.png)
What Does an HR Compliance Audit Cover for India Teams?
- Saransh Garg
- 2 days ago
- 8 min read
Under India's POSH Act, any organisation employing 10 or more people must set up a registered Internal Committee, even for a fully remote team, or risk a penalty starting at ₹50,000. We have audited more than 60 India based teams for global employers over the last three years, and this one clause alone catches out more foreign companies than any other. A proper HR compliance audit cover for India teams usually spans nine statutory areas, from provident fund contributions to data privacy, and most first time audits come back clean on two or three of them and exposed on the rest.
What Does an HR Compliance Audit Cover for India Teams?
An HR compliance audit cover for India teams typically checks nine areas: entity registration, PF and ESI contributions, employment contracts and worker classification, POSH compliance, bonus and gratuity provisioning, termination and exit processes, data privacy obligations, and statutory recordkeeping. For most global employers, the audit isn't a paperwork exercise. It's the process that tells you whether your India team's payroll, contracts, and workplace policies would survive an actual labour inspection.
Companies with a GCC or an India entity that has grown quickly tend to have the widest gaps, because compliance ownership rarely keeps pace with headcount growth. A team that started with 12 people and a single HR policy document often reaches 100 people without anyone revisiting whether that original setup still holds up. That gap is exactly what a compliance audit is built to find before a regulator does.
Contract Hiring vs Full Time Hiring: How Compliance Obligations Differ
This distinction matters more than most global HR teams realise.
Under contract hiring in India, the worker is typically engaged through a staffing partner or as an independent consultant, and statutory obligations like PF, ESI, and gratuity generally sit with the staffing entity rather than the client company, provided the engagement genuinely reflects a contractor relationship.
The problem is that many companies keep someone on contract terms for a year or more while treating them exactly like an employee: fixed hours, direct supervision, company equipment, no other clients. Indian labour law applies what's called the control test here, and once that test is met, the worker is functionally an employee regardless of what the contract says. That reclassification brings full-time hiring obligations, including PF, gratuity, and statutory notice pay, applied retroactively.
Full time hiring, by contrast, brings clear obligations from day one: PF and ESI enrolment where applicable, a compliant appointment letter, leave and gratuity accrual, and inclusion in the company's POSH and grievance framework. An HR compliance audit cover for India teams checks both categories separately, because the risk profile and the fix are completely different for each.
Which Indian Laws Fall Under an HR Compliance Audit?
India doesn't yet have a single unified labour code fully in force everywhere. The four new Labour Codes on Wages, Industrial Relations, Social Security, and Occupational Safety have been passed nationally but are being rolled out state by state, so most audits today still check against the older statutes layered together.
The core laws every audit reviews:
Shops and Establishments Act (state specific, such as the Karnataka or Delhi versions), governing office registration, working hours, and leave.
Employees' Provident Funds Act, 1952, mandatory once headcount crosses 20, with 12% employer and 12% employee contribution on basic wages up to the statutory ceiling.
Employees' State Insurance Act, 1948, applying to employees earning up to ₹21,000 a month gross.
Payment of Gratuity Act, 1972, triggered after five years of continuous service.
Payment of Bonus Act, 1965, frequently missed by foreign employers who assume it's optional.
POSH Act, 2013, requiring a registered Internal Committee and an annual filing.
Most companies assume that moving India staff onto an Employer of Record (EOR) automatically resolves all of this. It manages ongoing statutory compliance going forward, but it does not retroactively fix contractor misclassification or a missing POSH committee that predates the arrangement. Every one of these laws needs to be checked person by person, not assumed at the arrangement level.
HR Compliance Audit Checklist for India Teams
This table is the core of any HR compliance audit cover for India teams. Use it as a quick self check before commissioning a formal audit.
Compliance Area | What Gets Checked | Common Gap Found |
Entity registration | Shops and Establishments certificate, PAN and TAN | Certificate not updated after office relocation |
PF and ESI | Monthly challans, wage ceiling application | Ceiling applied inconsistently after bonuses |
Contracts and classification | Appointment letters, contractor agreements | Long tenure contractors functioning as employees |
POSH compliance | Internal Committee formation, annual filing | Committee formed once, never refreshed |
Bonus and gratuity | Eligibility checks, balance sheet provisioning | No gratuity provision recorded at all |
Termination and exit | Full and final settlement calculations | Leave encashment miscalculated |
Data privacy | DPDP Act readiness, processing agreements | No consent or processing records in place |
Recordkeeping | Statutory registers, wage and attendance logs | Records kept in non prescribed format |
If your team is missing even three of these, it's worth talking to our team about scoping a full audit before it turns into a labour inspection finding.
How the Audit Process Works and What We Found in a Real Case
At AnjuSmriti Global, our compliance audit runs on a three week cycle. Week one covers document collection, including payroll registers, PF and ESI challans, appointment letters, and POSH records. Week two is verification, where we interview the local HR lead and cross check what's on paper against what's actually happening. Week three delivers the gap report, ranked by financial exposure rather than alphabetically.
One case shows why this matters. A US healthtech company had built a 45 person GCC in Pune over two years, mixing direct hires with long term contractors sourced independently. On audit, twelve engineers turned out to be classified as contractors for 14 to 22 months while working fixed hours under an India based manager, a textbook case of the contract hiring versus full time hiring line being crossed without anyone noticing. The back pay exposure on PF alone came to roughly ₹38 lakh once interest and damages were modelled in.
What almost went wrong: one of the twelve had crossed the ESI wage ceiling three months into the engagement and should have moved out of eligibility, a detail buried in an outdated spreadsheet formula. We caught it on a second verification pass, which is why every audit we run includes two passes rather than one. The client converted all twelve to a compliant arrangement within six weeks and restructured their hiring process so no one crosses six months on contractor status without a formal review.
What Compliance Costs, and What's Changing in India Hiring
For a 30 to 80 person India team, a full HR compliance audit cover for India teams typically runs ₹2.5 to 5 lakh, a one time cost scoped by headcount and entity complexity. PF and ESI employer contributions add roughly 15.5% on top of gross salary, gratuity provisioning adds about 4.81% of basic wages accrued annually, and contractor to employee remediation typically costs ₹1 to 5 lakh per misclassified head depending on tenure.
Hiring patterns are shifting fast right now. AI and cloud infrastructure roles are pulling GCC growth into tier two cities as much as Bengaluru and Pune, which means compliance frameworks built for a single city office no longer cover the full team. More clients are also folding DPDP Act readiness directly into their HR compliance audit rather than treating data privacy as a separate exercise, since GCC teams increasingly handle customer data directly.
And contractor to employee conversion remains the single most common item we close out for teams scaling past 30 people in India, as more companies formalise hybrid contract and full time structures instead of defaulting to one or the other.
If your India team has grown without a formal audit in the last two years, the gap is very unlikely to be zero. The only real question is how large it is, and whether you find it before an inspector does. Reach out to AnjuSmriti Global here and we'll scope what an audit looks like for your team's exact size and setup.
Interesting Reads:
FAQs
1.Does an HR compliance audit check contractors as well as full time staff?
Yes, and it should be one of the first things reviewed. Indian law applies a control test: if a contractor works fixed hours, uses company equipment, and reports to a manager continuously, they may legally count as an employee regardless of the contract wording. Audits review every contractor engagement individually rather than relying on the paperwork alone, since misclassification exposure compounds the longer it's left unaddressed and can turn into a significant back pay liability.
2.What's the difference between an audit and switching to an Employer of Record (EOR)?
An EOR manages statutory compliance going forward for employees on its books, covering PF, ESI, and standard contracts once the arrangement begins. It doesn't retroactively fix gaps that already existed before that, such as misclassified contractors or a missing POSH committee. An audit is what identifies those older gaps so they can be resolved before or alongside the EOR transition, rather than carried forward unnoticed.
3.How often should a foreign company run an HR compliance audit cover for India teams?
We recommend a full audit once headcount crosses 20 employees, since that's the threshold triggering mandatory PF registration, then an annual review after that point onward. Teams growing quickly, or converting several contractors to full time roles within a short window, should audit sooner, since ESI and bonus eligibility thresholds can be crossed mid year without payroll teams noticing until reconciliation.
4.Does POSH apply if our India team has no physical office?
Yes. The requirement is tied to headcount, not to having a physical workplace. Once you cross 10 employees in India, a registered Internal Committee is required regardless of whether the team works remotely, from a co working space, or on a client site. This is one of the most commonly missed obligations among remote first teams, largely because founders assume office based rules don't apply to them.
5.How far back can PF or ESI liability be claimed during an audit?
There's no fixed cap on the lookback period. In cases of sustained non compliance, dues can be claimed back several years with interest and damages compounding the whole time. This is exactly why contractor misclassification becomes far more expensive the longer it continues, since an eight month gap is manageable to fix but a three year gap on the same role can multiply the liability many times over.
6.What documents should we prepare before commissioning a compliance audit?
At minimum: the last 12 months of PF and ESI challans, a sample of appointment letters across seniority levels, contractor agreements for anyone engaged over three months, exit settlement records, and POSH Internal Committee minutes. Companies that can produce all of this cleanly and quickly usually have fewer material gaps than companies that struggle to locate even one of these categories on request.
7.Do GCCs face different compliance requirements than smaller remote teams?
GCCs with 100 or more employees typically face more scrutiny around Factories Act applicability for any hybrid or on site component, plus more complex bonus and gratuity provisioning across multiple pay bands. Smaller remote teams under 30 people usually carry simpler exposure, concentrated mainly in PF and ESI threshold errors, but proportionally higher risk per employee since there's often no dedicated HR function catching mistakes early on.
8.Does compliance liability apply even if our India staff are employed through an EOR?
Statutory compliance for EOR employed staff sits legally with the EOR, but the operational and reputational risk of any failure still lands on your company's name, not the vendor's. That's why periodic independent audits are worth running even for teams fully managed through an EOR, simply to confirm the compliance work is actually being executed correctly on the ground rather than just assumed from a services contract.
Comments