Preparing for an HR and Payroll Compliance Audit – What the Inspector Wants to See

Audits and compliance reviews in the HR and payroll department follow a distinct, recognizable pattern. If you understand the primary focus areas of UK enforcement bodies, you can identify and resolve critical discrepancies beforehand—rather than having to justify systemic errors under pressure during a formal investigation.

Three Primary Types of HR & Payroll Audits

Key HR Focus Areas

1. National Minimum Wage & accurate working time. The single most scrutinised area in UK payroll inspections. Under the National Minimum Wage Regulations 2015, inspectors assess whether total remuneration divided by actual hours worked meets statutory National Living Wage / Minimum Wage thresholds across every pay reference period. Crucially, "working time" includes mandatory training, pre-opening shift briefings, security queues, and uniform donning. Failure to capture these hours digitally creates automatic arrears.

2. Working time records & rest break compliance. The foundation of workforce compliance. Employers must maintain adequate records to demonstrate compliance with the Working Time Regulations 1998 (WTR 1998, Reg 9) and ECJ ruling C-55/18 (CCOO) standards—specifically the 48-hour average weekly limit (unless a valid individual opt-out is on file), 11 consecutive hours of daily rest, and statutory 20-minute rest breaks for shifts exceeding 6 hours. For NMW purposes, time records must be preserved for at least 6 years. Electronic records must demonstrate tamper-proof immutability, continuous audit logging, and full traceability of retrospective edits (including timestamp, reason, and user ID).

3. Benefits in Kind (BiKs) and expenses. Have company cars, medical insurance, accommodation, and non-cash perks been reported accurately via P11D forms or payrolled under Real Time Information (RTI)? Are trivial benefits strictly capped below £50 per event (and £300 annually for directors of close companies under s.323A ITEPA 2003)? Has Class 1A NIC been calculated and paid via Form P11D(b)?

4. Employment status & off-payroll working (IR35). Are self-employed contractors and sole traders genuinely in business on their own account, or do they constitute disguised employees? Under the Off-Payroll Working rules (Chapter 10, Part 2 ITEPA 2003 for medium and large clients; Chapter 8 for small businesses), the hiring entity must exercise reasonable care when issuing Status Determination Statements (SDS). Key legal tests include mutuality of obligation, degree of control, right of personal substitution (Ready Mixed Concrete / Autoclenz), and integration into the organisation.

5. Variable hours, shift premiums, and holiday pay calculations. Following statutory reforms under the Employment Rights (Amendment, Revocation and Transitional Provision) Regulations 2023 and landmark case law (Bear Scotland v Fulton, Harpur Trust v Brazel), holiday pay for variable-hour and irregular-shift workers must reflect normal remuneration—including regular overtime, commission, and unsocial hours shift allowances—calculated across a 52-week reference period.

6. Business travel & subsistence expenses. Have temporary versus permanent workplaces been correctly classified under the 24-month rule (Sections 336–339 ITEPA 2003)? Are reimbursed mileage claims within statutory HMRC Approved Mileage Allowance Payment (AMAP) advisory rates (45p/25p per mile)? Are subsistence claims backed by valid itemised receipts or approved benchmark scale rates?

7. Director remuneration & close company transactions. HMRC regularly scrutinises director emoluments, director loan accounts (s.455 CTA 2010 tax charges), waive agreements, and personal expenses run through business accounts.

Preparation: Seven Steps

1. Run a test data export. Does your time tracking and HR software export clear, structured payroll datasets across all historical tax years—including legacy archives? Are all timestamps, user IDs, and pay elements fully populated and transparent?

2. Review HR & payroll process documentation. Are standard operating procedures, pay calculation rules, and time tracking policies fully documented and version-controlled? Is the mapping between recorded time categories (overtime, on-call, night shifts) and payroll wage types explicitly defined?

3. Spot-check working time records. Can you produce unmanipulated, complete records of daily start times, finish times, and total durations for any randomly chosen employee and pay period? For any retrospectively amended time entry, can you demonstrate who made the edit, when, and the commercial reason?

4. Verify NMW calculations for salaried and variable staff. Check salaried workers who routinely work unrecorded overtime to ensure their effective hourly rate (annual salary divided by actual total annual hours) never falls below the National Living Wage. Audit all deductions (e.g. salary sacrifice pensions, uniforms, tools) that reduce pay for NMW purposes.

5. Review Benefits in Kind and P11D reporting. Cross-reference all company credit card expenditure, staff vouchers, and expense reimbursements against the statutory P11D/P11D(b) or PAYE Settlement Agreement (PSA) schedules to ensure no taxable perk is omitted.

6. Audit off-payroll worker status (IR35). Maintain a comprehensive register of all off-payroll contractors, consultants, and Personal Service Companies (PSCs). Ensure every engagement is backed by an up-to-date Status Determination Statement (SDS) supported by an HMRC CEST (Check Employment Status for Tax) assessment.

7. Establish read-only auditor access. Set up a dedicated, permission-restricted auditor role within your digital time tracking platform, enabling direct read-only access to time logs and audit trails without exposing unrelated personnel data or granting modification rights.

The Audit Procedure

1. Formal Notice of Review / Inspection — issued in writing by HMRC or The Pensions Regulator (often via a Schedule 36 Information Notice under Finance Act 2008), setting out the scope, target tax years, and required documentation.
2. Information & Document Request — submission of electronic payroll archives, time sheets, P11D schedules, expense records, and employment contracts.
3. Audit Execution — conducted through digital data analysis, accompanied by on-site interviews with HR managers, payroll administrators, and operational staff.
4. Interim Enquiries & Sampling — formal requests for clarification or deeper sample testing on identified anomalies. All responses should be submitted systematically in writing.
5. Closing Meeting — the lead inspector discusses provisional findings. This represents the primary opportunity to present mitigating evidence, dispute misinterpretations, and correct factual inaccuracies.
6. Formal Determination & Assessment Notices — issuance of the final audit report, followed by statutory assessment notices (such as Regulation 80 determinations, Section 8 NIC decisions, or Notices of Underpayment).

Interacting with the Auditor

• Appoint a single point of contact. Channel all auditor communications and document transmissions through one designated HR/payroll lead to avoid contradictory statements.
• Document every interaction. Keep a detailed log of every question asked, document provided, and discussion held with the inspection team.
• Never speculate. If an answer cannot be verified immediately, state calmly that the documentation will be checked and submitted in writing by an agreed deadline.
• Provide strictly what is requested. Do not volunteer unrequested historical files or extraneous documentation outside the defined scope of the formal inspection notice.
• Engage professional advisers. Involve your employment law solicitor, chartered tax adviser (CTA), or payroll compliance consultant early, especially prior to the formal closing meeting.

After the Audit

No direct appeal lies against an informal observation letter; actionable statutory instruments are the formal assessment notices issued by the regulatory body. Employers have a statutory right to challenge assessments—such as an HMRC Regulation 80 PAYE determination or an NMW Notice of Underpayment—by requesting a formal internal review or lodging an appeal with the First-tier Tribunal (Tax Chamber) or Employment Tribunal within 30 days of the notice date.

More importantly, every compliance finding signals a structural vulnerability in internal HR workflows. By embedding automated compliance safeguards, continuous audit logging, and precise digital time tracking into everyday operations, you permanently mitigate regulatory exposure for future review cycles.

Audit Preparation Checklist

Sources and Legal Bases

Statutory Provisions and Regulations

• Employment Rights Act 1996 (ERA 1996) — Statutory employment rights, wage deductions (s.13), and written particulars of employment
• National Minimum Wage Act 1998 (NMWA 1998) — Statutory minimum wage framework, employer obligations, and enforcement mechanisms
• National Minimum Wage Regulations 2015 (SI 2015/621) — Regulation 59: mandatory 6-year employer record-keeping duty and calculation of working hours
• Working Time Regulations 1998 (SI 1998/1833) — Regulations 9, 10, 11, and 12: record-keeping duties, maximum 48-hour working week, daily rest, and statutory rest breaks
• Income Tax (Earnings and Pensions) Act 2003 (ITEPA 2003) — Taxation of employment income, Benefits in Kind (P11D), expense exemptions, and Off-Payroll Working (IR35 / Chapter 10)
• Social Security Contributions and Benefits Act 1992 & Social Security (Contributions) Regulations 2001 (SI 2001/1004) — Class 1 and Class 1A National Insurance Contributions liabilities and records
• Pensions Act 2008 — Statutory workplace automatic enrolment duties and enforcement powers of The Pensions Regulator
• Finance Act 2008, Schedule 36 — Statutory powers of HMRC to obtain information and inspect employer records

Further Sources

• HMRC Internal Manual: Compliance Handbook (CH) — Standards for HMRC employer compliance checks, information notices, and penalty frameworks
• HMRC National Minimum Wage Manual (NMWM) — Technical guidance on working time calculation, deductions, and enforcement policy
• The Pensions Regulator (TPR) — Automatic Enrolment Compliance and Enforcement Strategy — Investigation procedures, statutory notices, and penalty regimes
• ECJ Ruling C-55/18 (Federación de Servicios de Comisiones Obreras / CCOO) — European Court of Justice requirement for objective, reliable, and accessible daily working time recording systems

Status of evaluation: August 2026. This article provides general compliance guidance and does not constitute formal legal or tax advice for specific individual circumstances.