Multi-national companies’ efforts to conduct global compliance audits and risk assessments of their human resources operations get complicated, because each country’s employment laws are unique.
The globalising economy has pushed multi-national companies to align more and more aspects of their human resources across borders. Multi-nationals now routinely globalise HR programmes, policies, benefits and other “offerings” that used to be purely local.
As a company’s headquarters watches over its new cross-border HR offerings, compliance initiatives go global as well. A company’s headquarters also has a strong incentive to oversee compliance with the growing list of “extra-territorial” laws that can impact upon workforces internationally.
But how can a multi-national efficiently audit, assess, check or review HR compliance across borders? First, assemble a project team. Involve headquarters, local human resources staff, and the in-house legal and compliance functions. Consider instructing external counsel with attorney/client privilege or an outside international HR consultant.
Team in place, the question becomes: “how to project-manage a cross-border HR audit cost-effectively and efficiently?” The temptation may be to use the quick-and-dirty approach - grab a “global HR audit checklist” off the shelf, dive in and just do the audit.
But this rarely works, because no one-size-fits-all “global HR audit checklist” exists that can do the job. Each global HR audit project spins off in its own direction, with its own particular goals, its own pool of affected countries, focused in its own particular industry. A global HR compliance audit requires an organic, holistic approach in five steps:
- Articulate context and scope. Isolate the context and delineate the scope of this particular global HR audit project. HR audits/assessments arise in very different contexts, for example: implementing a new corporate structure; preparing for a restructuring; doing a merger or acquisition (spin-off or post-merger integration); responding to litigation/government investigation; or simply toughening compliance through a robust HR practices check-up. Some global HR audits focus externally on outside supplier compliance while others focus internally, but on specific legal challenges such as health/safety, wage/hour, data privacy, bribery, whistleblower hotlines, or – increasingly - corporate social responsibility and ethics.
Isolating the context of your particular audit is vital because it lets you put aside all irrelevant issues not in play here. After setting context, delineate project scope. Should the project focus on compliance with employment laws, with collective agreements, with corporate policies - or with all three? As to legal compliance, should the project look at local employment laws, at laws of the country in which headquarters is located that reach “extra-territorially” – or at both? Should the project be confined to local employees or should it reach expatriates, consultants, independent contractors and suppliers? Should the project go beyond employment laws and policies to assess compliance with HR-context data privacy, corporate and tax laws? What industry-specific issues require special focus—like wage/hour in retail, conflicts of interest/insider trading in professional services, health/safety in manufacturing?
- Create master template. “Compliance” means following mandates. Because employment law mandates differ significantly by jurisdiction, localised HR compliance audit checklists (or questionnaires) are essential, and should align to allow for “apples-to-apples” comparisons across jurisdictions. Align local HR audit checklists by spinning each one off a single master template (or outline). Create that master template organically - tailor it to fit this unique audit project. Include all topics consistent with the project scope (step 1), but exclude all other topics.
Depending on context, HR compliance audit topics might include:
- Local labour/employment laws including rules regulating: candidate interviewing, recruiting and “onboarding,” union/collective labour/works councils, wage/hour (including overtime and flat caps on hours), holiday/vacation, health/safety, employee communications/language, discrimination/harassment, complaints and internal investigation procedures, termination/release/pay out at separation.
- Internal policies and collective (union/works council) agreements including: local HR policies, global code of conduct, industry codes, bribery/corruption policy, globally applicable HR policies issued by headquarters, “framework”/union neutrality agreement, collective agreements to which the organisation is a party and “sectoral” agreements that apply by force of law.
- Benefits and compensation issues including: employee benefits, equity plans, statutory mandatory benefits, profit sharing, payroll compliance (deductions, withholding, reporting).
- Individual employment contract issues including: contract/ offer letter template, restrictive covenants, employee acknowledgements/consents/waivers, computer-click intranet assents (“electronic signatures”).
- Contingent and irregular employment issues including: contractor/consultant misclassification, fixed-term/part-time employees, secondees/ leased/agency employees, non-employee directors, expatriates (including visas/work permits).
- Headquarters-country employment laws that reach overseas such as laws on: accounting, bribery/ foreign corruption, discrimination, Sarbanes- Oxley whistleblower “procedures,” securities, terrorism watch list, trade sanctions.
- Corporate and tax issues reaching employment including: employer entity, employer registrations/ corporate form, dual-employer exposure, “permanent establishment” exposure from “floating employees”, employee powers of attorney.
- Data privacy laws that reach employee data, personnel files and global Human Resources Information Systems, including: employee notification/consents, registrations with data protection authorities, “sensitive” employee data, data security, HR data retention/purging practices, cross-border data transmissions.
- Align local-country checklists off the master. “Localise” the master project template into a set of aligned audit checklists (or questionnaires), one per jurisdiction. Create a local checklist for each jurisdiction and localise each point with the applicable local standard. For example, if bullet #18 on a master template says “check compliance with local vacation laws,” then the local Brazil checklist (for example), at its bullet #18, might say something like “confirm employees get 30+ vacation days per year and draw down vacation in periods of 10+ days per vacation break”. Be sure each local checklist captures any relevant one-off local rules which are not addressed in the master template. (For example, a local HR audit checklist for England might address overtime opt-outs; one for Saudi Arabia might address gender segregation; one for Korea might address menstruation leave).
- Conduct the audit. Take the local checklists into the field and conduct the global audit. Gather data in each jurisdiction applying appropriate “metrics”. Decide how the audit process will work. Will headquarters-based auditors travel on-site, or can the field piece be conducted remotely? Will inspections be pre-announced or not? How to handle local HR staff that fail to respond adequately? What translations will be needed? Will auditors look only at policies/protocols/agreements, or will they inspect specific employment agreements, acknowledgements, pay roll information, timesheets, safety logs, etc.? Will auditors interview employees? What will be the role of local outside providers like payroll agencies and benefits administrators? How will the audit process itself comply with local data laws?
- Report and implement remedial measures. Summarise audit findings and implement remedial measures/fixes. Any summary report should avoid identifying specific employees (to minimise data protection and defamation exposure) and should account for privilege and evidentiary “admissions” issues. Could the report later get used against the employer as evidence of deliberate non-compliance? Finally, propose specific remedial measures - and then ensure the solutions actually get implemented locally.
Think through, in advance, the challenges to a cross-border HR compliance audit or risk assessment. Proceed strategically. Craft aligned, locally tailored checklists from a master template.