HR risk management and compliance is the process of identifying people-related risks, such as legal violations, talent loss, misconduct and data breaches, and putting controls in place so the company meets every employment law it is subject to. Compliance is one part of it; risk management is the wider discipline.
The topic became urgent in India on 21 November 2025, when the four Labour Codes came into force and replaced 29 central labour laws. Salary structures, gratuity, contract labour and fixed-term hiring rules all changed. This guide covers the types of HR risk, the laws that matter in 2026, a seven-step process and an audit checklist. If you need hands-on help, see T Monk’s HR digitization and compliance services.
Disclaimer: this article is general information, not legal advice. Labour rules vary by state; confirm specifics with a qualified employment lawyer.
What is HR Risk Management?
HR risk management is a structured way to find, rate and reduce risks that arise from employing people. It covers anything that can cause legal penalties, financial loss, operational disruption or reputational damage through the workforce.
HR Risk Management vs HR Compliance
HR risk management vs HR compliance
Basis | HR compliance | HR risk management |
|---|---|---|
Question it answers | Are we following the law? | What could go wrong with our people, and how badly? |
Scope | Statutes, rules, filings, policies | Legal, talent, conduct, data, safety and culture risks |
Nature | Mandatory | Strategic and ongoing |
Output | Registers, returns, licences, policies | Risk register, controls, owners, review cycle |
Owner | HR and payroll teams | CHRO, CFO, legal and business heads |
Failure looks like | Fines, notices, prosecution | Attrition of key people, litigation, brand damage |
Types of HR Risks
Seven categories cover most HR risk in an Indian company.
Risk type | Examples | Typical control |
|---|---|---|
Statutory compliance risk | Wrong PF or ESI base, missed returns, unlicensed contractors | Compliance calendar and quarterly audit |
Wage and payroll risk | Salary structure not meeting the 50% wage rule, delayed full-and-final | Payroll restructuring and maker-checker reviews |
Workplace conduct risk | Harassment complaints, no Internal Committee, weak inquiry process | POSH policy, trained committee, annual report |
Talent and key-person risk | Sudden CXO exit, no successor, critical skills held by one person | Succession planning and interim leadership cover |
Employee-relations risk | Wrongful termination claims, disputes over appraisal | Documented employee performance management |
Data privacy risk | Employee records shared without consent, breach of HR systems | Consent notices, access controls, retention policy |
Health and safety risk | Accidents, excess working hours, no safety committee | Safety audits and working-hour tracking |
Why HR Risk Management and Compliance Matters
- and platform workers.
- Payroll cost is affected: a higher wage base raises PF, gratuity and bonus liabilities.
- Directors can be personally liable: many labour offences attach to the person in charge of the establishment.
- Leadership churn is high: 48% of CXOs who moved in FY2025–26 had spent only one to three years in their previous role.
- Investors and clients check: due diligence and vendor audits now ask for labour compliance proof.
Risk and compliance work best as part of strategic human resource management, not as a year-end exercise.
HR Compliance in India — laws that matter in 2026
Indian employers now work under four Labour Codes plus a handful of standalone laws. The Codes came into force on 21 November 2025, and the Central Rules with Model Standing Orders were notified on 8 May 2026. Many state rules are still pending, so check your state’s position.
Law | What it covers | What HR must do |
|---|---|---|
Code on Wages, 2019 | Minimum wages, payment of wages, bonus, uniform definition of wages | Restructure pay so excluded allowances do not exceed 50% of remuneration; pay on time |
Industrial Relations Code, 2020 | Standing orders, fixed-term employment, layoffs, disputes | Give fixed-term staff parity of wages and benefits; update standing orders |
Code on Social Security, 2020 | PF, ESI, gratuity, maternity benefit, gig and platform workers | Recompute PF and gratuity on the new wage base; provide gratuity to fixed-term staff after one year |
Occupational Safety, Health and Working Conditions Code, 2020 | Safety, working hours, contract labour, appointment letters | Issue appointment letters; track hours; check contract labour licensing (threshold raised from 20 to 50 workers) |
POSH Act, 2013 | Prevention of sexual harassment at the workplace | Form an Internal Committee if you have 10 or more employees; train staff; file the annual report |
Digital Personal Data Protection Act, 2023 | Employee and candidate personal data | Give notice, limit access, set retention periods, report breaches |
State Shops and Establishments Acts | Registration, leave, holidays, working hours for offices | Register each location; follow state leave and hour rules |
New Labour Codes Compliance — the three changes that hit payroll
- The 50% wage rule. If allowances such as HRA and special allowance exceed 50% of total remuneration, the excess is added back to wages. PF, gratuity and bonus are then calculated on the higher base.
- Gratuity for fixed-term employees after one year. The five-year wait no longer applies to fixed-term staff, so provisioning must rise.
- One wage definition across laws. The same definition now drives PF, ESI, gratuity and bonus, which removes the room to structure pay differently for each.
HR Risk Management Process (7 steps)
- Identify risks. List every people-related risk by category, using the table above, across each location and entity.
- Run an HR compliance audit. Check registrations, registers, returns, contracts, policies and contractor records against the current law.
- Assess and rate. Score each risk on likelihood and impact, and mark the top ten as priority.
- Assign owners and controls. Each priority risk gets a named owner, a control and a deadline.
- Fix people and leadership gaps. Use leadership assessment to find key-person dependencies and name successors.
- Digitise and train. Move registers, payroll and policy acknowledgements to an HRMS; train managers on POSH, terminations and data handling.
- Monitor and report. Review the risk register quarterly and report to the board or promoters, ideally within your strategic HR advisory cycle.
HR Compliance Checklist for India (2026)
Registrations and licences
- ☐ Shops and Establishments registration for every office
- ☐ PF and ESI registration where thresholds are met
- ☐ Professional tax and labour welfare fund registration, where the state requires it
- ☐ Contract labour registration and contractor licences verified
Payroll and benefits
- ☐ Salary structures tested against the 50% wage rule
- ☐ PF, ESI, bonus and gratuity recalculated on the new wage definition
- ☐ Gratuity provisioning updated for fixed-term employees
- ☐ Wages and full-and-final settlements paid within statutory timelines
- ☐ Minimum wages checked against the latest state notification
Documents and policies
- ☐ Appointment letters issued to all employees
- ☐ Fixed-term, consultant and contractor agreements reviewed for misclassification
- ☐ POSH policy, Internal Committee and annual report in place
- ☐ Leave, working-hour, disciplinary and grievance policies updated to the Codes
- ☐ Employee data privacy notice and consent records in place
Records and reporting
- ☐ Statutory registers maintained, digitally where permitted
- ☐ Monthly and annual returns filed on time
- ☐ Inspection and notice log maintained
- ☐ Quarterly compliance review minuted
Penalties for Non-Compliance
Penalties range from fines of a few thousand rupees to imprisonment and nine-figure data penalties. The bigger cost is usually back-payment of dues with interest.
Law | Example of default | Maximum penalty |
|---|---|---|
Code on Wages, 2019 | Paying less than the amount due | Fine up to ₹50,000; repeat within five years, up to three months’ imprisonment or fine up to ₹1 lakh |
POSH Act, 2013 | No Internal Committee | Fine up to ₹50,000; double for a repeat offence, with possible licence cancellation |
Digital Personal Data Protection Act, 2023 | Failure to take reasonable security safeguards | Up to ₹250 crore |
PF and ESI provisions | Late or short contribution | Arrears with interest and damages |
Editor note: penalty figures are stated from the statutes as generally understood. Have an employment lawyer confirm each row before publishing.
HR Risk and Compliance Metrics to Track
- Percentage of statutory filings made on time
- Open inspection notices and labour cases
- Share of salary structures meeting the 50% wage rule
- POSH training completion rate
- Number of critical roles without a named successor
- Regretted attrition in critical roles
- Contractor compliance score
- Time to close audit findings
Common Mistakes in HR Compliance
- Treating the Labour Codes as a payroll-only change and ignoring contracts and policies.
- Following central rules but missing state rules for each location.
- Calling long-term workers “consultants” to avoid benefits, which creates misclassification risk.
- Having a POSH policy on paper with no trained committee.
- Keeping employee data in open spreadsheets and personal email.
- Ignoring leadership risk: when a CXO exits without a successor, executive search under time pressure costs more.
FAQs on HR Risk Management and Compliance
What is HR risk management and compliance?
It is the process of identifying people-related risks and making sure the company follows every employment law that applies to it. Compliance covers the legal part; risk management also covers talent, conduct, data and safety risks.
What are the main types of HR risks?
Statutory compliance, payroll, workplace conduct, talent and key-person, employee relations, data privacy, and health and safety.
Are the new Labour Codes in force in India?
Yes. The four Labour Codes came into force on 21 November 2025 and the Central Rules were notified on 8 May 2026. Many states are still finalising their rules, so requirements differ by state.
What is the 50% wage rule?
If allowances excluded from wages exceed 50% of total remuneration, the excess is treated as wages. PF, gratuity and bonus are then calculated on that higher amount.
Is POSH compliance mandatory for small companies?
Every employer must provide a safe workplace. An Internal Committee is mandatory once you have 10 or more employees.
How does the DPDP Act affect HR?
HR holds personal data of employees and candidates. You need a clear notice, a lawful purpose, limited access, a retention period and a breach-response process.
How often should an HR compliance audit be done?
A full audit once a year, with quarterly reviews of filings and the risk register. Run an extra audit after any law change, merger or new state entry.
Who is responsible for HR compliance?
The employer and the person in charge of the establishment are legally responsible. Day to day, the CHRO or HR head owns it with payroll, legal and finance.
Can HR compliance be outsourced?
Filings, audits and payroll can be outsourced to an HR compliance consultant. Legal liability stays with the employer.
Get your HR risk and compliance reviewed
HR risk management and compliance is cheaper to fix before an inspection, a dispute or a due-diligence request than after. If you want an independent view of where you stand under the Labour Codes, book an HR compliance audit with T Monk.
