Compliance · October 6, 2026 · 6 min read
The compliance gap most growing companies don't see until it is expensive
Compliance failures are rarely dramatic. They are a policy nobody updated, a manager nobody trained, and a classification made three years ago that has never been revisited.
Where the exposure actually hides
Almost no company sets out to be non-compliant. What happens instead is that the company changes and the paperwork does not. A role gets reclassified informally. A remote hire is onboarded in a new province or state. A policy written for twelve people is still in force at ninety.
Each of those is small. Together they form a pattern that is difficult to unpick once a claim, an audit or a disgruntled departure puts it under a spotlight.
The five areas an auditor looks at first
Across the audits we run, the same five areas produce the majority of findings. They are unglamorous, and they are almost always fixable — but the cost of fixing them rises sharply once a third party is involved.
- —Worker classification — contractors performing employee-like work, and mis-levelled overtime status
- —Policy currency — handbooks that reference legislation, thresholds or entitlements that have since changed
- —Documented performance — warnings, improvement plans and termination records that would not survive scrutiny
- —Manager training — harassment, privacy and health-and-safety obligations that exist on paper but were never delivered
- —Records and retention — personnel files incomplete, inconsistent, or stored somewhere nobody can retrieve them from
Why the gap stays hidden
Compliance problems do not announce themselves. There is no error message when a handbook goes stale. The signal arrives later and from the outside: a candidate who knows their rights, a former employee with a lawyer, a buyer's due-diligence checklist with forty-one items on it.
The other reason gaps persist is ownership. In companies without a senior HR seat, compliance is nobody's full-time job. It is the thing the operations lead means to get to after the quarter closes.
What a real audit produces
A useful audit is not a list of everything that could theoretically be improved. It is a risk register: each finding scored for likelihood, exposure and the effort to fix, then ordered so that the highest-risk, lowest-effort items happen first.
That ordering matters more than the findings themselves. Most companies cannot fix everything in one quarter, and trying to usually means fixing nothing properly.
The cost of waiting
Remediation before a claim is a project. Remediation after one is a negotiation, sometimes with a regulator, often with a lawyer, and always with a deadline you did not choose.
If your handbook, contracts and manager training have not been reviewed since your headcount doubled, that review is the highest-return three hours you can spend this quarter.