Growing companies cannot manage compliance with a yearly check. Requirements vary by the state, county and city where employees actually work, and change often. Set a recurring review with a named owner, track requirements by work location, and convert each change into a policy, payroll, form or training action.
If your company is growing, you cannot manage People Operations compliance by checking employment law once a year and assuming you are covered.
The rules change often, and they change differently depending on where your people actually work. Your workforce changes. Your locations change. Every new state or municipality where you employ someone can introduce additional requirements.
Why an annual check no longer covers you
The requirements that apply to you shift on their own timetable, and that timetable has nothing to do with your fiscal year.
You have federal requirements, state requirements, and sometimes local ones. Some cities and counties layer their own rules on top of the state's. San Francisco is the example I use, because it maintains an entire set of its own policies above the state policies.
Some changes are simple and predictable. A minimum wage figure updates each year and you adjust it. Others are not. Look at family medical leave, or a state paid medical leave programme. Those change frequently, and the changes are not only a dollar figure. They can change who is eligible. They can change how you are required to administer the whole thing.
An annual review catches the first kind and misses the second, which is the kind that creates real exposure.
Not knowing does not remove the obligation
What I tell owners is straightforward. Even if you do not know about a requirement, you are still held accountable for it.
The agency you are answerable to does not care that you did not know. They care that you comply. What applies to you is driven by the size of your company and where your people work, and both of those change as you grow.
This is genuinely what keeps business owners up at night, and it is a reasonable thing to lose sleep over. Many of them do not have enough employees to justify a full-time HR person, and they still carry exactly the same obligation as a company that does.
Track requirements by employee work location
A policy that satisfies one state may not satisfy another. As you expand, you need to know where your employees actually work, which requirements apply there, and where your policies or procedures need to differ.
The word that matters is where they work, not where you are headquartered or where payroll is processed. A remote employee in another state can bring that state's requirements with them.
Cities and counties add a further layer, and it is the layer most often missed, because national guidance rarely mentions it.
For companies operating on both sides of a border, this gets more involved again. Our guide to running cross-border manufacturing crews covers what changes when your workforce spans two countries.
Set a recurring compliance review cadence
Create a repeating process for reviewing federal, state, and applicable local requirements. The areas I would cover:
- Wage and hour
- Leave requirements
- Hiring practices
- Employee classification
- Required policies and notices
- Recordkeeping
- Workplace safety
Someone has to own this. That person determines what applies, documents what changed, and identifies the actions required. Without a named owner it becomes everybody's responsibility, which means it happens when there is a scare and not before.
A cadence also gives you something an annual scramble cannot: a record showing you review this deliberately and act on what you find.
Turn a regulatory change into an operational change
Knowing a rule changed does not make you compliant. This is the step where most companies stop, and it is the step that matters.
For every change that applies to you, work through the same questions:
- Does a policy need updating?
- Does payroll need to change?
- Do forms or notices need updating?
- Does the handbook need to change?
- Does a manager's process need to change?
- Does anyone need training?
The goal is to translate a regulatory change into something your organization actually does differently. Until that happens, you have information rather than compliance.
The employee lifecycle is where the requirements live
It helps to stop thinking of compliance as a body of law and start thinking of it as a set of moments in an employee's time with you.
Every stage carries its own requirements and its own documentation. Recruiting and hiring. Onboarding and classification. Timekeeping and wage practices. Performance and disciplinary documentation. Leave and accommodation requests. Employee complaints. Termination and offboarding.
Mapped that way, the question stops being whether you know the law and becomes whether each of those moments has a defined step, a responsible person, and a record. That is a question a leadership team can actually answer.
It also shows you where the gaps sit. In most growing companies the front of the lifecycle is reasonably well built, because hiring gets attention. The middle and the end are where the exposure concentrates, because those moments are less frequent and nobody built a process for them.
Keep your People Operations materials current
Handbooks, onboarding documents, leave procedures, manager resources, and required notices all need defined owners and review dates.
Documents drift quietly. A leave procedure written for one state gets copied to a second location because it was the version on hand. An acknowledgement form keeps referencing a policy that was replaced. None of this is visible until someone needs the paperwork to be right, which is usually the worst moment to discover it is not.
A review date on each document forces the question of whether it still reflects how the work is actually done.
Train the people who have to execute it
A new policy sitting in a folder does very little. Managers, supervisors, payroll, and HR need to understand what changed and how their own responsibilities are affected.
Do not simply tell them the law changed. Tell them what changed, how it affects your organization, and what they specifically need to do differently.
This is where growth compounds the risk. More employees means more supervisors making decisions on behalf of your company, across more shifts, generating more documentation, with more opportunity for two managers to handle the same situation differently. At certain headcounts, additional requirements begin to apply that did not before.
Our HR compliance checklist for manufacturing companies works through the specific controls underneath each of these areas.
The everyday mistakes that become expensive ones
It rarely takes one catastrophic decision. It takes a series of ordinary ones made by people who were trying to keep the operation moving.
An employee is misclassified. Overtime is calculated incorrectly across a shift. A supervisor terminates someone without the documentation to support it. A leave or accommodation request is mishandled because the manager did not know the route. Two managers enforce the same policy differently on two shifts. A known safety issue is not documented or corrected on time.
Each of those has a reason behind it. Production was behind. The manager was new. The policy was not where anyone could find it. None of them were acts of bad faith, and none of that matters once they are being reviewed.
What turns them expensive is accumulation. Small People Operations mistakes become back pay, penalties, legal fees, settlements, management time, and production disruption. For a company running on thin margins, an unplanned employment expense does not consume a percentage of revenue. It consumes a meaningful share of annual profit.
Who owns this when you have no HR department
Most growing companies hit this problem before they are large enough to justify a full-time HR person, and the obligation does not wait for the headcount.
In practice the work lands on an office manager, a controller, or the owner. That is workable, provided two things are true. The responsibility is explicitly assigned rather than assumed, and the person holding it has a route to a qualified answer when something falls outside what they know.
The failure mode is the unassigned version, where everyone believes somebody else is watching the requirements. That is also the version that is hardest to detect, because nothing looks wrong until something does.
Whoever owns it needs time protected for the review. A compliance cadence that only happens when the month is quiet is not a cadence.
Build the review before you need it
The companies that handle this well do not treat compliance as a project. They build it into how People Operations runs, with an owner, a cadence, and a route from a change in the rules to a change in what managers actually do.
If you are adding locations, states, or headcount this year, the review cadence needs to exist before the expansion, not after the first requirement is missed.
Frequently Asked Questions
How often do employment requirements actually change?
Often enough that an annual check is not sufficient. Some items, like a minimum wage figure, update predictably each year. Others, such as family or state paid medical leave, change frequently and can alter who is eligible and how you administer them.
Am I liable for a requirement I did not know about?
Yes. The agency does not care that you did not know, only that you comply. What applies is driven by the size of your company and where your people work, and both change as you grow.
Which location determines the rules for an employee?
Where the employee actually works, not where the company is headquartered or where payroll is processed. Cities and counties can also add requirements on top of state ones, and that layer is the one most often missed.
What does a compliance review cadence need to cover?
Wage and hour, leave requirements, hiring practices, employee classification, required policies and notices, recordkeeping, and workplace safety, with a named owner who documents what changed and identifies the required actions.
Why is knowing about a change not enough?
Because compliance lives in what the organization does differently. Each applicable change needs to be tested against your policies, payroll, forms and notices, handbook, manager processes, and training before it counts.