How to Prepare for a Policy Audit: A Checklist for Indian HR and Compliance Teams

Most organisations treat policy audits as an event. Something that happens when a regulator shows up, or when a dispute lands on a senior leader’s desk, or when a new compliance officer decides to clean house.

That framing is the problem. By the time an audit becomes an event, the gaps that existed for months or years are already in plain view. The document that was never updated after a legal amendment. The acknowledgment trail that stopped three years ago. The policy that refers to a process the company stopped using long before the last appraisal cycle.

For Indian HR and compliance teams, the stakes are concrete. Labour law in India is not static. The Industrial Relations Code, the Code on Social Security, the POSH Act, the Payment of Gratuity Act, and various state-level standing orders all carry specific documentation and communication requirements. Organisations that cannot demonstrate compliance, not just claim it, face penalties, reputational exposure, and protracted legal proceedings.

This guide gives you a practical, structured checklist to audit your policy environment and close the most common gaps before they become problems.

What a Policy Audit Actually Covers

Before working through a checklist, it helps to understand what auditors and regulators are typically looking for. There are three distinct layers.

The first is existence. Does the policy exist? Is it documented, dated, and accessible? Many organisations have verbal norms that have never been formally documented, or have policies that exist in someone’s email archive but never reached an official repository.

The second is currency. Is the policy current? Does it reflect the applicable law as it stands today, not as it stood when the document was first written? Policy content that was accurate in 2018 may be non-compliant today.

The third is communication and acknowledgment. Has the policy been shared with the employees it applies to? Can the organisation demonstrate that employees received it, read it, and acknowledged it? In most dispute and regulatory contexts, this third layer is where organisations are most exposed, because it is the hardest to reconstruct after the fact.

Phase 1: Policy Inventory Audit

The first step is simply knowing what you have.

Create a master inventory of every policy your organisation currently operates under. This should include employment contracts, the employee handbook, standalone policy documents, and any policy updates issued by circular or notice. For each policy document, record the following: the document name, the date it was created, the date it was last reviewed, the date it was last updated, the version number, who owns it internally, and which employee groups it applies to.

Once you have this inventory, run it against a baseline of required policies for Indian employers. The core list for most organisations includes the following.

A Prevention of Sexual Harassment policy is mandatory for any establishment with ten or more employees under the Sexual Harassment of Women at Workplace Act 2013. This policy must specify the constitution of the Internal Complaints Committee, the grievance redressal process, and the annual reporting obligation.

A standing order or service rules document is required under the Industrial Employment (Standing Orders) Act 1946 for industrial establishments with one hundred or more workers, and under the Central Model Standing Order for other covered establishments. This document governs conditions of service including attendance, leave, termination, and disciplinary procedures.

A maternity benefit policy is required under the Maternity Benefit Act 1961 as amended in 2017, which extended paid maternity leave to 26 weeks for the first two children and introduced creche facility obligations for establishments with fifty or more employees.

A gratuity policy should document the employer’s obligations under the Payment of Gratuity Act 1972, including the eligibility criteria, the calculation formula, the nomination process, and the payment timelines.

A data protection and IT acceptable use policy has become effectively mandatory for any organisation handling employee or customer data, even ahead of formal operationalisation of the Digital Personal Data Protection Act 2023.

Beyond these, sector-specific requirements apply in industries such as banking, insurance, pharma, and IT services, where regulators including the RBI, IRDAI, and SEBI carry their own compliance frameworks.

Flag any policy that is absent, and note any area where no policy exists but one is likely required.

Phase 2: Currency and Accuracy Review

Once you have the inventory, review each policy for legal and factual accuracy.

The most common currency failures in Indian policy audits involve the following.

Gratuity calculations that have not been updated to reflect the current ceiling. The maximum gratuity payable under the Payment of Gratuity Act was enhanced to twenty lakh rupees. Policies that still reference the earlier ceiling of ten lakh rupees are technically incorrect and could create incorrect employee expectations.

POSH policies that do not reflect the current ICC composition requirements or that reference the Local Complaints Committee without specifying when to use it. A significant number of POSH policies circulating in Indian organisations were drafted before the Supreme Court guidelines in Vishaka were replaced by the 2013 Act.

Leave policies that have not been updated to reflect state-specific amendments. Several states have made changes to paid leave entitlements, earned leave encashment rules, and festival holiday obligations in the past three to four years. A policy that reflects central legislation but not your operating state’s amendments will have gaps.

Maternity benefit provisions that predate the 2017 amendment and do not cover the extended leave, work-from-home provisions for eligible employees, or the creche facility obligation.

PF and ESI policies that still reflect contribution rates or wage ceiling thresholds that have since been revised.

For each policy in your inventory, assign it a status: current and accurate, requires update, or requires replacement. For anything flagged for update or replacement, note the specific provision that needs to change and the legislative basis for the change.

Phase 3: Version Control and Documentation Audit

One of the clearest signals of a well-managed compliance function is clean version control across the policy library.

For each policy, confirm the following. There is a single authoritative current version. Previous versions are archived with their dates and the reason for revision noted. The current version carries a version number and a review date. There is a record of who approved the current version and when.

Common failures at this stage include organisations that have two versions of the same policy circulating simultaneously, with neither marked as superseded. This happens frequently after mergers, restructuring, or HR system migrations, where the old policy file was never formally retired.

It is also common to find policies where the review date has passed with no evidence of review having occurred. A policy with a stated annual review cycle and a last-reviewed date of 2021 is, from a compliance standpoint, an unreviewed policy.

Document any version control gaps and flag policies where the approval chain is unclear or undocumented.

Phase 4: Acknowledgment Trail Audit

This is where most Indian organisations have their most significant exposure.

For every policy in your library, determine whether you can produce a record showing which employees have acknowledged which version of each policy and when. In an audit or dispute, you will be expected to demonstrate this for at minimum your current employees and, in some cases, for former employees where a dispute involves conduct during their tenure.

Work through the following questions for each policy.

Can you produce a timestamped acknowledgment record for every current employee? If you rely on paper-based signatures, are those records physically secure, indexed, and retrievable? If you rely on email confirmations, are those emails archived in a retrievable format with metadata intact?

When the policy was last updated, did you re-issue it to all applicable employees and collect fresh acknowledgments for the new version? Many organisations collect acknowledgements at onboarding but have no system for re-acknowledgment when the policy changes.

For employees who joined in the last twelve months, is there a clear record of which policies were presented to them during onboarding, when they were presented, and whether acknowledgment was collected?

Are there employees in your system with no acknowledgment record at all? This commonly happens for long-tenured employees who predate the implementation of any formal acknowledgment process, or for employees in remote locations where onboarding was handled informally.

Map the gaps clearly. The output of this phase should be a view of your acknowledgment coverage across your employee base, segmented by policy, by joining cohort, and if possible, by location.

Phase 5: Communication and Accessibility Audit

A policy that exists and has been acknowledged but cannot be found by an employee when needed is only marginally more useful than one that was never shared at all.

Audit how employees access your current policies. Are policies published on an intranet or internal platform?

Is that platform accessible to all employee groups, including factory floor workers, contract staff who may have limited system access, and employees working in field roles?

Are policies available in the regional languages required by your state-level standing order obligations?

Check whether your POSH policy and ICC details are displayed at visible locations in your office premises. The 2013 Act requires this. A policy that exists in an intranet folder but is not displayed or easily accessible does not fully satisfy the communication requirement.

Confirm whether your grievance redressal mechanism details are communicated to employees separately, not just embedded in a policy document they may not actively consult.

Phase 6: Audit Readiness Pack

Once the above phases are complete, compile an audit readiness pack. This is a structured set of documents you can produce quickly if asked by a labour authority, a statutory inspector, or an internal or external auditor.

The pack should include the current version of every mandatory policy with version dates, the ICC constitution document and annual compliance reports under POSH, a sample acknowledgment record demonstrating what your acknowledgment trail looks like and how it is retrieved, a policy review log showing the date of last review for each policy, and an escalation log showing how overdue acknowledgments or policy concerns are tracked and resolved.

The value of compiling this pack before an audit, not during one, is that the process of assembling it will surface gaps that are much easier to address on your own timeline than under external scrutiny.

The Technology Gap in Indian Policy Compliance

A significant part of the audit vulnerability that Indian HR teams carry comes from managing policy compliance through tools that were not built for it. Shared drives, email chains, and spreadsheet trackers can hold documents and record acknowledgments, but they cannot actively manage the compliance lifecycle.

Policy management software changes this in three material ways.

It creates a single source of truth for every policy version, with automatic version history and audit logs that capture every change, approval, and distribution event.

It automates acknowledgement collection and re-acknowledgment when policies are updated, with configurable deadlines and escalation triggers when employees miss them.

It produces audit-ready reports at the click of a button, showing acknowledgment status across the organisation by policy, by department, by location, and by employee tenure.

For HR and compliance teams managing this workload manually, the shift to a dedicated system represents a meaningful reduction in both administrative burden and compliance risk.

A Final Note on Frequency

A policy audit is not a one-time exercise. The Indian regulatory landscape moves often enough that a policy library that is fully compliant today may develop gaps within twelve to eighteen months without active management.

Building a standing review calendar, quarterly for high-risk areas like POSH and gratuity, annually for the full library, with ownership assigned to specific individuals in HR or legal, is the difference between organisations that manage compliance and those that react to it.

If you want to see how PolicyCentral.ai supports policy audit readiness, version control, and acknowledgment tracking across your employee base, request a demo today.

Frequently Asked Questions