Every compliance gap gets found in the end. The only real question is whether you find yours first, on your own clock, or an agency finds it on theirs and reaches back years. Here is what a gap actually costs, and how to run the first pass yourself.
Most compliance gaps are not the result of anyone being careless. They open slowly, when processes become misaligned and internal controls fail to keep up with changes. The risk is hard to detect, right up until someone outside the company decides to look.
Individual errors can compound into enormous costs. In one recent case, the Department of Labor identified 158 misclassified workers in one organization. Between them, the employees were entitled to $422,137 in unpaid overtime, and damages brought that bill up to almost $850,000.
If you run HR for a company that has grown in the last few years, a gap like that almost certainly exists somewhere. The real question is who finds it first, and on whose clock.
How much does an HR compliance gap cost when an agency finds it first?
When someone outside your company finds the gap first, the bill is almost always bigger than the mistake that caused it. Last year the Department of Labor recovered $259 million in back wages for workers, the most it has collected in years. Most of these gaps don't start with a bad decision. They start with a reasonable one that quietly stopped being right as the company grew.
The reason the number climbs so fast is worth understanding, because it changes how you weigh the risk. A wage mistake never stays a single figure. Back wages reach back years, liquidated damages can double what you owe, and you owe it for every worker the policy touched. So a single payroll decision at the top becomes one bill repeated across everyone it affected. That is how a quiet call turns into a six- or seven-figure number by the time anyone adds it up.
Three exposures account for most of that risk, and it helps to know where each one lands.
| Exposure | What it can cost | How it multiplies |
|---|---|---|
| Worker misclassification and unpaid overtime | Up to $2,515 per violation in civil penalties, on top of the unpaid overtime you owe | Back wages double through liquidated damages and are counted per worker |
| I-9 and work authorization | $288 to $2,861 per form for paperwork errors, and far more for knowingly employing someone unauthorized | Every form on file is its own line item, and repeat offenses climb the schedule |
| Recordkeeping | No headline fine, but missing records are a violation in their own right | When you cannot produce records, a court can accept the employee's estimate of hours worked, so it weakens every other defense |
When you weigh your own exposure, then, don't stop at the fine on the page. Picture it multiplied across your people, doubled by damages, and reaching back through several years of payroll. And the more you have grown, the more of that payroll a single mistake can touch.
How do you find your compliance gap before an agency does?
The good news is that you don't need an agency or an outside firm to get a first read on where you stand. The five steps below are a self-audit you can run yourself, ordered so you start with the exposures that cost the most. A full gap assessment goes deeper on each one, but this is enough to tell you whether you have a problem worth taking seriously.
1. Map the thresholds you have already crossed
Start with a number you already have, your current headcount, and line it up against the points where new obligations attach, around 15, 20, 50, and 100 employees. Write down every federal regulation that came into force since your last review. Then do the same for each state and locality your people work in, because state and local thresholds often sit lower than the federal ones, and a duty you cleared at the federal level may already apply under state or local law.
2. Pull your worker classifications and your I-9s
Next, go straight to the two exposures that carry the biggest price tags. Classification splits into two checks, and both carry real exposure. First, confirm that every contractor would still read as a contractor under the DOL's independent contractor test, because the cost of getting this wrong is the doubling you saw earlier. Second, confirm that your exempt and non-exempt calls hold up under the Fair Labor Standards Act, since a worker treated as exempt who does not qualify carries the same unpaid-overtime risk. On I-9s, confirm that each form is complete and on file for its full retention window.
The stakes on I-9s rose in March 2026. An ICE reclassification turned a range of paperwork errors that used to carry a short window for correction into substantive violations you can be fined for on sight. The fines climb with each additional error, and knowingly employing someone without work authorization costs far more than a clerical slip. The room to quietly fix these has narrowed, which is exactly why finding them yourself now matters.
3. Confirm your records would survive an inspection
Then make sure you could actually produce the records if someone asked for them tomorrow. Federal law asks you to keep payroll records for three years and the underlying wage calculations for two, and to hold I-9s until the later of three years after hire or one year after someone leaves. The reason this matters is quieter than a fine. When you cannot produce the records, a court can accept an employee's own reasonable estimate of the hours they worked, so a thin file weakens every other defense you have.
4. Rank every gap by its dollar exposure
Now put a dollar figure next to everything you found, and sort by that figure, largest first. It is tempting to clear the small, obvious items because it feels like progress. But an afternoon spent tidying paperwork while a six-figure misclassification sits untouched is motion, not protection. Use the cost table above as your yardstick and start where the exposure is largest.
5. Correct on your own terms and document the work
Finally, fix what you found and keep a record that shows you did. This is where finding it first pays off directly. When you correct a wage problem on your own initiative and in good faith, you may be able to reduce or waive the doubled damages that would otherwise land on top of the back wages, and the Department of Labor's voluntary PAID program can let you self-report certain wage and hour violations and resolve them without litigation. Both are calls to make with your employment counsel, since they turn on legal judgments about exposure and waiver. What neither option works without is the thing the self-audit gives you: you found the problem first, you took corrective action, and you can show that you did both.
What is your next move?
Every compliance gap gets found in the end. The only real choice is who finds it first, and on whose clock. A self-audit runs on your calendar and has an end. The version where an agency runs it starts on their timeline and reaches back years. Set those two costs side by side and the case for looking first mostly makes itself.
If you would rather not run that first pass alone, Helios HR can give you a clear, prioritized picture of where your exposure sits, with a plan next to each finding:
- HR Compliance for organizations that want a full gap assessment before anyone outside the company goes looking
- HR Consulting for organizations that have found a gap and need a clear plan to close it
- Strategic HR for organizations adding headcount or new states faster than their policies can keep up
- HR Outsourcing for organizations that want compliance handled year-round rather than checked once
Book a call with a Helios HR consultant to discuss your compliance position today.
