Skip to content
VettedPad
Menu

HR Compliance Checklist for Small Employers

A hiring compliance checklist for the whole program, not one hire: the job ad, the application, background screening, the offer, Form I-9 and E-Verify, the records you keep and the posters on the wall. Enter your headcount and the list shows only the federal lines that apply at your size, each with its cite, then tracks your progress and prints as one sheet for the file.

Use the tool

10 of 26 done for 22 employees

See what is open

Pre-filled with an example: a 22-person employer that orders background reports, part way through. Set your own headcount and answers, then tick what your process already does.

Count everyone on the payroll for each working day in 20 or more calendar weeks this year or last, the way Title VII, the ADEA and the FMLA count.

01Job posting

0 of 2 done

Before the ad goes up.

  • Pay-range rules for job ads come from states and cities, and they differ on who is covered and what the ad must show.

    State and local lawPay transparency laws by state

  • ADEA employers keep advertisements and notices about job openings, and job orders sent to an employment agency, for one year from the personnel action they relate to.

    20+ employees29 CFR 1627.3(b)(1)(iii), (vi)

02Application

0 of 2 done

What the form and the interview may ask.

  • A growing number of states and cities bar conviction questions on the application. California (five or more employees) and New York City (four or more, per its guidance) wait until after a conditional offer.

    Cal. Gov. Code § 12952; NYC Admin. Code § 8-107(11-a)Ban-the-box laws by state

  • A covered employer may not ask an applicant whether they have a disability or about its nature or severity before an offer. It may ask whether they can perform job-related functions.

    15+ employees42 U.S.C. § 12112(d)(2)

03Background screening

2 of 6 done

Only if you order background reports from a screening firm.

  • The disclosure sits in a document that “consists solely of the disclosure”; the signature for permission may sit on that page. The FCRA has no headcount floor.

    15 U.S.C. § 1681b(b)(2)(A)Build the disclosure

  • You certify that you gave the disclosure, got written permission, will follow the adverse-action steps, and will not use the report against equal employment law.

    15 U.S.C. § 1681b(b)(1)

  • EEOC guidance names three factors: the nature and gravity of the offense, the time that has passed, and the nature of the job. It is guidance under Title VII, not a statute.

    15+ employeesEEOC Enforcement Guidance No. 915.002 (2012), § V.BIndividualized assessment

  • Give a copy of the report and the CFPB’s A Summary of Your Rights Under the Fair Credit Reporting Act (the March 2023 version, required since March 20, 2024).

    15 U.S.C. § 1681b(b)(3)(A)Adverse action letter

  • Federal law sets no fixed number of days. A 1997 FTC staff letter called five business days reasonable, which is common practice; some states and cities set longer windows by law.

    15 U.S.C. § 1681b(b)(3)(A); FTC staff letter (1997)Adverse action timeline

  • It names the screening firm and how to reach it, says the firm did not make the decision, and tells the person they can get a free copy within 60 days and dispute anything wrong.

    15 U.S.C. § 1681m(a)Adverse action notice

04Offer

1 of 2 done

Between the offer and the first day.

  • An offer may be conditioned on a medical exam if all entering employees in the job take it regardless of disability, and the results are kept on separate forms in separate medical files.

    15+ employees42 U.S.C. § 12112(d)(3)

  • The employee completes Section 1 no later than the first day of employment, and you may not ask someone who has not accepted an offer to complete it.

    8 CFR 274a.2(b)(1)(i)(A); M-274 § 3.0Form I-9 employer guide

05Form I-9 and E-Verify

2 of 5 done

Every hire, every employer; E-Verify lines only if you use it.

  • The current edition is dated 01/20/25; USCIS also accepts the 08/01/23 edition that expires 05/31/2027. The form is kept, never filed with USCIS.

    USCIS Form I-9 page; 8 CFR 274a.2(a)(2)

  • Examine the documents and complete Section 2 within three business days of the hire: start Monday, finish by Thursday.

    8 CFR 274a.2(b)(1)(ii)I-9 deadline calculator

  • Asking for more or different documents than the rule requires, or refusing documents that reasonably appear genuine, is an unfair immigration-related employment practice when done to discriminate.

    4+ employees8 U.S.C. § 1324b(a)(1), (a)(6)I-9 document checker

  • Reverify by the date the work authorization expires. Green Cards, U.S. passports and List B IDs never trigger reverification.

    8 CFR 274a.2(b)(1)(vii); M-274 § 6.0Reverification calculator

  • A self-audit is practice, not a rule. Paperwork violations cost $288 to $2,861 per form.

    8 CFR 274a.10(b)(2)I-9 audit checklist

06Records

2 of 5 done

What you keep, for how long, and how it goes.

  • Keep a former employee’s form until three years after hire or one year after their last day, whichever is later. An inspection comes with at least three business days’ notice.

    8 CFR 274a.2(b)(2)(i)(A), (b)(2)(ii)I-9 retention calculator

  • FLSA employers keep payroll records at least 3 years from the last entry, and time cards and wage rate tables at least 2 years.

    29 CFR 516.5(a), 516.6(a)

  • Any personnel or employment record, applications and other hiring records included, is kept one year from the date it was made or the personnel action, whichever is later. A discrimination charge extends that.

    15+ employees29 CFR 1602.14

  • ADEA employers keep payroll records with each employee’s name, address, date of birth, occupation, rate of pay and weekly compensation for 3 years.

    20+ employees29 CFR 1627.3(a)

  • The FTC tells employers to securely dispose of a report and anything gathered from it: shred paper, make files unreadable. Check your EEOC and state record-keeping rules before you do.

    FTC, Using Consumer Reports: What Employers Need to Know

07Posters

3 of 4 done

On the wall, or online where the rule allows.

  • Employers covered by the federal minimum wage post the Wage and Hour Division’s notice in a conspicuous place at every establishment.

    29 CFR 516.4Labor law poster requirements

  • Each employer posts OSHA’s notice in each establishment where notices to employees are customarily posted, and keeps it from being covered or defaced.

    29 CFR 1903.2(a)(1)

  • Every employer subject to the EPPA posts the notice where employees and applicants can readily see it.

    29 CFR 801.6

  • Title VII, ADA, GINA and PWFA employers post the EEOC’s notice where employees and applicants can see it. Failing to post can be fined up to $698 per separate offense.

    15+ employees29 CFR 1601.30(a)–(b)

Federal items done for 22 employees

10 of 26

8 U.S.C. § 1324b(a)(2)(A); 42 U.S.C. §§ 2000e(b), 12111(5)(A); 29 U.S.C. § 630(b); 29 CFR 825.104(a), 1602.7

Job posting 0/2, Application 0/2, Background screening 2/6, Offer 1/2, Form I-9 and E-Verify 2/5, Records 2/5, Posters 3/4

  1. Job posting: Check your state and city for a pay-range rule before the ad goes up
  2. Job posting: Keep every job ad and job order for one year
  3. Application: Check the application against ban-the-box rules where you hire
  4. Application: No disability or medical questions before an offer
  5. Background screening: Weigh criminal records case by case, not by blanket rule
  6. Background screening: Send the pre-adverse notice before deciding against anyone because of a report
  7. Background screening: Wait a reasonable period before the final decision
  8. Background screening: Send the final adverse action notice as a second, separate letter
  9. Offer: Medical exams only after the offer, and for everyone entering the job
  10. Form I-9 and E-Verify: Let the employee choose which documents to show
  11. Form I-9 and E-Verify: Diary work authorization expiry dates and reverify on Supplement B
  12. Form I-9 and E-Verify: Audit your own Forms I-9 before anyone else does
  13. Records: Keep applications and hiring records one year
  14. Records: Keep age-related payroll data three years
  15. Records: Shred background reports when you dispose of them
  16. Posters: Employee Polygraph Protection Act poster

Next federal threshold, 50 employees: Family and Medical Leave Act (3 more lines).

Starts as you grow

  • 50+Give every new hire the FMLA general notice29 CFR 825.300(a)(3)
  • 50+Keep FMLA records three years29 CFR 825.500(b)
  • 100+File the EEO-1 report every year29 CFR 1602.7
  • 50+FMLA poster, even with no eligible employees29 CFR 825.300(a)(1)–(2)
The rule

This checklist applies the federal rules as written, at the headcounts the statutes set. It is not legal advice, and state and city law may add steps or start at smaller sizes.

Coloured pencil drawing of a corkboard with blank sheets pinned in a row
Blank sheets pinned in a row, one held by a blue pin.

What it computes

The checklist holds 34 federal lines across 7 stages of the hiring path, from the job ad to the poster wall. Three answers decide which lines are yours: your headcount, whether you order background reports, and whether you use E-Verify. Each line carries the rule that creates it and the headcount where it starts.

It checks your program, the controls that hold for every hire. To walk one new employee from offer to day 90, use the new hire checklist instead.

FromWhat startsCite
1+FCRA hiring steps, Form I-9, FLSA, OSHA and EPPA posters15 U.S.C. § 1681a(b); 8 CFR 274a.2
4+INA ban on citizenship and national-origin discrimination in hiring8 U.S.C. § 1324b(a)(2)(A)
15+Title VII and the ADA42 U.S.C. §§ 2000e(b), 12111(5)(A)
20+Age Discrimination in Employment Act29 U.S.C. § 630(b)
50+Family and Medical Leave Act29 CFR 825.104(a)
100+EEO-1 report (Title VII employers)29 CFR 1602.7
Federal headcounts read from the U.S. Code and eCFR, October 23, 2026.

How the statutes count

Title VII covers an employer “who has fifteen or more employees for each working day in each of twenty or more calendar weeks in the current or preceding calendar year.” The ADA uses the same test at 15, the ADEA at 20, and the FMLA at 50 “for each working day during each of 20 or more calendar workweeks.” A business that crossed a line last year is still covered this year.

The rule

Two lines ignore headcount. The FCRA's hiring steps apply to any employer that orders a background report, a one-person business included. And public agencies and elementary and secondary schools are FMLA employers whatever their size.

15 U.S.C. § 1681a(b); 29 CFR 825.104(a)

From four employees the INA bars discrimination in hiring because of citizenship status or national origin; from 15, national-origin claims move to Title VII and the INA keeps citizenship status (8 U.S.C. § 1324b(a)(2)). Our FCRA rules for employers and poster requirements guides go deeper on the screening and poster stages, and the HR compliance software compare shows which tools keep these records for you.

Penalty

A missing EEOC poster can be fined up to $698 per separate offense. Form I-9 paperwork violations cost $288 to $2,861 per form.

29 CFR 1601.30(b); 8 CFR 274a.10(b)(2)

Worked example

Four employers, the same checklist. The café has the short list: the FCRA steps, Form I-9 and the posters every employer puts up. At 22 the contractor picks up the ADA's medical-question rules, the EEOC poster, the one-year hiring records and the ADEA's ad and payroll records. The clinic does not screen, so the FCRA lines drop out, but E-Verify and the FMLA add theirs.

EmployerFederal linesNext threshold: lines added
Café, 3 employees, background reports, no E-Verify184: +1
Contractor, 22 employees, background reports, no E-Verify2650: +3
Clinic, 60 employees, no background reports, E-Verify26100: +1
Distributor, 100 employees, both34None above
Counts computed by the checklist above from its own data.

The pre-filled example is the contractor, with the screening consent, the I-9 basics, payroll retention and three posters already ticked. Untick everything to start your own run, then print the sheet for the file.

State notes

  • Federal
  • CA
  • NY
  • NYC

State and city rules often start below the federal headcounts. A few that change this checklist:

  • California: employers with five or more employees wait until after a conditional offer to look at conviction history (Cal. Gov. Code § 12952), and train staff on sexual harassment every two years, one hour for employees and two for supervisors (Cal. Gov. Code § 12950.1). See the California Fair Chance Act guide.
  • New York State: every employer gives all employees interactive sexual harassment prevention training every year (N.Y. Labor Law § 201-g).
  • New York City: criminal history only after a conditional offer, and at least five business days for the applicant to respond (NYC Admin. Code § 8-107(11-a)). See the NYC Fair Chance Act guide.
  • Pay ranges in ads, ban-the-box and mandatory E-Verify are state and city rules: check pay transparency, ban-the-box and E-Verify by state.

Keep reading