Most employers only discover a compliance gap after it has already become a problem — a labour officer visit, a former employee's tribunal claim, or a data breach that should never have been possible. An HR audit exists to find these gaps before they find you. Below are the eight we encounter most often when we sit down with a Kenyan employer's HR file for the first time.
Why HR Audits Matter More Than Ever in 2026
Three things have changed the compliance landscape for Kenyan employers in recent years: stricter enforcement of the Data Protection Act, more employees who know their rights under the Employment Act and are willing to escalate to the Employment and Labour Relations Court, and a statutory deduction environment (NSSF, SHIF, PAYE) that has gone through real structural change. An HR practice that was "good enough" five years ago can quietly fall out of compliance without anyone noticing — until it costs you.
The 8 Gaps We See Most Often
1. Missing or Outdated Employment Contracts
Verbal agreements, contracts that were never signed, or contracts that still reference a role, salary, or reporting line the employee left behind two promotions ago. Under the Employment Act, a written contract isn't optional for most engagements — and an outdated one gives you almost no protection if a dispute reaches a tribunal.
2. Incomplete Statutory Deduction Records
NSSF, SHIF, and PAYE remittances that are made but poorly documented — no clear audit trail linking each payslip to each remittance. When a statutory body asks for three years of records during an audit, "we think we paid it" is not an acceptable answer.
3. No Documented Disciplinary Procedure
Verbal warnings that were never written down, dismissals that skipped a hearing, or a disciplinary process that exists on paper but was never actually followed in practice. This is one of the single biggest sources of successful unfair-dismissal claims we see.
4. Weak Data Protection Practices
Employee files — including national ID copies, medical information, and bank details — stored in shared drives with no access control, or retained indefinitely after an employee leaves. The Data Protection Act treats this as personal data requiring a lawful basis, defined retention period, and reasonable security, regardless of company size.
5. Inconsistent Leave Records
Annual leave, sick leave, and maternity/paternity leave tracked informally (or not at all), leading to disputes over leave balances at exit — usually at the exact moment an ex-employee is deciding whether to escalate a grievance.
6. Unverified Certificates and Work Permits
Academic and professional certificates taken at face value without verification, and foreign nationals working without a valid, current work permit. Both carry real legal and reputational exposure, and both are simple to check during onboarding.
7. No Written HR Policy Manual
Rules that exist only as "how we've always done it," inconsistently applied across departments or between an employee's first manager and their third. Without a written policy, you have no consistent standard to point to when you need one.
8. No Regular Internal HR Audits
The gap behind all the other gaps: an organization that has never systematically reviewed its own HR practice will accumulate all seven issues above without anyone deciding it should happen. Compliance drifts; it doesn't announce itself.
The Cost of Getting It Wrong
The direct costs are the obvious ones: statutory penalties, tribunal awards, and legal fees. The less obvious costs are often larger — the management time consumed by a dispute, the damage to your employer brand when former staff talk, and the risk that one weak file becomes the precedent every other disgruntled employee points to.
How a Professional HR Audit Fixes This
A structured HR audit doesn't just flag problems — it prioritizes them by actual risk, gives you a remediation plan, and (done well) leaves you with the policies and templates to stay compliant going forward rather than repeating the exercise from scratch every time. A good audit report separates what needs fixing this week from what can be scheduled over the next quarter, so you're never left with a long list and no sense of where to start.
How Often Should You Run an HR Audit?
Most organizations benefit from a full HR audit annually, with a lighter internal review at the mid-year mark. That said, certain events should trigger one outside the usual schedule regardless of when the last audit happened: a merger or acquisition, a sudden period of rapid hiring, a change in senior HR leadership, or a near-miss dispute that suggests a wider problem than the individual case. Waiting for the scheduled annual audit after one of these events is how gaps compound.
Frequently Asked Questions
What is the difference between an HR audit and a compliance check?
A compliance check typically verifies you're meeting minimum legal requirements. A full HR audit goes further — it also assesses whether your policies and practices are consistent, well-documented, and defensible if challenged, not just technically legal.
How long does an HR audit take?
For a small to mid-sized organization, a thorough audit typically takes one to three weeks depending on how well-organized existing records are — disorganized records are, on their own, usually the first finding.
Can a small business skip an HR audit if it only has a handful of employees?
No — the Employment Act and Data Protection Act apply regardless of headcount. Smaller organizations are often more exposed, not less, because they're less likely to have dedicated HR capacity catching issues as they arise.
Trinity's HR Audit & Compliance service walks through exactly these eight areas and more, benchmarked against current Kenyan employment law. If you want a fast, no-obligation first read on where you stand, our AI HR Audit Checker takes under five minutes and flags your highest-risk gaps immediately.
