A compliance analysis is a structured review of whether your business operations match the laws, regulations, and internal policies that apply to your industry. It identifies the gap between what you are doing and what regulators expect, scores how serious each gap is, and prescribes specific fixes. Done well, it surfaces problems while you still have the option to correct them voluntarily. Done poorly, or not at all, it leaves you learning about the same problems from an enforcement agency, usually with penalties attached.
The concept is simple. The execution is where companies struggle: knowing which frameworks apply, who owns the review, what documents to pull, how to score what you find, and what to do about it.
What a Compliance Analysis Covers
The first job is identifying which regulatory frameworks actually govern your operations. Assuming one does not apply to you when it does is one of the more expensive errors a business can make. The frameworks below are the ones that drive most private-sector reviews.
The Sarbanes-Oxley Act requires publicly traded companies to maintain strict internal controls over financial reporting. Section 404 requires management to assess and report on those controls, and for larger filers, an independent auditor must separately attest to that assessment.1U.S. Department of Labor. Sarbanes-Oxley Act of 2002 Under SEC Rule 10b-5, fraud or deception in the purchase or sale of securities is illegal, which covers misleading statements and deliberate omissions of material facts.2Electronic Code of Federal Regulations. 17 CFR 240.10b-5 – Employment of Manipulative and Deceptive Devices
The Fair Labor Standards Act sets the floor for minimum wage, overtime, and recordkeeping across most private-sector and government employers.3U.S. Department of Labor. Wages and the Fair Labor Standards Act Covered nonexempt employees must receive overtime at one-and-a-half times their regular rate for hours worked beyond 40 in a workweek.4U.S. Department of Labor. Handy Reference Guide to the Fair Labor Standards Act OSHA separately requires most employers to maintain records of work-related injuries and illnesses using the OSHA 300 Log, the 300-A Summary, and the 301 Incident Report.5Occupational Safety and Health Administration. 29 CFR 1904.29 – Forms
Organizations that handle protected health information fall under the HIPAA Privacy Rule, which governs how that data can be used and disclosed. It applies to health plans, healthcare clearinghouses, and healthcare providers that conduct electronic transactions.6U.S. Department of Health and Human Services. The HIPAA Privacy Rule Companies that sponsor employee benefit plans face separate filing obligations under ERISA, including Form 5500, which calendar-year plans generally must file electronically through the DOL’s EFAST2 system by July 31 of the following year, with a possible extension to October 15.
Public companies now also have to disclose material cybersecurity incidents on SEC Form 8-K within four business days of determining the incident is material.7U.S. Securities and Exchange Commission. Form 8-K That obligation catches a lot of boards off guard.
Who Runs the Analysis
A compliance analysis only works if someone with real authority and independence owns it. In most mid-size and large organizations, that is a chief compliance officer or a designated compliance team leader. The role needs three things to function: independence from revenue-driven decisions, access to information and people across every department, and the authority to escalate issues or block activities that cannot be brought within legal boundaries. When any one is missing, the analysis becomes performative.
The compliance officer should report findings directly to the board of directors or a board-level compliance committee. Compliance problems often implicate the decisions of senior management, so if the person identifying violations reports to the people creating them, the review is compromised before it begins.
Internal or External Review
Internal reviews, conducted by your own staff, are flexible and can target specific operational areas. They are useful for ongoing monitoring and for catching problems before an outside regulator does. The downside is potential bias and the fact that internal teams sometimes lack the specialized knowledge to interpret complex or newly enacted regulations.
External reviews, conducted by third-party auditors or consultants, bring independence and specialized expertise. Public companies are already required to undergo independent financial audits, and SOX Section 404 mandates external auditor attestation of internal controls for larger filers.8Securities and Exchange Commission. Disclosure Required by Sections 406 and 407 of the Sarbanes-Oxley Act of 2002 Private companies that are not legally required to hire outside auditors often benefit from doing so anyway, particularly when entering new markets or facing regulatory scrutiny.
The most effective approach uses both. Regular internal monitoring throughout the year, pressure-tested by periodic external reviews. SEC guidance for registered investment advisers requires compliance policy reviews no less frequently than annually, and recommends treating the review as an active, ongoing process rather than a once-a-year event.
What to Pull Together Before You Start
Incomplete records trigger immediate red flags for regulators, and reconstructing missing documents during an active review is expensive and unconvincing. Collect everything first.
Financial statements, including balance sheets and income statements, form the backbone of any analysis involving fiscal transparency. For public companies, these should be reconciled against SEC Form 10-K filings to confirm consistency between internal books and public disclosures.9U.S. Securities and Exchange Commission. Form 10-K Annual Report
Employment records serve double duty. Every employer must complete a Form I-9 for each employee to verify identity and work authorization, and must keep a Form W-4 on file to determine income tax withholding.10Internal Revenue Service. Hiring Employees Payroll registers and timecards confirm that overtime calculations comply with FLSA requirements.3U.S. Department of Labor. Wages and the Fair Labor Standards Act Workplace safety records round out the core set: OSHA Form 300 logs, annual summaries, and incident reports must be current and complete.11Occupational Safety and Health Administration. Injury and Illness Recordkeeping Forms Pull previous audit reports as well; they identify recurring issues and areas flagged for improvement in earlier cycles.
How Long to Keep Records
Retention periods vary by record type and governing agency. The safest approach is to follow the longest applicable requirement.
- Employment tax records: at least four years after the tax becomes due or is paid, whichever is later.12Internal Revenue Service. How Long Should I Keep Records
- OSHA injury and illness records: five years following the end of the calendar year they cover.13Occupational Safety and Health Administration. 29 CFR 1904.33 – Retention and Updating
- General payroll and accounting records: seven years is the common standard for accounts payable, accounts receivable, expense records, and employee files.
- Financial statements, tax returns, and benefit plans: retain permanently.
Destroying records too early is one of the few compliance mistakes that is almost impossible to fix after the fact. When in doubt, keep the document.
How the Gap Analysis Works
The core of the review is a side-by-side comparison of what your organization is doing against what the law requires. It runs in three phases.
Map the Requirements
Translate each applicable regulation into concrete, measurable obligations. A general sense that HIPAA applies to you is not useful. What is useful is breaking that down: who can access patient data, how it must be encrypted, what the breach notification timeline is, and who is responsible for each control. Legal counsel should be involved for complex or newly enacted regulations, since misinterpreting a rule at this stage compounds into larger problems downstream.
Document the Current State
Then document how things actually work today. Interview department heads, review written policies, and observe day-to-day practice. The gap between written policy and actual behavior is where most compliance failures hide. A company might have an impeccable data privacy policy on paper that nobody follows in practice. The analysis has to capture reality, not aspiration.
Score the Gaps
Each gap gets documented with a risk level. Most organizations use a matrix that scores on two dimensions: how likely a violation is and how severe the consequences would be. High-likelihood, high-severity gaps get addressed first. A missing OSHA log that could trigger fines during a routine inspection ranks higher than a formatting inconsistency in an internal policy no regulator will ever see. The scoring also drives resource allocation, since compliance budgets are finite and spending equal time on every gap wastes both. The highest-priority issues should have corrective timelines measured in days or weeks, not quarters.
Reporting and Corrective Action
The output of the analysis is a formal compliance report that lists every gap, scores its risk level, and prescribes specific remediation steps. It goes to the board of directors and senior management. The purpose is not to produce a document that sits in a drawer; it is to give leadership a clear picture of where the organization stands and what needs to happen next.
An effective report includes an executive summary that surfaces the highest-risk findings immediately, a methodology section explaining the scope of the review, and a detailed findings section that links each gap to the specific regulatory provision it violates. Vague findings like “improve data handling” are useless. Actionable findings look like: the marketing department stores unencrypted customer health data on a shared drive accessible to 47 employees, violating HIPAA minimum necessary standards; migrate to an access-controlled system by Q2.
For every gap, the report should include a corrective action plan that specifies what needs to change, who is responsible, what resources are required, and when the fix must be done. Remediation varies with the violation:
- FLSA overtime violations typically require back-paying affected employees, recalculating payroll going forward, and retraining managers on exempt versus nonexempt classifications.
- HIPAA data handling gaps might require updating encryption protocols, restricting database access, and revising employee training on patient data privacy.14U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule
- SOX internal control deficiencies may involve redesigning approval workflows, adding segregation of duties, or hiring additional qualified personnel for financial oversight.
Speed matters. Regulators consistently treat organizations that self-identify and quickly correct problems more favorably than those that wait until an external audit forces their hand. Build follow-up review dates into the plan to confirm each fix was actually implemented and is working.
What Non-Compliance Costs
Penalty structures vary across frameworks, but the common theme is that willful or repeated violations cost exponentially more than first-time or unknowing mistakes.
HIPAA penalties in 2026 follow a tiered structure. A violation the organization did not know about starts at $145 per incident. Willful neglect that goes uncorrected within 30 days starts at $73,011 per violation, with an annual cap of $2,190,294 per identical provision. Criminal violations involving intent to sell or misuse health data for personal gain can result in fines up to $250,000 and ten years in prison.
Under the FLSA, willful or repeated minimum wage and overtime violations carry civil penalties of up to $2,515 per violation.15eCFR. 29 CFR Part 578 – Tip Retention, Minimum Wage, and Overtime Violations That is per violation, meaning a company that miscalculates overtime for 200 employees over multiple pay periods can accumulate six-figure exposure quickly. Failing to file Form 5500 on time can trigger penalties exceeding $2,500 per day.
SOX carries the heaviest criminal penalties among these frameworks. Executives who knowingly certify a financial report that does not comply with SOX requirements face up to ten years in prison, and willful false certification carries up to twenty years.16Congress.gov. H.R.3763 – Sarbanes-Oxley Act of 2002 Criminal convictions under SEC Rule 10b-5 can result in up to 20 years in prison and fines of $5 million for individuals or $25 million for corporations. These are not abstract threats, and the referrals land on individual executives, not just the corporate entity.
Protecting People Who Report Problems
Proactive leadership findings are only part of the picture. The analysis also depends on an environment where employees can report violations without fear of retaliation, and federal law builds specific protections into the major regulatory frameworks.
Under the Sarbanes-Oxley Act, publicly traded companies and their subsidiaries are prohibited from retaliating against employees who report conduct they reasonably believe violates securities fraud statutes, SEC rules, or other federal fraud laws. That protection applies whether the employee reports internally to a supervisor or externally to a federal agency or member of Congress.17Whistleblower Protection Program. Sarbanes-Oxley Act (SOX) – 18 USC 1514A Retaliation includes firing, demotion, suspension, threats, and harassment. An employee who prevails in a retaliation claim is entitled to reinstatement, back pay with interest, and compensation for litigation costs and attorney fees. These rights cannot be waived through employment agreements or arbitration clauses. OSHA separately protects employees who raise workplace safety concerns or report injuries from employer retaliation.18Whistleblower Protection Program. Whistleblower Protection Program
Set up an anonymous reporting channel, such as an ethics hotline, before you need one. Organizations without a safe internal reporting channel tend to learn about violations from regulators rather than employees, and by that point the opportunity for voluntary correction, and the more lenient treatment that comes with it, has already passed.