E D I T E D BY D O U G L A S

ZIEGENFUSS

RESEARCH CONNECTION

The Human Resources Audit

Adding HR to the
regular audit cycle can
help ensure major risks
aren't overlooked.
BY KELLI W. V I T O

RENDS IN HUMAN RESOURCES {HR) tests that arc invalid or illegal, and documanagement often find their way into the menting inappropriate reasons for selection
headlines, forcing organizations to take or nonselection. Supervisors should not be
notice of their potential risks. Some recent asking applicants questions related to their
issues include executive management race, gender, religion, marital status, disethics, skyrocketing health-care costs, abilities, ethnic background, or country of
employee fraud, and MR outsourcing.
origin. U.S. organizations should be careful
Other risks associated with HR include not to develop hiring tests that vi(jlate the
noncomphance with employment laws, Equal Employment Opportunity Commisinadequate compensation and benefit sion's 4/5ths rule in minorities hired.
plan design, not maintaining appropriate
In reviewing the organization's structure,
staffing levels, and poor record keeping. auditors should look for red Hags such as
Despite all of these risks, internal audi- first-line supervisors with spans of control
tors have only recently begun to consider too great to he practical; middle managers
regularly auditing the HR function.
with lines of authority over only one other
Auditors may be surprised at the broad manager, and chains of command that are
scope of HR issues to review. A com- not clearly designated or that reflect mulprehensive HR audit includes the main tiple, conflicting reporting relationships.
functional areas of workforce planning, Problems in this area can result in conflicts
employee development, compensation and between departments, inefficiencies, inabilbenefits, employee and labor relations, and ity to keep up with customer demands, and
risk management.
low employee morale.
In organizations that hire contractors,
WORKFORCE PLANNING
auditors should ensure controls are in place
A common definition oi workforce plan- to monitor these individuals or pnividers. In
ning is "to have the right number of peo- the United States, contractor duties should
ple, with the right skills, at the right time be routinely monitored to ensure they meet
to perform the required work." An audi- Internal Revenue Service requirements for
tor reviewing workforce-planning efforts contractor versus employee status.
should focus on whether HR is performing
HR also has a vital role in analyzing
adequate analyses and developing action employee turnover. Auditors can review
plans to ensure the organization is not left turnover analysis and the exit interview
with a shortage of qualified workers.
process to determine whether high turnHR departments often spend significant over is putting a strain on recruiting
time recruiting and selecting job candi- efforts and work productivity and whether
dates. Auditors should assess whether management is appropriately addressing
HR is documenting applicant informa- issues raised by exiting employees.
tion accurately and timely and whether
records are current. Auditors should also EMPLOYEE DEVELOPMENT
verify that HR is using suitable recruiting Training is notoriously one of the first
sources that are capable of furnishing ade- programs to he cut in a budget crunch.
quate numbers of qualified applicants.
However, a decrease in training can have
Risks associated with the inter\aew pro- a direct impact on performance and ulticess include permitting untrained managers mately on an organization's bottom line.
to ask illegal questions, requiring applicant Auditors should assess whether HR is
APRIL 2 0 0 8 I N T E R N A L

AUDITOR

RESEARCH

CONNECTION

monitoring training needs and making

adjustments, offering the appropriate
level of training for different positions,
and conducting cost-benefit analysis for
training programs.
One of the greatest risks an organization
can face is supervisors who are not trained
in employment law or how to manage their
siihordinates' performance. When auditing
the employee performance management
system, auditors should assess whether
appraisals are done timely, are based on
job-specific criteria, and do not document
information that could be considered
discriminatory. Ineffective performance
management systems can result in a lack
of good informal feedback from managers
to employees, minimal employee development, and low employee engagement levels
affecting organizational productivity.
There are also risks associated with
employee counseling and discipline. Auditors should verify that management documents performance problems and actions
taken, including acknowledgement that
the employee was made aware of the problem. This is important because disciplined
employees may file an internal grievance

or external complaint or lawsuit. Management's documentation should include support for the decision made because it could
become subject to further scrutiny.
COMPENSATION AND BENEFITS

Employee reward systems, including all

compensation and benefits programs, are
one of the most complex HR systems. A
reward system should help support the
organization's strategic mission, motivate
employees, and reward performance. Compensation systems should be both externally
competitive and provide internal equity.
Auditors may want to work with a compensation expert when reviewing this area.
During the audit, auditors should ensure
that: a compensation philosophy has been
developed that defines how the organization
wants to pay people with respect to its position in the labor market; there are current
job descriptions for each position; an effective market analysis has been conducted; a
salary structure has been developed to help
manage pay; and an appropriate job evaluation system is being used to slot jobs into
the salary structure. A review ot the organization's salary administration process is also

SOX Tested
QAR Accredited
Independent; to
ensure you receive
unbiased results

PRI AUDIT & CONTROL

Providing internal audit services and
staffing support worldwide since 1984.
We are big enough to be competitive,
but small enough to care.

www.priaudit.com
ChJcago-lndianapolis-South Bend-Nashville
New Orieans-Antwerp Belgium

(574) 237-0877-(800) PRI-2003

pni Is a division of Professional Resources International

INTERNAL

AUDITOR

APRIL

2008

important to determine how employees are

paid throughout their careers, including
merit increases, variable performance pay,
promotions, bonuses, stock options, and
deferred compensation, to name a few.
A key area of risk for U.S. organizations
is appropriately complying with the Fair
Labor Standards Act (FLSA) regarding
overtime pay. Organizations must correctly classify each position as nonexempt
(subject to overtime pay) or exempt (not
subject to overtime pay). In addition, they
must correctly calculate overtime pay for
nonexempt employees. A review of the
payroll function should ensure that new
hires, personnel actions, work hours, and
differential pay are efficiently processed so
that paychecks are accurate and processed
timely. Auditors should verify controls to
ensure that the confidentiality of personnel
data is maintained, addifions to base pay are
appropriately calciJated and authorized, full
compliance with tax and other deductions is
made, terminating employees' payrolls are
processed appropriately, and payroll costs
are in line with budgeting objectives.
On the benefits side, employee benefit
programs often include medical insurance.

RESEARCH

life insurance, vacation and leave policies,

and some form of orgimization-sponsored
retirement or savings plan. Factors to consider in auditing benefit plans are external competitiveness, cost effectiveness,
management goals, employee needs, and
compliance with state and federal laws. In
addition to beingfinanciallyburdensome,
poorly designed benefit plans may not support an organization's strategies.
EMPLOYEE AND LABOR RELATI0N5

Much of HR administration deals with the

processes related to managing employees
throughout their careers with the organization. There are several employment
risks to consider, including discrimination,
harassment, wrongfiil discharge, negligent
biring, retention, and employee privacy.
Internal auditors should ensure that HR:
I las comprehensive policies and
procedures that are compliant with
employment regulations and reflect
best practices.
Conducts employee attitude surveys and
takes action based on survey results.
Miunt;uns appropriate employment files
for each employee, including separate

files that document demographic and

medical infonnation.
How an organization handles employee
complaints and grievances is an area where
a clear audit trail is necessary. Documentation should include the date, situation, and
nature of the grievance or complaint; the
action management has taken; any investigation results; and the final outcome or
settlement. If an organization has a labor
agreement, then policy changes, attitude
surveys, and employee complaints and
grievances have an added element of review
and negotiation.

CONNECTION

prevention and control measures, and

thorough training are provided. HR should
establish controls to minimizerisk,including succession planning, adequate severance and outplacement services, executive
coaching and development, thorough HR
handbooks, documented employee hiring,
training and termination procedures, and
internal employee surveys.
AN OVERLOOKED AUDIT AREA

Despite its integral role, MR has often been

considered a "soft" area, and management
may not understand the inherent risks
involved with this function. Adding an
RrSK MANAGEMENT
HR audit to an organization's regular audit
According to the Society for Human cycle pro\ades important risk coverage that
Resource Management, the "people risk" may have been previously overlooked.
is exposing organizations to more liability
than traditional areas of risk management.
With the surge in worker's compensation KELLI W. VITO. SPHR, CCP, is the principal of
expenses, discrimination violations, and KV Consulting, a human resources consulting
other compliance issues, the risk function is firm based in Austin. Texas, and the author
overlapping with safety and IIR more than of Auditing Human Resources from The IIA
ever. Auditors' review of the organization's Research Foundation Handbook Series (2007).
safet)' and health program should focus
on whether work-site analyses to identiiy To comment on this article, e-mail the author
hazards and potential hazards, stringent at kelli.vito@theiia.org.

The Auditor's Choice

To expose suspected errors

M
M
M

WizRule

business rules detector

To reveal similar or identical records

\ou ik-scnf murketinf; s

SSS WizSame

your [lotcntiji through:

Partnership Program - lilnjoy

(.nntafl w i l h I I A niemhers.

. r i ^ duplicate rccord.s di.scoverv

Conference Exhibits & Sponsorships \k'cl \(iiii i.-usinnK'i"^ livt' iind in person.
Print and Online Advertising Get your
message read by affluent, well-traveled
decision makers.

To match one-to-many and many-to-many

WtjWizCounf

IIA niiirke! ing s o l u t i o n s w o r k - ("or you!

^ ^ ^ B f l bank/account reconciliation

Contact us today at adverttsJng@theiJa.org

or+1-407-937-1109.
08314

for a live online demonstration visit www.wizsoft.com

WizSofr
makes a difference
(516)393-5841 info@wizsoft.com

APRIL 2008

INTERNAL

AUDITOR