How to Configure a Legally Compliant Timekeeping System

intermediate · 1–2 weeks for single-site deployments

This procedure establishes a time-and-attendance infrastructure that satisfies FLSA, state-law, and DCAA documentation standards. Executed by HR operations or payroll administrators during initial system deployment or a compliance remediation project, it produces a configured, audit-trailed timekeeping system ready for live payroll feeds.

1. Define Clock-In and Clock-Out Rules
Prerequisites
- Employee classification roster (exempt vs. non-exempt) finalized and approved
- State-law applicability list confirmed (FLSA baseline plus any California, Illinois, or DCAA overlays)
- Payroll system API credentials or export format specification obtained
- IT or vendor access to timekeeping platform admin console confirmed
Configure the timekeeping system to capture start time, stop time, and all break periods to the nearest minute as required by 29 CFR § 516.2. Open the admin console and set the time-capture granularity to one-minute intervals. Disable any default rounding rules that could mask actual hours worked until you have confirmed the rounding method complies with your jurisdiction-rule matrix.
For organizations with employees on job sites, factory floors, or warehouse docks, confirm that the selected clock-in method (biometric, mobile, kiosk, or web) is accessible at the physical point where work begins. EasyClocking by WorkEasy Software provides biometric, facial recognition, RFID, and mobile clock-in options designed for harsh environments where dirty hands, gloves, or poor cell coverage are common.
Document the configured rules in a system-settings log for future audit reference.
Expected outcome: The system captures every clock-in, clock-out, and break period to the nearest minute, and a settings log documents the configured rules.
2. Separate Exempt and Non-Exempt Employee Profiles
Prerequisites
- Employee classification roster (exempt vs. non-exempt) finalized and approved
Create distinct employee groups or profiles in the timekeeping system for FLSA-exempt and non-exempt workers. Apply the following settings to each group:
- Non-exempt profiles: Enable daily and weekly overtime calculation thresholds. For California-sited employees, set daily OT at 8 hours and double-time at 12 hours. For employees subject only to the federal FLSA baseline, set weekly OT at 40 hours.
- Exempt profiles: Disable overtime calculation. If your policy requires exempt employees to record hours for project costing or DCAA purposes, enable time capture without OT triggers.
Verify each employee's assignment by comparing the system roster against the approved classification roster. A single misclassified employee can create back-wage liability across every pay period the error persists.
Expected outcome: Every employee is assigned to the correct exempt or non-exempt profile, and overtime rules fire only for non-exempt employees according to the applicable jurisdiction.
3. Enable Immutable Audit Trail
Prerequisites
- IT or vendor access to timekeeping platform admin console confirmed
Activate the system's change-log feature so every edit to a time entry records the editor's identity, the timestamp of the edit, and a mandatory reason field. This audit trail is a non-negotiable requirement for DCAA-compliant systems and a critical defense in any DOL wage-hour investigation.
Test the audit trail by creating a test time entry, editing it, and confirming the log captures all three data points (who, when, why). EasyClocking by WorkEasy Software logs punches, edits, approvals, scheduling decisions, payroll syncs, break attestations, and consent or deletion controls in a single audit record.
Restrict edit permissions to authorized roles (payroll administrator, direct supervisor) and require a documented reason for every change. Unrestricted edit access defeats the purpose of an audit trail.
Expected outcome: Every edit to a time record produces an immutable log entry with editor identity, timestamp, and documented reason; edit permissions are restricted to authorized roles.
4. Configure State-Specific Overtime and Break Rules
Prerequisites
- State-law applicability list confirmed
- Jurisdiction-rule matrix completed (if operating in multiple states)
Add state-specific rule sets as separate configurations applied to employees by work-site location. Do not rely on a single federal rule set for all employees. At minimum, address these common conflicts:
- California: Daily OT at 8 hours, double-time at 12 hours, mandatory 30-minute meal period before the fifth hour of work, and a second meal period before the tenth hour.
- Illinois: One Day Rest In Seven Act (ODRISA) break requirements and meal-period documentation obligations.
- DCAA-covered contracts: Daily time recording and supervisor approval by cost objective.
If you operate in states beyond California and Illinois, run the Multi-State Rule Mapping procedure (Procedure 2 in this hub) before configuring rules here. That procedure produces the jurisdiction-rule matrix that tells you exactly which rules to configure.
Expected outcome: Each state-specific rule set fires correctly for employees assigned to that state's work location, and California daily OT, double-time, and meal-period rules are independently verified.
5. Map Timekeeping Output Fields to Payroll Input Fields
Prerequisites
- Payroll system API credentials or export format specification obtained
Confirm that regular hours, OT hours, double-time hours, PTO codes, holiday codes, and department or cost-center codes in the timekeeping export map exactly to the corresponding earning codes in your payroll system. A single mapping error can mispay an entire employee group for an entire pay period.
EasyClocking by WorkEasy Software integrates with 20+ payroll and HR systems through direct API connections and file-based exports. Pull a sample export, open it alongside the payroll system's import template, and confirm every field aligns. Pay special attention to:
- OT earning code vs. regular earning code (they must be distinct)
- Department or cost-center codes (mismatches route labor costs to the wrong budget)
- Date-format alignment (MM/DD/YYYY vs. YYYY-MM-DD mismatches can shift entire pay periods)
Expected outcome: A sample export from the timekeeping system imports into the payroll system with zero field-mapping errors, and all earning codes align correctly.
6. Run a Parallel Test Period
Prerequisites
- Steps 1 through 5 of this procedure completed
Operate the new timekeeping system alongside your existing process (paper timesheets, spreadsheet, or legacy system) for one full pay period. At pay-period close, compare the outputs side by side:
- Do total regular hours match for every employee?
- Do OT hours match, including California daily OT if applicable?
- Does the payroll export produce the same gross-pay calculation as your existing process?
Document every discrepancy, trace it to a configuration issue, and resolve it before cutting over. Skipping this step is the most common cause of first-pay-period payroll errors after a system migration. The parallel period also gives employees and managers time to learn the new clock-in process in a low-stakes environment, which is especially important on job sites and factory floors where workers may be punching in with gloves or in cold-storage conditions.
Expected outcome: Outputs from the new system match the existing process within acceptable tolerance, all discrepancies are documented and resolved, and the team is confident in the cutover.
7. Obtain Employee Acknowledgment
Prerequisites
- Timekeeping policy document finalized and approved by legal counsel
Collect signed (or electronically signed) timekeeping policy acknowledgments from every employee. The acknowledgment should confirm that the employee understands:
- Their obligation to record all hours worked accurately
- The method of timekeeping (biometric, mobile, kiosk, or web)
- The process for reporting missed punches or errors
- The consequence of falsifying time records
Store signed acknowledgments in the employee's personnel file and in the timekeeping system's document repository if available. These acknowledgments serve two compliance purposes: they establish the employee's awareness of the timekeeping policy (relevant in dispute defense), and they satisfy consent-capture requirements for biometric clock-in methods where applicable. Consult qualified legal counsel regarding biometric consent requirements in your state before deploying biometric hardware.
Expected outcome: Every active employee has a signed acknowledgment on file, stored in both the personnel file and the timekeeping system's document repository.

Download the procedure above

How to Map Timekeeping Rules Across FLSA and State Jurisdictions

advanced · Scales with the number of jurisdictions; allow adequate time for legal review

This procedure identifies every timekeeping obligation that applies to each employee population based on work location, classification, and applicable law. Executed by HR compliance or payroll leads before system configuration or during an annual compliance review, it produces a jurisdiction-rule matrix that drives system settings and policy language.

1. List Every State Where Employees Physically Perform Work
Prerequisites
- Complete employee roster with work-site state confirmed for each employee
- Current FLSA exemption classifications on file
- List of active government contracts (for DCAA applicability determination)
- Access to state labor department guidance for each applicable jurisdiction
Build a complete list of every state where your employees physically work, not just where your company is headquartered. Include remote employees by their home-state work location. For construction, transportation, and staffing organizations, this list may change frequently as crews move between job sites or assignments.
Pull the list from your HR system or payroll roster. Cross-check it against active project or job-site records. If you operate in states you have not previously tracked, flag those as high-priority for rule mapping. EasyClocking by WorkEasy Software captures work-location data through GPS geofencing on mobile clock-ins and site-assigned biometric clocks, which can help you verify where employees are actually working.
Expected outcome: A complete, verified list of every state where employees perform work, cross-checked against project and payroll records.
2. Apply the FLSA Baseline Rule Set
Prerequisites
- Current FLSA exemption classifications on file
Record the federal minimums that apply to all non-exempt employees regardless of state:
- Record retention: Retain payroll records (including time records) for a minimum of 3 years; retain wage-computation records for a minimum of 2 years per 29 CFR § 516.5 and § 516.6.
- Time capture: Record hours worked to the nearest minute. FLSA does not require a specific format, but the records must be accurate and complete.
- Overtime: Calculate OT at 1.5x the regular rate for all hours exceeding 40 in a workweek.
This baseline is your floor. Every state-specific rule you add in subsequent steps either matches or exceeds these federal standards. Where a state rule is stricter, the state rule controls.
Expected outcome: The FLSA baseline rule set is documented as the federal floor for retention, time capture, and overtime in your jurisdiction-rule matrix.
3. Layer California-Specific Rules for CA-Sited Employees
Prerequisites
- Employee roster identifies California-sited employees
For every employee whose physical work location is in California, add the following rules on top of the FLSA baseline:
- Daily OT: 1.5x for hours exceeding 8 in a workday; 2x for hours exceeding 12 in a workday.
- Seventh-day OT: 1.5x for the first 8 hours on the seventh consecutive day; 2x for hours exceeding 8 on the seventh day.
- Meal periods: A 30-minute uninterrupted meal period before the end of the fifth hour; a second 30-minute meal period before the end of the tenth hour.
- Employee access to records: Employees are entitled to copies of their time records within 21 days of a written request under California Labor Code § 226.
Document each of these rules in the jurisdiction-rule matrix as the controlling standard for California-sited employees. The daily OT trigger is the most common source of misconfiguration because managers accustomed to the federal weekly-only rule forget it exists.
Expected outcome: California-specific overtime, meal-period, and records-access rules are documented in the jurisdiction-rule matrix and identified as controlling standards that exceed the FLSA baseline.
4. Layer Illinois-Specific Rules for IL-Sited Employees
Prerequisites
- Employee roster identifies Illinois-sited employees
For every employee whose physical work location is in Illinois, add the applicable rules on top of the FLSA baseline:
- One Day Rest In Seven Act (ODRISA): Employees are entitled to a minimum of 24 consecutive hours of rest in every calendar week and a 20-minute meal period for shifts of 7.5 continuous hours or more, taken no later than 5 hours after the start of the shift.
- Recordkeeping: Confirm meal-period documentation obligations under applicable Illinois regulations.
Illinois employers should also monitor biometric data handling practices. Consult qualified legal counsel regarding any state-specific requirements for capturing, storing, or deleting biometric data before deploying biometric time clocks in Illinois. EasyClocking by WorkEasy Software converts biometric scans into encrypted mathematical templates and does not store raw fingerprint or facial images; the platform includes consent-capture workflows and configurable retention and deletion controls.
Expected outcome: Illinois-specific rest-period, meal-period, and recordkeeping rules are documented in the jurisdiction-rule matrix.
5. Determine DCAA Applicability
Prerequisites
- List of active government contracts obtained
Review your list of active government contracts. If any employee charges time to a federal contract, apply DCAA timekeeping requirements to that employee's time records:
- Daily time recording: Employees must record time daily, not weekly or retroactively.
- Supervisor approval: A supervisor must review and approve time records.
- Labor distribution by cost objective: Time must be allocated to specific contract numbers and cost objectives, not just to a general overhead code.
DCAA auditors specifically look for after-the-fact timekeeping (employees filling in time cards at the end of the week) and missing supervisor approvals. Both are common findings in DCAA audits of construction and professional services firms.
Expected outcome: Every government-contract employee is flagged for DCAA timekeeping requirements, and the daily recording, supervisor approval, and labor-distribution rules are documented in the matrix.
6. Identify Conflicts Between Federal and State Rules
Prerequisites
- Steps 2 through 5 of this procedure completed
Review the jurisdiction-rule matrix column by column to identify every point where a state rule is stricter than the FLSA baseline. Document the state rule as the controlling standard for that employee group. Common conflict points include:
- California daily OT vs. federal weekly-only OT
- California meal-period timing requirements vs. no federal meal-period mandate
- State retention periods that exceed the FLSA 3-year baseline
- Illinois rest-period requirements vs. no federal rest-period mandate
Where two state rules apply to the same employee (for example, a remote Illinois employee working on a California-based project), consult legal counsel to determine which state's rules control. Do not default to the less strict rule without legal guidance.
Expected outcome: Every federal-vs.-state conflict is documented in the matrix, and the stricter rule is identified as the controlling standard for each employee group and jurisdiction.
7. Produce the Jurisdiction-Rule Matrix
Prerequisites
- Steps 1 through 6 of this procedure completed
Compile the results of Steps 1 through 6 into a single table with the following columns: State, Employee Group (non-exempt, exempt, DCAA-covered), OT Threshold (daily and weekly), Break Requirements, Retention Period, Format Requirements, and Audit Trail Standard.
Hand this matrix to the team responsible for system configuration (Procedure 1 in this hub). Every setting they configure should trace directly to a cell in this matrix. The platform from EasyClocking by WorkEasy Software includes a pre-built rule library covering FLSA, California, Illinois, and DCAA requirements, which can accelerate the translation from matrix to system configuration.
Schedule an annual review of this matrix. State labor rules change, new jurisdictions are added as your organization grows, and DCAA guidance evolves. Treat this matrix as a living document, not a one-time deliverable.
Expected outcome: A completed jurisdiction-rule matrix specifying every timekeeping obligation by state and employee group, ready to drive system configuration and policy documentation.

Download the procedure above

How to Validate Time Data Before Each Payroll Run

intermediate · Executed every pay period

This procedure confirms that all time records are complete, approved, and accurately mapped to payroll codes before the payroll calculation executes. Executed by payroll administrators on each pay-period close, it produces a validated time-data export with zero unresolved exceptions and is the primary control preventing payroll errors from reaching employee paychecks.

1. Pull the Exception Report
Prerequisites
- All employee timesheets submitted and manager-approved for the pay period
- Timekeeping system export generated in payroll-system-compatible format
- Exception report (missing punches, unapproved OT, unresolved edits) pulled from timekeeping system
- Prior-period reconciliation file available for comparison
Extract all flagged records from the timekeeping system for the current pay period. Common exception types include:
- Missing clock-outs (employee clocked in but no corresponding clock-out recorded)
- Unapproved overtime (OT hours without manager authorization)
- Edits without documented reasons (a red flag for audit purposes)
- Employees with zero hours in a scheduled workweek (potential missed punches or leave not recorded)
EasyClocking by WorkEasy Software surfaces these exceptions automatically through its timesheet exception workflow, flagging missing punches, late arrivals, early departures, no-shows, and unusual hours before payroll runs rather than after employees receive incorrect paychecks. Review every line on the exception report. Do not proceed to the next step until you have read the full report.
Expected outcome: A complete exception report listing every flagged time record for the current pay period, with no records overlooked.
2. Resolve Missing Punches
Prerequisites
- Exception report reviewed (Step 1)
Contact the employee and their manager for each missing punch. Obtain a written statement confirming the actual time worked, and enter the correction into the timekeeping system with a documented reason. The audit trail must show who made the correction, when, and why.
For field workers on job sites, missing punches often result from dead zones where mobile clock-ins fail to sync. For warehouse and manufacturing employees, missed punches may occur at shift transitions when lines are moving and workers forget to punch. Whatever the cause, resolve each missing punch individually. Batch corrections without employee-specific documentation create audit liability.
If you cannot reach the employee before payroll close, document the attempt and escalate to the department supervisor for a best-estimate entry with a notation that the employee must confirm the time on their next working day.
Expected outcome: Every missing punch is resolved with a documented correction, and the exception report shows zero remaining missing-punch flags.
3. Confirm Overtime Authorization
Prerequisites
- Exception report reviewed (Step 1)
Verify that all overtime hours in the time-data export carry manager approval. Check two dimensions:
- Weekly OT: All hours above 40 in the workweek must be approved.
- Daily OT (California): All hours above 8 in a workday for California-sited employees must be approved and calculated at the correct rate (1.5x for hours 8 through 12; 2x for hours beyond 12).
If the timekeeping system shows OT hours without manager approval, contact the manager before the payroll deadline. Unapproved OT that is legitimately worked must still be paid under FLSA; you cannot withhold pay because the OT was not pre-approved. However, documenting the approval gap is important for internal policy enforcement and for your audit trail.
Expected outcome: All overtime hours carry documented manager approval, and California daily OT is calculated at the correct rate.
4. Cross-Check Headcount
Prerequisites
- Time-data export and payroll active roster available
Confirm that the number of employees in the time-data export matches the active headcount in the payroll system. Flag any discrepancy before proceeding. Common causes of mismatches include:
- New hires added to payroll but not yet enrolled in the timekeeping system
- Terminated employees still appearing in the timekeeping export
- Temporary or seasonal workers in staffing or construction who joined mid-period
A headcount mismatch means either someone will not be paid or someone who should not be paid will receive a paycheck. Both outcomes create liability. Pull the active roster from both systems, sort alphabetically, and compare line by line. For organizations with seasonal fluctuations in construction, warehousing, or staffing, this step is especially important during onboarding and offboarding surges.
Expected outcome: The employee count in the time-data export matches the active headcount in the payroll system exactly, with every discrepancy investigated and resolved.
5. Validate Pay-Code Mapping
Prerequisites
- Time-data export and payroll earning-code table available
Confirm that regular, OT, double-time, PTO, and holiday codes in the time-data export map to the correct payroll earning codes. A single mapping error can mispay an entire employee group for the full pay period.
Open the time-data export file and the payroll system's earning-code table side by side. Verify each code pair:
- Regular hours map to the regular earning code
- OT hours map to the OT earning code (not the regular code)
- Double-time hours (California) map to the double-time earning code
- PTO and holiday hours map to their respective codes
EasyClocking by WorkEasy Software supports 20+ direct and file-based payroll integrations that pre-map these codes during initial configuration. Even so, verify the mapping every pay period. Code tables can change when payroll administrators add new earning types or when the payroll vendor releases updates.
Expected outcome: Every time-code in the export maps to the correct payroll earning code, with no mismatches.
6. Run a Gross-Pay Spot-Check
Prerequisites
- Pay-code mapping validated (Step 5)
Select a random sample of employees and manually calculate their expected gross pay from the time records. Compare the manual calculation to the payroll system's calculated gross for each selected employee.
Include at least one employee from each of these categories in your sample:
- A non-exempt hourly employee with overtime
- A California-sited employee (to verify daily OT and double-time calculations)
- A salaried non-exempt employee (this group's OT is frequently miscalculated because managers assume "salaried" means exempt)
- An employee with a mid-period rate change, department transfer, or job-code change
Investigate any variance. Even small discrepancies can indicate a systemic mapping or rounding error that affects the entire payroll population.
Expected outcome: The manual gross-pay calculations match the payroll system's calculations for all sampled employees, with any variances investigated and resolved.
7. Lock the Time Period
Prerequisites
- All exceptions resolved and spot-check passed
Once all exceptions are resolved and the spot-check passes, lock the pay period in the timekeeping system. A locked period prevents post-approval edits that could create discrepancies between the time records and the payroll run.
Confirm the lock by attempting a test edit on a record within the locked period. The system should reject the edit or require an administrative override with a documented reason. If the system allows edits without restriction after locking, escalate to your system administrator or vendor. The platform from EasyClocking by WorkEasy Software enforces period locks through role-based access controls, ensuring that only authorized administrators can unlock a closed period, and any post-lock edit is logged in the audit trail.
Expected outcome: The pay period is locked in the timekeeping system, and post-approval edits are blocked or require documented administrative override.
8. Archive the Validated Export
Prerequisites
- Pay period locked (Step 7)
Save the locked export file with a timestamp and pay-period identifier to the compliance records folder. This file is the primary audit artifact for this pay period. Follow your organization's retention policy (see Procedure 5 in this hub) for storage format, location, and retention duration.
At minimum, retain the following for each pay period:
- The locked time-data export file
- The exception report (showing zero unresolved exceptions)
- The spot-check log documenting which employees were sampled and the results
These three documents, together with the system's audit trail, form the complete evidentiary record you would produce in a DOL or DCAA audit (see Procedure 4 in this hub).
Expected outcome: The validated export file, exception report, and spot-check log are archived with a timestamp in the compliance records folder per the organization's retention policy.

Download the procedure above

How to Prepare a Timekeeping Records Package for a DOL or DCAA Audit

advanced · Depends on audit scope and records accessibility

This procedure assembles, organizes, and verifies the time and payroll records required to respond to a Department of Labor wage-hour investigation or a DCAA timekeeping audit. Executed by HR compliance and payroll leads upon receipt of an audit notice, it produces a complete, organized records package delivered within the agency's response window.

1. Confirm the Audit Scope
Prerequisites
- Audit notice received with specified record period and employee scope identified
- Legal counsel or HR compliance lead designated as audit point of contact
- Access to timekeeping system historical records for the full audit period (minimum 3 years for FLSA)
- Payroll records for the same period available in exportable format
Read the audit notice carefully and identify three things: the exact date range, the employee population in scope, and the specific record types requested. Do not produce records outside the stated scope unless legal counsel advises otherwise.
Create a scope document listing these three parameters and share it with every team member involved in the records assembly. Misunderstanding the scope is one of the most common causes of delayed audit responses. If the notice is ambiguous, have legal counsel contact the auditing agency for clarification before you begin pulling records.
For DOL wage-hour investigations, the scope typically covers non-exempt employees for a specific date range. For DCAA audits, the scope typically covers employees who charged time to a specific contract during a specific period.
Expected outcome: A written scope document identifying the date range, employee population, and record types requested, shared with all team members involved in records assembly.
2. Pull Timekeeping Records for the Full Scope
Prerequisites
- Scope document completed (Step 1)
Export all time records for every employee in scope for every pay period in the audit window. The export must include:
- Clock-in and clock-out times for every shift
- Break-period start and end times
- Overtime hours (daily and weekly)
- All edits to time records, including the editor's identity, timestamp, and reason
EasyClocking by WorkEasy Software retains historical punch data, edit logs, approvals, and break attestations in its audit trail, allowing you to export a complete record set for any date range. If you are using a system that does not retain full historical records, this gap will become apparent here and should be flagged immediately for legal counsel.
Verify the export is complete by checking the first and last pay periods in the audit window and confirming the employee count matches the scope document.
Expected outcome: A complete time-records export covering every employee, pay period, and record type in the audit scope, with no gaps.
3. Pull Corresponding Payroll Records
Prerequisites
- Payroll records for the audit period available in exportable format
Export payroll registers for the same employee population and date range. The payroll export must show hours paid (regular, OT, double-time), deductions, and gross and net pay for each employee and pay period.
If your payroll system and timekeeping system are separate platforms, confirm that the employee identifiers (employee ID, SSN last four, or other matching key) align between the two exports. Mismatched identifiers make reconciliation in Step 4 unreliable.
For organizations that have changed payroll providers during the audit window, you may need to pull records from the legacy provider as well. Confirm access to legacy data before the response deadline.
Expected outcome: A complete payroll-register export covering every employee and pay period in the audit scope, with employee identifiers that match the timekeeping export.
4. Reconcile Time Records to Payroll Records
Prerequisites
- Timekeeping and payroll exports completed (Steps 2 and 3)
For every employee and every pay period in scope, confirm that hours recorded in the timekeeping system match hours paid in the payroll system. Document and explain any variance.
Common causes of variance include:
- Rounding differences between the timekeeping and payroll systems
- Manual adjustments entered directly in payroll but not reflected in the timekeeping system
- PTO or holiday hours recorded differently in each system
- Mid-period rate changes that affected pay calculations
Prepare a written explanation for each variance. Auditors will ask about discrepancies; having documented explanations ready demonstrates control and good faith. If you discover a variance that resulted in underpayment, consult legal counsel about remediation before the audit response.
Expected outcome: A reconciliation log showing that hours in the timekeeping export match hours paid in the payroll system for every employee and period, with documented explanations for any variance.
5. Compile the Audit Trail Log
Prerequisites
- Access to timekeeping system historical audit trail
Extract the system's change log for every time record in the audit scope. The audit trail log should show every edit, including:
- The record that was edited (employee, date, field changed)
- The editor's identity
- The timestamp of the edit
- The stated reason for the edit
If your system does not produce a consolidated audit trail export, you may need to pull edit logs record by record, which is time-intensive. The platform from EasyClocking by WorkEasy Software provides a consolidated audit trail export covering punches, edits, approvals, and payroll syncs, designed specifically for audit-response scenarios.
Review the audit trail for any edits that lack a documented reason. If you find any, document the gap and prepare an explanation for the auditor rather than attempting to retroactively add reasons.
Expected outcome: A complete audit trail log covering every edit to a time record in scope, with editor identity, timestamp, and reason for each edit.
6. Prepare Employee Classification Documentation
Prerequisites
- HR records for employees in audit scope accessible
Assemble FLSA exemption determinations for every employee in the audit scope. For each employee, the package should include:
- The job description on file during the audit period
- The salary basis confirmation (if exempt)
- The exemption category applied (executive, administrative, professional, computer, outside sales)
- Any reclassification documentation if the employee's status changed during the audit period
DOL investigators frequently challenge exemption classifications. A missing or outdated job description is often treated as evidence that the classification was not properly analyzed. If you discover classification documentation gaps during this step, flag them for legal counsel immediately.
Expected outcome: A classification documentation file for every employee in scope, including job descriptions, salary basis confirmations, and exemption category determinations.
7. Organize the Package by Agency Format
Prerequisites
- All records compiled (Steps 2 through 6)
Structure the records package according to the auditing agency's expected format:
- DOL wage-hour audits: Organize by employee, then by pay period within each employee file. Include timekeeping records, payroll records, the reconciliation log, and classification documentation for each employee.
- DCAA timekeeping audits: Organize by contract number, then by employee and cost objective. Include daily time entries, supervisor approvals, and labor distribution records for each contract.
Confirm the required format with legal counsel before assembling the final package. Some regional DOL offices have specific submission requirements (electronic format, physical binders, or a combination). Meeting the format requirement on the first submission avoids delays and additional requests.
Expected outcome: A records package organized in the format specified or expected by the auditing agency, ready for pre-submission review.
8. Conduct a Pre-Submission Review
Prerequisites
- Complete records package assembled (Step 7)
Have legal counsel or a senior HR compliance officer review the complete package before submission. The reviewer should check for:
- Missing records for any employee or pay period in scope
- Inconsistencies between the timekeeping records, payroll records, and reconciliation log
- Audit trail entries that may require additional written explanation
- Classification documentation gaps that need to be addressed in a cover letter
Do not submit the package without this review. A single inconsistency discovered by the auditor, rather than disclosed proactively by you, shifts the investigation's tone from cooperative to adversarial. Submit the package within the agency's response window. If you need additional time, have legal counsel request an extension in writing before the deadline.
Expected outcome: Legal counsel or a senior HR compliance officer has reviewed and approved the complete records package, and all gaps or inconsistencies are documented with written explanations before submission.

Download the procedure above

How to Establish a Timekeeping Records Retention and Access Policy

intermediate · Initial setup plus annual review cycle

This procedure defines how long time and payroll records are stored, in what format, and who can access or request them under FLSA, state law, and DCAA requirements. Executed by HR compliance leads during initial compliance program setup or after a records-gap finding, it produces a written retention policy and a configured records-management system.

1. Set the Baseline FLSA Retention Schedule
Prerequisites
- Jurisdiction-rule matrix completed (Procedure 2) identifying retention periods by state
- IT or records-management system access confirmed for archiving configuration
- Legal counsel sign-off on retention schedule obtained
- Employee handbook section on timekeeping records access drafted for review
Configure your records storage to retain payroll records (including time records) for a minimum of 3 years and wage-computation records (rate tables, work schedules, additions to or deductions from wages) for a minimum of 2 years, per 29 CFR § 516.5 and § 516.6.
In practice, apply the 3-year minimum to all timekeeping and payroll records rather than attempting to separate the 2-year and 3-year categories. The incremental storage cost is negligible, and maintaining a single retention floor simplifies compliance. IRS employment tax record requirements generally call for 4 years of retention; apply the longer IRS period as the controlling standard when the records serve both FLSA and tax purposes.
Document the baseline retention schedule in a written policy document that will become the foundation for state-specific overlays in the next steps.
Expected outcome: A documented baseline retention schedule specifying a minimum of 3 years for all timekeeping and payroll records, with a notation to apply the 4-year IRS standard where applicable.
2. Apply State-Law Retention Overlays
Prerequisites
- Jurisdiction-rule matrix completed (Procedure 2)
Review the jurisdiction-rule matrix (produced in Procedure 2) and identify every state that requires a retention period longer than the FLSA baseline. Where a state rule exceeds the federal floor, apply the state period as the controlling standard for employees in that state.
For example, California requires employers to retain wage statements for a minimum of 3 years under Labor Code § 226, which matches the FLSA baseline for payroll records but may exceed the 2-year FLSA minimum for wage-computation records specifically. Apply the longer period.
For organizations operating in multiple states, the simplest approach is to apply the longest applicable retention period across all employees unless the records-management system can apply state-specific retention rules at the employee level. EasyClocking by WorkEasy Software includes pre-built retention schedules for FLSA, California, Illinois, and DCAA requirements, with configurable rules that can be applied by employee group or work-site location.
Expected outcome: State-specific retention overlays are documented in the retention policy, and the longest applicable period is identified as the controlling standard for each employee group.
3. Apply DCAA Retention Requirements
Prerequisites
- List of active and completed government contracts with final payment dates
For employees who charge time to federal contracts, apply the DCAA retention requirement: retain timekeeping records for the duration of the contract plus 3 years after final payment, per FAR 4.703.
This requirement often exceeds both the FLSA and state-law retention periods, especially for long-duration contracts. A 5-year contract with a 3-year post-payment retention window means records must be retained for 8 years or more.
Tag DCAA-covered records separately in your records-management system so they are not inadvertently destroyed when the standard FLSA retention period expires. If your system does not support record-level retention tagging, create a separate archive folder for DCAA records and apply a manual hold.
Expected outcome: DCAA-covered records are tagged for extended retention (contract duration plus 3 years after final payment), and separate archiving prevents premature destruction.
4. Define the Approved Storage Format
Prerequisites
- IT or records-management system access confirmed
Specify whether records are retained in the timekeeping system's native format, exported to a document-management system, or both. The chosen format must be:
- Tamper-evident: It must be clear if a record has been altered after archiving.
- Retrievable: You must be able to locate and produce any specific employee's records within the timeframe an auditing agency requires.
- Durable: The format must remain readable for the full retention period. Proprietary formats that depend on a specific software version create risk if you change vendors.
For most organizations, retaining records in the timekeeping platform's cloud-based archive and exporting a redundant copy in a standard format (PDF, CSV, or XML) to a document-management system provides both convenience and durability. The system from EasyClocking by WorkEasy Software stores records in encrypted cloud databases and supports export in standard formats for redundant archiving.
Expected outcome: A documented storage-format standard specifying the primary archive location, redundant export format, and tamper-evidence and retrievability requirements.
5. Configure Automated Retention Alerts
Prerequisites
- Retention schedule finalized (Steps 1 through 3)
Set system reminders that fire 90 days before any record cohort reaches its scheduled destruction date. The alert should notify the HR compliance lead and the records-management administrator so they can confirm that destruction is authorized before deletion occurs.
Automated alerts prevent two common failures:
- Premature destruction: Records deleted before the retention period expires, creating a gap that is difficult or impossible to fill at audit time.
- Indefinite retention: Records kept far beyond the required period, increasing storage costs and data-breach exposure without compliance benefit.
Test the alert system by setting a test cohort with a near-term destruction date and confirming the alert fires correctly. Document the test in your compliance log.
Expected outcome: Automated alerts are configured and tested, firing 90 days before each record cohort's destruction date and notifying the designated compliance staff.
6. Define Employee Access Rights
Prerequisites
- Employee handbook section on records access drafted
Document the process by which employees can request their own time records. Publish this process in the employee handbook and ensure managers and HR staff can direct employees to it.
Key requirements by jurisdiction:
- California: Employees are entitled to copies of their time records within 21 days of a written request under Labor Code § 226.
- FLSA (federal): FLSA does not mandate employee access to records, but providing access is a best practice that supports the fairness-first approach to timekeeping. Employees who can verify their own records are more likely to report discrepancies early, before they become payroll errors.
The platform from EasyClocking by WorkEasy Software provides employee self-service access to schedules, hours worked, previous punches, and time-off balances from mobile, web, or time clock devices, reducing the administrative burden of formal records requests.
Expected outcome: A published employee records-access process specifying how to submit a request, the response timeline by jurisdiction, and the format in which records will be provided.
7. Conduct an Annual Retention Audit
Prerequisites
- Retention policy and storage system configured (Steps 1 through 5)
Once per year, pull a sample of records from each retention cohort and verify that they are intact, retrievable, and stored in the approved format. The annual audit should confirm:
- Records are accessible within a reasonable timeframe (test retrieval speed)
- No records have been inadvertently deleted or corrupted
- DCAA-tagged records remain under hold and have not been released for destruction prematurely
- The retention policy still reflects current FLSA, state-law, and DCAA requirements (update the jurisdiction-rule matrix if laws have changed)
Document the audit results and any corrective actions taken. This annual step is what makes the retention policy a living compliance control rather than a one-time document. Schedule the annual retention audit on your compliance calendar alongside the annual review of the jurisdiction-rule matrix (Procedure 2, Step 7).
Expected outcome: An annual retention audit report confirming that records are intact, retrievable, stored in the approved format, and that the retention policy reflects current legal requirements.

Download the procedure above

How to Build Audit-Ready Timekeeping: 5 Procedures for HR and Payroll Leaders | EasyClocking by WorkEasy Software

Not Ready for a Quote? Start Here.

How to Configure a Legally Compliant Timekeeping System

1. Define Clock-In and Clock-Out Rules

2. Separate Exempt and Non-Exempt Employee Profiles

3. Enable Immutable Audit Trail

4. Configure State-Specific Overtime and Break Rules

5. Map Timekeeping Output Fields to Payroll Input Fields

6. Run a Parallel Test Period

7. Obtain Employee Acknowledgment

How to Map Timekeeping Rules Across FLSA and State Jurisdictions

1. List Every State Where Employees Physically Perform Work

2. Apply the FLSA Baseline Rule Set

3. Layer California-Specific Rules for CA-Sited Employees

4. Layer Illinois-Specific Rules for IL-Sited Employees

5. Determine DCAA Applicability

6. Identify Conflicts Between Federal and State Rules

7. Produce the Jurisdiction-Rule Matrix

How to Validate Time Data Before Each Payroll Run

1. Pull the Exception Report

2. Resolve Missing Punches

3. Confirm Overtime Authorization

4. Cross-Check Headcount

5. Validate Pay-Code Mapping

6. Run a Gross-Pay Spot-Check

7. Lock the Time Period

8. Archive the Validated Export

How to Prepare a Timekeeping Records Package for a DOL or DCAA Audit

1. Confirm the Audit Scope

2. Pull Timekeeping Records for the Full Scope

3. Pull Corresponding Payroll Records

4. Reconcile Time Records to Payroll Records

5. Compile the Audit Trail Log

6. Prepare Employee Classification Documentation

7. Organize the Package by Agency Format

8. Conduct a Pre-Submission Review

How to Establish a Timekeeping Records Retention and Access Policy

1. Set the Baseline FLSA Retention Schedule

2. Apply State-Law Retention Overlays

3. Apply DCAA Retention Requirements

4. Define the Approved Storage Format

5. Configure Automated Retention Alerts

6. Define Employee Access Rights

7. Conduct an Annual Retention Audit

How These Procedures Connect

Next steps