Inheriting a Broken HR Compliance Stack: The Privilege-Wrapped First 30-Day Triage Runbook

Day 1 Gate: Stop Typing Findings in Slack and Wrap the Audit Under Upjohn Privilege

An eager new HR Director's biggest enemy in Week 1 is her own keyboard. Documenting statutory violations in unprivileged emails or spreadsheets manufactures plaintiff Exhibit A before leadership even approves a remediation budget.

You just started on Monday as the first experienced Head of People at a fast-growing 120-person company. By Wednesday afternoon, opening three folders makes your stomach drop. Half the active employees have no Form I-9 on file. Seventeen $52,000 customer-onboarding coordinators are paid salaried-exempt with zero timekeeping despite working 48-hour launch weeks. Three biweekly 401(k) payroll deductions sat in the corporate checking account for six weeks when the Controller went on vacation. And two employees have been out on handshake "unlimited medical leave" for five months with zero FMLA or COBRA paperwork.

Freeze your fingers before typing "Urgent: found massive FLSA and I-9 violations!" into Slack or a Notion page. Look at the federal discovery math under the Fair Labor Standards Act. Ordinarily, unpaid overtime recovery spans two years under 29 U.S.C. § 255(a), and an employer can seek relief from double liquidated damages by proving good faith under 29 U.S.C. § 260. However, if a plaintiff subpoena uncovers an unprivileged HR audit spreadsheet flagging Roles X, Y, and Z as "misclassified / illegal"—and the CFO delayed fixing them for two quarters—that spreadsheet proves willful knowledge, extending back-pay liability to 3 years, locking in 100% liquidated damages (2x back pay), and exposing decision-makers to personal liability as mapped in our HR personal-liability statute guide.

Before auditing a single payroll row in people operations, spend 30 minutes on Day 2 getting CEO/CFO sign-off on a written Counsel-Directed Compliance Audit Engagement with outside employment counsel under Upjohn Co. v. United States, 449 U.S. 383 (1981):

1. Counsel directs the audit for legal advice: Outside (or in-house) legal counsel formally requests that HR gather factual payroll, I-9, and benefits data for the primary purpose of rendering legal advice to the company—never as a routine business operations project.
2. Segregated privileged workspace: Store working worksheets exclusively in a restricted folder shared only between Counsel, HR, and essential executive decision-makers, clearly headed PRIVILEGED & CONFIDENTIAL — PREPARED AT DIRECTION OF LEGAL COUNSEL FOR LEGAL ADVICE. (Note: underlying primary records like raw pay stubs and I-9s are never privileged, whereas counsel-directed legal analysis spreadsheets and remediation options memos are!)

Days 5 to 12: Fixing Unremitted 401(k) Deferrals Under 29 CFR § 2510.3-102 & DOL's VFCP

Fix late 401(k) employee payroll deductions first because withheld wages become ERISA plan assets the earliest day they can reasonably be segregated. Sitting on employee deferrals is a prohibited fiduciary loan to the employer—and Form 5500 forces public self-reporting.

Why do 401(k) deferrals jump ahead of handbooks and performance reviews in Week 1? Because you have to tattle on yourself every year on IRS/DOL Form 5500 (Schedule H or Schedule I, Line 4a): "Did the employer fail to transmit to the plan any participant contributions within the time period described in 29 CFR 2510.3-102?" Checking "Yes" without a proper correction triggers Department of Labor Employee Benefits Security Administration (EBSA) audit letters; checking "No" falsely is a federal felony under 18 U.S.C. § 1027.

Check the exact clock in 29 CFR § 2510.3-102. Critics often quote "the 15th business day of the following month," misreading the statutory ceiling as a safe harbor. It is not! The regulation requires remitting employee 401(k) deferrals and loan repayments on the earliest date on which such amounts can reasonably be segregated from the employer’s general assets:

• Plans under 100 participants: Enjoy an explicit 7-business-day safe harbor under § 2510.3-102(a)(2).
• Plans with 100+ participants: Have zero 7-day safe harbor; if your payroll system routinely remits deferrals in 2 business days on 22 pay runs and takes 9 business days on 2 pay runs, EBSA treats those 2 nine-day runs as delinquent prohibited transactions!

Remediate delinquent deposits immediately using the DOL’s updated Voluntary Fiduciary Correction Program (VFCP) Self-Correction Component (SCC) (effective March 17, 2025, paired with amended Prohibited Transaction Exemption PTE 2002-51):

1. Deposit 100% of the missing principal contributions into participant accounts immediately.
2. Calculate lost investment earnings from the segregation date through the recovery date using the official EBSA VFCP Online Calculator and deposit those lost earnings from corporate funds (never plan forfeitures!).
3. Check eligibility for the streamlined 2025 VFCP Self-Correction Component: if the delinquent contributions were remitted within 180 calendar days from withholding, total lost earnings across the batch equal $1,000 or less, and the plan is not under investigation, file the electronic SCC Notice on EBSA’s portal and sign the SCC Retention Record Checklist—avoiding a full formal VFCP application while securing automatic enforcement and excise-tax relief. If delays exceeded 180 days or lost earnings topped $1,000, file a standard VFCP application + IRS Form 5330 (15% excise tax under 26 U.S.C. § 4975 on lost earnings, unless exempted).

Days 12 to 20: Form I-9 Internal Audit Rules (Never Backdate, Never Shred Defectives)

Substantive Form I-9 paperwork errors carry federal civil penalties of $288 to $2,861 per form—and fixing them wrong doubles the fine. Follow the joint ICE/DOJ IER internal-audit guidance to the letter.

Open the shoebox or HRIS onboarding folder next. Under 8 U.S.C. § 1324a and DHS inflation-adjusted penalty schedules (8 CFR § 274a.10(b)(2), adjusted January 2025 to $288 to $2,861 per form for substantive or uncorrected technical paperwork violations), fifty missing I-9s at a 120-person company represent over $100,000+ in baseline Notice of Inspection exposure.

Follow the joint ICE and Department of Justice Immigrant and Employee Rights Section (IER) Guidance for Employers Conducting Internal Employment Eligibility Verification Form I-9 Audits strictly—violating any of these five rules creates a worse felony or discrimination charge than the missing form:

• Rule 1 — Audit 100% of active + retention-window I-9s neutrally: Never audit only foreign-sounding surnames or visa holders (unlawful citizenship/national-origin discrimination under 8 U.S.C. § 1324b). Note the statutory retention math for terminated employees: retain I-9s for 3 years after date of hire OR 1 year after date of termination, whichever is later.
• Rule 2 — NEVER backdate a single date field: If an employee hired on March 10, 2024, has zero Form I-9 on file, complete a brand-new current-edition Form I-9 today, enter the real original hire date (`03/10/2024`) in Section 2’s employment-start field, enter today’s actual 2026 signature date in Sections 1 and 2, and attach a signed, dated audit memo explaining: "Missing Form I-9 identified during October 2026 internal compliance audit; completed prospectively upon discovery." Backdating signature dates violates 18 U.S.C. § 1001 / § 1546.
• Rule 3 — Who corrects which section: Only the employee may correct errors in Section 1 (drawing a single line through the error, entering correct text, and initialing + dating today; never use correction fluid/White-Out!). Only the employer corrects Section 2 or Supplement B.
• Rule 4 — Never throw away the defective original: If Section 2 is so mangled you complete a fresh Section 2 page, staple the new page to the untouched original I-9 with a signed audit explanation note. Shredding defective originals looks like willful concealment during an ICE inspection.
• Rule 5 — Zero document over-specification: Hand employees choosing new Section 2 documents the official List of Acceptable Documents and let them choose which List A or List B+C combination to present—demanding a US passport or Green Card violates 8 U.S.C. § 1324b(a)(6).

Days 20 to 30: FLSA Reclassification Economics and Prospective Leave Cleanup

Verify both duties and state salary floors before touching FLSA classifications, and never deduct prior undocumented absences from an employee's 12-week FMLA bank without proving no prejudice.

Close out Month 1 by resolving the two trickiest people-facing debts without sparking a class action:

• FLSA Exempt Salary & Duties Triage: Following the Eastern District of Texas vacatur of the 2024 DOL overtime rule in State of Texas v. U.S. Department of Labor (Nov. 15, 2024), the federal FLSA white-collar (EAP) minimum salary threshold reverted to $684/week ($35,568/year) under 29 CFR Part 541. Do not stop at $35,568! State exempt minimums sit almost double the federal floor—exceeding $68,640+ in California (2x state minimum wage for full-time employment), $62,400–$66,300 in New York, and high multiples in Washington and Colorado—and paying $90,000 still fails exemption if an "Operations Coordinator" lacks primary executive, administrative (discretion and independent judgment on matters of significance under 29 CFR § 541.200), or learned-professional duties. Work with counsel under privilege to calculate historical overtime exposure, tie prospective reclassification to hourly base-equivalent rates during a scheduled org or compensation cycle, and evaluate supervised DOL WH-58 or state-compliant back-pay releases where historical hours were high.
• Unwritten "Handshake Leave" Habits: Suppose an employee has been out 9 weeks on an informal manager handshake with zero FMLA Eligibility/Rights/Designation notices ever sent. Under 29 CFR § 825.301(d)–(e) (Ragsdale v. Wolverine World Wide, Inc., 535 U.S. 81 (2002)), retroactive FMLA designation is dangerous if lack of notice prejudiced the employee’s leave planning. Issue clean prospective FMLA/PWFA/ADA notices starting today forward, and immediately pull every stray doctor’s note out of general personnel drives into a locked ADA vault.

DAY-1 COUNSEL-DIRECTED AUDIT CHARTER + FORM I-9 REMEDIATION MEMO TEMPLATES

TEMPLATE 1 — PRIVILEGE CHARTER REQUEST TO LEGAL COUNSEL (SEND DAY 1–2 BEFORE DATA PULL)
Subject: PRIVILEGED & CONFIDENTIAL — Request for Legal Advice: Onboarding Employment Compliance Audit

Dear [Outside / In-House Employment Counsel],
Having assumed the role of [Head of People] on [Start Date], I am requesting your legal advice regarding [Company Name]'s statutory compliance obligations across FLSA wage-and-hour classifications, Form I-9 verification, ERISA 401(k) contribution timing, and leave recordkeeping. Please confirm in writing that any factual data compilations, audit worksheets, and communications prepared by my office for this review are conducted at your direction for the primary purpose of securing legal advice for [Company Name] under attorney-client privilege.

------------------------------------------------------------------------
TEMPLATE 2 — FORM I-9 PROSPECTIVE INTERNAL AUDIT CORRECTION MEMO (STAPLE TO REMEDIATED I-9)
MEMORANDUM TO FORM I-9 COMPLIANCE FILE
Employee Name: [Full Name]                  Original Hire Date: [MM/DD/YYYY]
Internal Audit Review Date: [Current Date]  Auditor: [Name & Title]

Audit Finding & Prospective Remediation Record:
During a company-wide, non-discriminatory internal Form I-9 compliance audit conducted on [Month/Year] in accordance with joint ICE and DOJ IER internal-audit guidance:
[ ] Option A (Missing Form I-9): No historical Form I-9 was located for this employee. On [Current Date], the employee and Company completed a current-edition Form I-9 entering the original hire date ([MM/DD/YYYY]) and signing/dating Sections 1 and 2 contemporaneously on [Current Date]. Zero dates were backdated.
[ ] Option B (Section 2 Substantive Error): Historical Form I-9 dated [Original Date] contained [describe defect, e.g., incomplete List A issuing authority/expiration]. A newly completed Section 2 signed and dated [Current Date] is attached permanently to the unaltered original Form I-9.

Signed: ___________________________   Date: [Current Date — NEVER BACKDATE]