Central finding: An employee record audit should test the record type, owner, approved location, access, retention rule, legal hold status, and review date rather than only confirming that a file exists [Source: U.S. Department of Labor workplace guidance].
Select the sample by record group
Include one onboarding record, one payroll or benefits record, one leave record, and one separation record. Record the sample rule and the roles [Source: U.S. Department of Labor workplace guidance].
A sample of only active files will not test retention or disposal. Include one record approaching its review date.
Check access and location
Record the approved location, the access group, the owner, and the last access review. A record in a personal drive is not a controlled record [Source: NIST Cybersecurity Framework].
A legal hold or investigation changes the disposal path. Record the hold status and the legal owner.
Test the retention rule
For each record, record the applicable rule, the review date, and the disposal evidence. Do not assume one rule applies to every record type [Source: SHRM records guidance].
A record that passed its date without a review is an open item. It is not automatically disposable.
Report findings by cause
Classify findings as missing owner, wrong location, access gap, rule gap, hold gap, or review date gap. Use the cause to decide whether the fix belongs to the template or the process [Source: SHRM records guidance].
The audit is a local control, not a legal conclusion. Legal and compliance owners decide the applicable rule.
Method note
We reviewed the public sources listed below and translated recurring operational ideas into questions for workflow ownership, source evidence, review, and escalation. This is operational guidance, not legal advice.