractor versus employee status.

HR also has a vital role in analyzing employee turnover. Auditors can review turnover analysis and the exit interview process to determine whether high turnover is putting a strain on recruiting efforts and work productivity and whether management is appropriately addressing issues raised by exiting employees.

EMPLOYEE DEVELOPMENT

Training is notoriously one of the first programs to be cut in a budget crunch. However, a decrease in training can have a direct impact on performance and ultimately on an organization's bottom line. Auditors should assess whether HR is monitoring training needs and making adjustments, offering the appropriate level of training for different positions, and conducting cost-benefit analysis for training programs.

One of the greatest risks an organization can face is supervisors who are not trained in employment law or how to manage their subordinates' performance. When auditing the employee performance management system, auditors should assess whether appraisals are done timely, are based on job-specific criteria, and do not document information that could be considered discriminatory. Ineffective performance management systems can result in a lack of good informal feedback from managers to employees, minimal employee development, and low employee engagement levels affecting organizational productivity.

There are also risks associated with employee counseling and discipline. Auditors should verify that management documents performance problems and actions taken, including acknowledgement that the employee was made aware of the problem. This is important because disciplined employees may file an internal grievance or external complaint or lawsuit. Management's documentation should include support for the decision made because it could become subject to further scrutiny.

COMPENSATION AND BENEFITS

Employee reward systems, including all compensation and benefits programs, are one of the most complex HR systems. A reward system should help support the organization's strategic mission, motivate employees, and reward performance. Compensation systems should be both externally competitive and provide internal equity. Auditors may want to work with a compensation expert when reviewing this area.

During the audit, auditors should ensure that: a compensation philosophy has been developed that defines how the organization wants to pay people with respect to its position in the labor market; there are current job descriptions for each position; an effective market analysis has been conducted; a salary structure has been developed to help manage pay, and an appropriate job evaluation system is being used to slot jobs into the salary structure. A review of the organization's salary administration process is also important to determine how employees are paid throughout their careers, including merit increases, variable performance pay, promotions, bonuses, stock options, and deferred compensation, to name a few.

A key area of risk for U.S. organizations is appropriately complying with the Fair Labor Standards Act (FLSA) regarding overtime pay. Organizations must correctly classify each position as nonexempt (subject to overtime pay) or exempt (not subject to overtime pay). In addition, they must correctly calculate overtime pay for nonexempt employees. A review of the payroll function should ensure that new hires, personnel actions, work hours, and differential pay are efficiently processed so that paychecks are accurate and processed timely. Auditors should verify controls to ensure that the confidentiality of personnel data is maintained, additions to base pay are appropriately calculated and authorized, full compliance with tax and other deductions is made, terminating employees' payrolls are processed appropriately, and payroll costs are in line with budgeting objectives.

On the benefits side, employee benefit programs often include medical insurance, life insurance, vacation and leave policies, and some form of organization-sponsored retirement or savings plan. Factors to consider in auditing benefit plans are external competitiveness, cost effectiveness, management goals, employee needs, and compliance with state and federal laws. In addition to being financially burdensome, poorly designed benefit plans may not support an organization's strategies.

EMPLOYEE AND LABOR RELATIONS

Much of HR administration deals with the processes related to managing employees throughout their careers with the organization. There are several employment risks to consider, including discrimination, harassment, wrongful discharge, negligent hiring, retention, and employee privacy. Internal auditors should ensure that HR:

* Has comprehensive policies and procedures that are compliant with employment regulations and reflect best practices.

* Conducts employee attitude surveys and takes action based on survey results.

* Maintains appropriate employment files for each employee, including separate files that document demographic and medical information.

How an organization handles employee complaints and grievances is an area where a clear audit trail is necessary. Documentation should include the date, situation, and nature of the grievance or complaint; the action management has taken; any investigation results; and the final outcome or settlement. If an organization has a labor agreement, then policy changes, attitude surveys, and employee complaints and grievances have an added element of review and negotiation.

RISK MANAGEMENT

According to the Society for Human Resource Management, the "people risk" is exposing organizations to more liability than traditional areas of risk management. With the surge in worker's compensation expenses, discrimination violations, and other compliance issues, the risk function is overlapping with safety and HR more than ever. Auditors' review of the organization's safety and health program should focus on whether work-site analyses to identify hazards and potential hazards, stringent prevention and control measures, and thorough training are provided. HR should establish controls to minimize risk, including succession planning, adequate severance and outplacement services, executive coaching and development, thorough HR handbooks, documented employee hiring, training and termination procedures, and internal employee surveys.

AN OVERLOOKED AUDIT AREA

Despite its integral role, HR has often been considered a "soft" area, and management may not understand the inherent risks involved with this function. Adding an HR audit to an organization's regular audit cycle provides important risk coverage that may have been previously overlooked.

KELLI W. VITO, SPHR, CCP, is the principal of KV Consulting, a human resources consulting firm based in Austin, Texas, and the author of Auditing Human Resources from The IIA Research Foundation Handbook Series (2007).

To comment on this article, e-mail the author at [e-mail].

EDITED BY DOUGLAS ZIEGENFUSS