California Wage-and-Hour Audit: Why Employers Should Audit Before a Claim
Wage & Hour Defense
A wage-and-hour audit that a California employer runs on its own terms looks very different from a review triggered by a PAGA notice. The difference is not just timing.
Under California's reformed Private Attorneys General Act, employers that take "all reasonable steps" to comply before receiving a PAGA notice or certain employee records requests may qualify for a 15% cap on otherwise applicable PAGA penalties. The statute expressly identifies periodic payroll audits and actions taken in response to the results as one example of those reasonable steps.
The audit is not an automatic safe harbor. What the employer does with the findings matters.
Here's what a legally focused California wage-and-hour audit should examine, how the process works, and why remediation before a claim can materially change the PAGA analysis.
Key Takeaways
A California wage and hour audit must cover IWC Wage Orders and Labor Code obligations: meal/rest breaks, reporting time pay, piece-rate rules that federal FLSA audits don't address at all.
An internal audit is proactive and self-initiated; it's meaningfully different from a reactive audit triggered by a DLSE inquiry or PAGA notice.
Under the 2024 PAGA reform, "reasonable steps" taken before a notice caps penalties at 15%; steps taken within 60 days after a notice cap them at 30%. These are percentage caps.
A flat $15-per-employee-per-pay-period penalty applies only when a violation is cured without a "reasonable steps" showing; $0 applies when both conditions are met.
Periodic payroll audits and action taken in response to the results are expressly identified in Labor Code § 2699 as potential evidence of "all reasonable steps."
A wage-and-hour audit directed by counsel for the purpose of providing legal advice may receive attorney-client privilege protection that a routine HR or software compliance review generally does not.
What Is a Wage and Hour Audit, and Why California Is Different
A wage and hour audit is a structured review of your payroll practices, employee classifications, timekeeping records, and workplace conditions to confirm compliance with applicable labor law. It typically starts with federal FLSA requirements and then adds the wage-and-hour rules of each state where the employer operates.
In California, the checklist is far longer. The Industrial Welfare Commission Wage Orders and the Labor Code impose state-specific obligations that the FLSA does not create: meal and rest break premiums, split-shift pay, reporting time pay, and piece-rate calculations, among others.
A federal self-audit is not a substitute for a California wage-and-hour review. The U.S. Department of Labor's current PAID program addresses specified violations of the FLSA and the FMLA. It does not audit compliance with California Wage Orders, meal and rest period rules, reporting time pay, or PAGA.
A California employer can therefore correct a federal overtime issue and still have separate state-law exposure.
What Is an Internal Wage-and-Hour Audit?
An internal wage and hour audit is one your business initiates and controls, before any government agency or employee attorney forces the question.
The distinction matters legally, not just operationally: an internal audit, conducted proactively and ideally under the attorney-client privilege, is what creates the documented "reasonable steps" record that actually reduces your PAGA exposure. An audit that occurs only after a DLSE inquiry or PAGA notice is issued is reactive and, by definition, too late to qualify for the strongest penalty protections available under the law.
A PAGA Notice Is Not the Only Deadline That Matters
The 15% penalty cap is not based solely on whether the employer acted before receiving a formal PAGA notice. Labor Code § 2699 also looks at whether the employer took all reasonable steps before receiving certain requests for payroll, personnel, or employment records from the aggrieved employee or the employee's counsel.
That means the first warning sign may be a records request, not a PAGA notice. For employers, waiting until an LWDA notice arrives can be a costly timing mistake if an employee or attorney has already requested records under Labor Code §§ 226, 432, or 1198.5.
If you're unclear about how a claim actually reaches your business in the first place, our guide on what qualifies as a wage-and-hour claim in California covers the mechanics this audit is designed to get ahead of.
What a California Wage-and-Hour Audit Should Review
A legally focused audit should test both written policy and actual payroll and timekeeping data. Depending on the workforce, the review may include:
Employee classification:
Exempt status under California's salary and duties tests and independent contractor classification under applicable California law.
Timekeeping and off-the-clock work:
Early logins, post-shift tasks, remote work, automatic time edits, and rounding practices.
Meal periods:
Timing, duration, waivers, missed or late meals, and premium-pay practices.
Rest periods:
Written policies, operational practices, and whether employees are actually authorized and permitted to take compliant breaks.
Overtime and regular rate:
Daily and weekly overtime, double time, bonuses, commissions, and other remuneration affecting the regular rate.
Wage statements:
Compliance with Labor Code § 226 and whether payroll data matches the information shown to employees.
Final pay:
Timing and calculation of wages due at termination or resignation.
Expense reimbursement:
Business expenses, remote work costs, mileage, and other amounts that may be covered under Labor Code § 2802.
Industry-specific pay rules:
Piece-rate compensation, reporting time pay, split-shift requirements, and the applicable IWC Wage Order.
Recordkeeping:
Whether payroll and time records are complete, accurate, and retained for the required periods.
The purpose is not simply to identify a bad policy. It is to find where policy, manager behavior, timekeeping data, and payroll treatment do not match.
The Real Cost of Skipping the Audit: The Corrected PAGA Math
The actual structure is more favorable to prepared employers and less forgiving of unprepared employers. Under the 2024 PAGA reforms applicable to newer PAGA notices and actions, the penalty an employer faces depends entirely on what steps were taken and when:
Employer's Position | Potential PAGA Penalty Treatment |
|---|---|
Took all reasonable steps before the PAGA notice or specified records request | No more than 15% of the otherwise recoverable PAGA penalty, subject to statutory exceptions |
Took all reasonable steps prospectively within 60 days after receiving the PAGA notice | No more than 30% of the otherwise recoverable PAGA penalty, subject to statutory exceptions |
Satisfied the 15% or 30% reasonable-steps provision and cured the violation | No PAGA civil penalty for the cured violation |
Cured a violation but does not fall within the no-penalty rule | No more than $15 per employee per pay period for the cured violation |
Qualifying wage statement violation | $25 per aggrieved employee per pay period in specified circumstances |
Isolated, nonrecurring violation | $50 per aggrieved employee per pay period if the statutory timing requirement is met |
"All reasonable steps" has a specific statutory meaning. It includes conducting periodic payroll audits, acting on the results, disseminating written policies in compliance with the law, training supervisors on Wage Order compliance, and taking corrective action with supervisors as needed.
What California HR Teams Are Discussing About PAGA Risk
The gap between a written policy and what timekeeping data actually shows is already a concern for California HR teams. In one Reddit discussion, an HR manager dealing with a PAGA claim described employees taking late meal periods because of workload or returning to work early, even though employees said managers had not instructed them to do so.
Another HR practitioner described a more proactive process: employee attestations for meal and rest periods, automatic premium pay for missed or late lunches, and regular reports that HR can use to identify and address recurring issues.
That is the difference an internal audit should be looking for. A handbook may say employees receive compliant meal periods. The timekeeping data may show repeated late lunches by the same team, location, or manager.
The audit question is not only, "Do we have the right policy?" It is, "What does our own data show, and what did we do when the pattern appeared?"
How to Choose the Right Audit Provider
Not every wage and hour audit service protects you the same way, and the difference isn't just price. It's whether the audit itself can be used against you later. Here's how the three common options actually compare:
Provider Type | Best For | Key Limitation |
|---|---|---|
HR Consulting Firm | Policy drafting and operational HR review | The review is not automatically protected by attorney-client privilege |
Payroll Software | Calculation automation and data flags | Cannot independently provide legal analysis of Wage Orders, exemptions, or classification tests |
Employer Defense Law Firm | Legal risk analysis, remediation strategy, and PAGA defense positioning | Higher upfront cost; privilege still depends on proper legal purpose and confidentiality |
Getting Started: Your Internal Audit Action Plan
You don't need to wait for a PAGA notice or a DLSE inquiry to begin. Here's where to start:
1.
Assess your highest-risk areas first.
Overtime calculations, meal break compliance, and employee classification are consistently the areas where California employers face the most exposure.
2.
Pull three years of payroll and timekeeping records.
Incomplete records are themselves a red flag that warrants attention before the audit even begins.
3.
Compare written policy against actual practice.
This gap is where most of the real exposure lies, not in the policy document itself.
4.
Engage an employer defense attorney before any government inquiry begins.
Once a DLSE audit or PAGA notice arrives, your options for a fully proactive "before notice" defense have already narrowed. If a claim has already been filed, our breakdown of settling versus fighting a DLSE claim walks through that decision point.
5.
Document every remediation step.
The employer bears the practical burden of establishing the compliance measures it took, and contemporaneous records can be critical to demonstrating a reasonable-steps position later.
If any of this sounds like a gap in your current practices, our Wage & Hour Defense team conducts exactly this kind of privileged internal audit, and our PAGA Defense team picks up immediately if a notice has already been served.
Conclusion
A documented internal wage-and-hour audit, conducted before a PAGA notice is filed, allows a California employer to cap penalty exposure at 15% of the otherwise applicable amount, rather than facing full statutory penalties.
The audit itself is one of the specific factors California law names as "reasonable steps" toward that cap. Employers who wait until a notice is filed can still act within 60 days to reach the 30% cap, but that window closes fast, and undocumented action earns no protection at all.
If your business hasn't conducted a privileged wage-and-hour audit, DefendMyBiz can start one before a claim forces you to meet the timeline. Book a free 15-minute consultation with our employer defense team.
Frequently Asked Questions
Can a wage-and-hour audit reduce PAGA penalties in California?
What is a wage and hour audit?
What is the 7-minute rounding rule, and does it hold up in California?
What triggers a DOL or DLSE wage-and-hour audit?
Does running an internal audit guarantee my business avoids PAGA penalties?
Disclaimer: The above content is for informational purposes only. This is not legal or tax advice. Laws, IRS guidance, and withholding requirements can change, and outcomes depend on specific facts. You are advised to contact a qualified attorney for any legal advice.
