Nobody knows who owns compliance. A readiness checklist.

A business received a notice relating to a filing it had not made. The finance head assumed HR handled it. The HR executive had joined eight months earlier and had never been told it existed. The consultant who used to manage it had stopped working with the business the previous year, and nobody had noticed the absence because nothing visible happens when a filing is simply not made — until it does.

Nothing about this was a knowledge failure. Everybody involved was competent. It was an ownership failure, and ownership failures are what most compliance problems in growing businesses actually are.

What this guide is and is not

It is not a list of what the law requires. Statutory obligations for employers in India vary by state, by sector, by headcount, by the nature of the premises and by the type of engagement, and they change. Any general article that tells you what applies to you is telling you something it cannot know.

What a general article can usefully provide is a structure for finding out — a set of questions you answer about your own business, which produces a map of what you know, what you do not, and who is responsible. That map is what you take to a qualified professional, and arriving with it makes the advice considerably cheaper and more useful than arriving with the question "are we compliant?"

Every specific obligation, threshold, deadline and figure should be confirmed with a qualified professional familiar with your sector and the states you operate in. That applies to everything below without repetition.

Section one: ownership

Start here, because it is the section that predicts everything else and it needs no legal knowledge to complete.

  Who is named as responsible for employment-related
  compliance? (a role, not "HR and finance")

  If that person left tomorrow, where is the list of
  what they were doing?

  Is there a calendar of recurring obligations with
  dates and an owner per item?

  Who checks that each one was actually done, and is
  it someone other than the person doing it?

  When an external consultant handles something, who
  internally confirms it happened?

  When did anybody last verify that the list itself
  is still complete?

  ANY BLANK ANSWER IS A FINDING.

The last question is the one that catches established businesses. A list built three years ago reflects the business as it was three years ago — before the second location, before the contractor arrangement, before headcount crossed whatever thresholds it crossed. Lists do not update themselves and nobody is assigned to notice.

Section two: what you would need to produce

A useful reframing that avoids needing to know the law: rather than asking what you are required to hold, ask what you could produce if asked, and how long it would take.

1. 1

   Employment records for every current and recent employee

   Contracts, appointment letters, changes to terms, current addresses. Test it by picking three people at random - one long-tenured, one recent, one who left last year - and seeing how long it takes to assemble a complete file.

2. 2

   Payroll records and evidence of what was paid and deducted

   For a period going back further than you might assume. The test is not whether the system holds it but whether someone can extract it without the one person who knows how.

3. 3

   Registers and records specific to your premises and sector

   Which ones apply is the question for a professional. Whether you could locate and produce whatever you do hold is a question you can answer today.

4. 4

   Evidence that required policies exist and were communicated

   Not just that a document exists, but that it reached people and that there is a record of it. Acknowledgement records that live in one person's mailbox do not count.

5. 5

   Records relating to contractors and third-party staff

   Frequently the weakest area, because responsibility is ambiguous and the arrangements were often set up informally. Establish who holds what before you need to know.

Each item is answerable as a time: immediately, a day, a week, or not at all. "Not at all" and "a week" are both findings, and the second is often more informative because it usually means the information exists but depends entirely on one person.

Section three: the single points of failure

Compliance work concentrates in individuals more than almost any other function, because it is specialised, invisible when working, and rarely documented.

• The person who knows the deadlines. Usually one individual, often without a written calendar, frequently the only one who would notice a missed date.
• The consultant relationship nobody else manages. If the engagement ends, or the individual there changes, what happens is generally discovered later rather than planned for.
• The login. Portal credentials held by one person, sometimes a former employee, is a common and easily fixed exposure.
• The undocumented arrangement. Something agreed verbally years ago that has been operating since. These surface under scrutiny and nobody remembers the reasoning.

None of these require legal advice to identify or to fix. They require somebody to ask, write down the answers, and address the gaps — which is most of what a functioning HR compliance framework consists of in practice, underneath the specific obligations.

Section four: the data underneath

A point that is easy to miss: nearly every compliance obligation depends on employee data being accurate, and most businesses discover their data problems during a compliance exercise rather than before one.

Headcount that does not reconcile between payroll and records, joining dates that differ by source, people classified inconsistently, locations that do not match where someone actually works. Each is an ordinary administrative discrepancy until it becomes the basis of a return, at which point it becomes something else.

Reconciling records against payroll is an afternoon's work and it is worth doing before any compliance review rather than during one. Where the discrepancies are substantial, employee information management is the prerequisite, and no compliance framework built on unreliable data will hold.

What to do with the completed map

You should now have four things: a named owner or the absence of one, a list of what you could and could not produce, a set of single points of failure, and a view of whether your data supports any of it.

Fix the ownership gaps and the single points of failure yourself. They need no advice, they are the cause of most actual failures, and they are within reach this month — a named role, a written calendar with dates and owners, credentials held in more than one place, and a check performed by someone other than the doer.

Take the rest to a qualified professional. Specifically: which obligations apply to your sector, your states, your headcount and your premises; whether your current practice meets them; and what has changed recently that you may not have picked up. Arriving with a completed map rather than an open question is what makes that engagement efficient, and it is the sensible first step in building an HR compliance framework that someone actually owns.

One closing caution, because it is the failure this guide is most concerned with. A compliance review that produces a report and no named owner will be repeated in two years having found the same gaps. The report is not the outcome; the owner, the calendar and the verification step are. Where that ownership has nowhere obvious to sit, it is usually a structural question rather than a compliance one, and HR policies and governance work is where it gets resolved.