What HR compliance actually covers.
Strip away the jargon and HR compliance is four repeating jobs. Keeping the documents that employment depends on valid: permits, licences, certifications, checks. Meeting statutory deadlines: the filings, renewals and reviews that law or a regulator expects on a date. Applying the correct jurisdiction’s rules to each person: entitlements, working time, pay rules. And being able to prove all of it afterwards, because an obligation you met but cannot evidence is treated, in an audit, much like one you missed.
The failure mode is rarely ignorance of the law. Companies mostly know they need right to work checks and current certifications. The failure mode is operational: the fact was known, the date was recorded somewhere, and nobody was looking at the somewhere when it mattered. That is why compliance is best treated as a systems problem, closer to maintenance engineering than to legal scholarship.
The documents that expire.
Every workforce carries a portfolio of dated documents: visas and work permits, right to work evidence, professional registrations, safety certifications, medical checks, driving licences. Each one has two properties that make it dangerous: it invalidates something important when it lapses, and it expires on its own schedule with no relationship to anyone else’s. A hundred employees can easily mean several hundred independent expiry dates, which is beyond any diary and every memory.
The workable pattern is a register with warnings at fixed horizons, commonly 90, 60 and 30 days, so that a renewal is started while it is still routine. The register only works if it is complete and maintained, which is why documents should live on the employee record itself, captured at hiring and updated at renewal, rather than in a parallel spreadsheet that has to be remembered separately.
The law follows the work.
The rule that surprises growing companies most: employment law generally applies where the work is performed, not where the company is registered. Hire a remote developer in another country and you have, in most cases, acquired that country’s employment rules: its leave entitlements, its working time limits, its statutory payments and often its payroll obligations. Head office policy does not override any of it.
Practically, this means the employee record needs to carry the jurisdiction, and every rule-driven calculation, leave, holidays, pay, deadlines, needs to read it. A UK employee and a Gulf employee in the same company live under genuinely different regimes: one has PAYE and pension duties, the other has employer-sponsored permits and salary payment through a wage protection system. Treating either as the default for the other produces confident, systematic error.
Audit trails: evidence beats assertion.
When a regulator, auditor or tribunal asks a question, the difference between a good afternoon and a bad quarter is whether the answer is a record or a recollection. An audit trail means that facts carry their history: who recorded the check and when, who approved the payment, what the balance was when the decision was made, what the policy said at the time. None of this can be reconstructed afterwards with any credibility; it exists only if the system was writing it down all along.
Acknowledgements deserve special mention. A policy sent by email is a hope; a policy with collected acknowledgements is evidence that specific people saw specific words by a specific date. The same logic applies to safety briefings and mandatory training: completion must attach to the person’s record, dated, because "we told everyone" has convinced no investigator in history, and it will not start with yours.
Statutory deadline hygiene.
Statutory deadlines, filings, renewals, mandated reviews, share an unhelpful property: missing them is usually cheap to prevent and expensive to repair. Deadline hygiene is a short list practised consistently. Every known deadline lives in one system, not in inboxes. Each has an owner and a warning horizon long enough to act in. Recurring deadlines recur automatically, because the ones that arrive every year are exactly the ones memory deprioritises. And completed obligations are marked done with the evidence attached, closing the loop.
Build the list per jurisdiction, because each country brings its own calendar, and review it whenever the business changes shape: a new country, a new regulated activity, a new class of worker. The review question is simple: what new dates did this create, and who is now watching them. Companies rarely miss the deadlines they know about and watch; they miss the ones created by growth that nobody added to the list.
A rhythm that survives busy weeks.
Compliance fails in busy weeks, which is when checking gets skipped, so the aim is a rhythm that runs without heroics. Daily and automatically: scan the records, surface anything newly expiring or missing, rank it by severity. Weekly and humanly: someone reviews the exceptions and clears or assigns them. Quarterly: a fuller review of the register, the deadline list and a sample of records, as an internal dress rehearsal for the audit you hope never comes. The daily layer must be automatic, because it is the layer busy weeks would otherwise delete.
Keep the human layer small and honest. A weekly exception review of ten minutes, done every week, outperforms a monthly deep clean that slips to quarterly. And record the review itself: the fact that someone looked, found three issues and fixed them is exactly the kind of evidence that turns a future inspection from adversarial to boring, which is the correct ambition for an inspection.