Use AI to compare a client's approved policies and contract templates against a scoped checklist, then verify each suggested gap against the document, current requirements and a sample of practice records. Record the source paragraph, risk rating, owner and proposed action in a gap matrix. Keep confidential employee files out of the prompt unless the client approves a protected workflow.
An AI-generated finding is a lead, not an audit conclusion. A missing clause may be in an appendix, an old file may not be the current version, and a polished policy may be ignored in practice. Your report should distinguish “document not supplied”, “text absent”, “text unclear” and “practice not evidenced”; those are different findings with different remedies.
Agree the audit boundary before accepting files
Start with a short written scope: business units, employee groups, document types, review period and the decisions the client needs. Ask who owns the documents, whether there is a current approved set, and whether your work is a document audit, an implementation check or both. The client may expect you to assess every employment decision ever made; a fixed-scope desk review cannot do that. Put exclusions and evidence limits in the engagement letter, with a route for issues that require a qualified employment adviser.
Request a document register rather than a bulk dump. Useful columns are file name, document type, version date, owner, approval status, population covered and whether the document is in use. A client with 25 staff may provide a handbook, two contract templates, onboarding checklist, absence procedure, grievance and disciplinary procedures, privacy notice, retention schedule and manager guidance. If a policy is missing, label that as “not provided” until the client confirms it does not exist.
Keep intake proportionate. A contract template may be enough to review standard wording; a named signed contract is needed only if the scope includes sampling actual execution. Remove names, addresses, salary and case narrative from copies used for pattern comparison. Store the unredacted original where the client's access rules require. Regulator guidance on employment records stresses a clear purpose for each record and access limited to the people who need it, so a consultant's working copy should hold no more than the scope requires. If the review concerns personal data, settle the contractual and privacy arrangements before uploading anything to an AI service.
The Complete Excel Course with AI Integration
From formulas and pivot tables to Power Query, DAX, VBA and AI with Copilot, ChatGPT and Claude — hands-on from the first lesson.
By Sagnik Bhattacharya and Virginia Thorn, Primetime Emmy Award winner
Buy nowUse a static checklist with evidence fields
The checklist below is a review aid, not a claim that every item is legally required for every employer. Record the applicable rule or client commitment beside each item. “Pass” should mean that the document and a selected practice sample support it. “Open” means a specific question remains. A polished AI answer is not evidence that a policy was issued, signed or followed.
| Area | Document question | Practice evidence to sample | Typical gap |
|---|---|---|---|
| Contracts | Are current templates approved and complete for the relevant role? | Two recent signed files, with identities masked for review | Old wording still used |
| Onboarding | Does the checklist allocate owners and deadlines? | Recent starter records and access acknowledgements | Checklist exists but no completion trail |
| Leave and absence | Are notice, recording and escalation steps clear? | Aggregate logs and selected redacted cases | Different managers apply different rules |
| Conduct | Are reporting and review routes stated? | Training or briefing records, not case merits | Policy names a role that no longer exists |
| Data handling | Are access, retention and deletion responsibilities recorded? | Access list and a disposal example | Files remain in shared folders indefinitely |
| Handbook control | Is there one current issued version? | Issue log and acknowledgements | Two conflicting copies circulate |
Make the matrix answer four questions for each item: what did you inspect, what precisely did you observe, why might it matter, and what would close it? Use a status such as confirmed gap, possible gap, not evidenced or outside scope. Give every row a source file and page or section. If AI cannot quote the location accurately, the row stays unverified. Avoid colour-only red, amber and green labels; include text so the matrix works when printed or read with assistive technology.
Run a narrow AI comparison and keep its trail
Separate the documents into manageable areas. For example, compare only the current onboarding checklist with the client's stated onboarding standard. Give the assistant the checklist and a list of expected questions, asking it to return a table of exact supporting passages and unresolved questions. Do not ask it to “certify compliance”. A model cannot know which law applies, whether the file is current or how a manager actually handles a case unless you supply that evidence and a qualified person assesses it.
Act as a document comparison assistant for a consultant. Use only the supplied approved onboarding checklist and the client standard below. For each requirement, quote the source section or write "not found in supplied document". Classify your result as supported, unclear or not found; do not call it unlawful. Return a question for a human reviewer and a proposed evidence sample. Do not use outside rules or invent a policy. Client standard: every starter receives an access briefing, a handbook acknowledgement and a named first-week contact.An illustrative result might mark “named first-week contact” as absent because the checklist says “manager to welcome starter” but does not assign a person. The consultant would inspect the full file and perhaps discover a separate welcome-email template with the manager's name. The corrected matrix row could say “unclear in checklist; welcome email template supplies a named contact, but issuance not yet sampled”. That is a more accurate finding than the model's first “missing” flag.
Keep the prompt, model output, source version and your correction in an audit trail. Use a business account that meets the client's confidentiality requirements, and ask who may read chat history or exports. OpenAI says ChatGPT Business content is excluded from training by default; Anthropic says that on Claude for Work (its Team and Enterprise plans) the customer is the controller of the data its users submit, and Anthropic processes that data only to provide the service on the customer's behalf. Neither statement authorises an indiscriminate upload of confidential personnel cases. Review contract terms, retention, access and the client's approval for the actual service being used.
Rate each finding by evidence and consequence
A risk score should guide attention, not disguise uncertainty. Use three fields: potential consequence, likelihood that the issue occurs in the client process, and confidence in the evidence. Do not multiply arbitrary numbers and treat the result as a legal verdict. If no signed contract sample has been seen, confidence is low even if a template looks poor. A high-consequence issue with weak evidence may warrant immediate fact-finding, while a low-consequence formatting problem can wait for the next controlled revision.
Illustrative worked audit: a 25-person bicycle repair chain supplies 14 documents. The agreed fee covers six policy areas and a sample of eight records. AI suggests 17 possible gaps. The consultant checks every suggestion against the source and finds six misreadings, three duplicate points and two issues already addressed in an appendix. Six remain for evidence checks. Of those, two are confirmed gaps, three are unclear pending manager records and one falls outside scope. The client report must show those counts, not proclaim “17 compliance failures”.
One confirmed example is a handbook that names an obsolete inbox for reporting concerns. The consequence could be missed reports; confidence is high because the current handbook and IT owner both confirm the address has been retired. The action is to replace the address, test the replacement, issue a controlled version and tell staff where to report. Another row, “managers never complete onboarding”, is a weak inference from blank fields in one file. Sample more recent records before assigning it a rating.
The eight sampled records should be selected to test variation: newer and older starters, at least two manager groups where feasible, and any process change dates. Document the selection rule before looking at the files. If six of eight have acknowledgements, do not present “75% compliance” as an organisation-wide estimate from a tiny purposive sample. Say that two sampled files lacked evidence, identify which process needs a wider check, and ask the client whether the sampling scope should expand.
Five specific false positives to catch
A version mix-up: an illustrative HVAC contractor sends a draft 2024 absence policy and an approved 2026 copy. AI reviews both and calls their different reporting windows “inconsistent”. The issue is document control, not necessarily conflicting live instructions. Ask which version staff received, archive the draft and test the distribution record. The report can still note that the old copy was accessible if it was in a shared folder.
A missing appendix: a handbook says “see Schedule B” for a conduct appeal route. If Schedule B was omitted from the upload, the assistant may declare that no appeal route exists. Mark the row “not evidenced in files supplied” and request the schedule. Do not convert an intake gap into a substantive finding. This distinction prevents a client from paying for needless rewriting.
A clause taken out of context: a template says a manager “may” approve a flexible start. AI rewrites it as “must approve”. Put the complete paragraph beside the proposed finding and compare the actual discretion. A single word can change the client's obligation. For material contract terms, have a qualified adviser review the wording before it enters a recommendation.
A fabricated citation: the model gives a section number that does not exist. Search the source for the quoted phrase and open the page yourself. If no passage matches, delete the citation and reclassify the row as unverified. The audit trail should record the correction so another reviewer does not assume the AI's page reference was checked.
A practice assumption: an onboarding checklist includes “send handbook”, so AI reports that all staff received it. A checklist instruction proves only intended process. Ask for a small issue-log sample or acknowledgements. If those are unavailable, the correct status is “practice not evidenced”. The difference matters to a client deciding whether to improve a document or manager follow-through.
Build the report around decisions the client can take
Use a short executive page: scope, documents received, records sampled, confirmed findings, unresolved questions and three decisions needed from the client. Attach the matrix with source references, status, consequence, confidence, proposed owner and target date. Include an appendix listing excluded material and documents requested but not received. State when the legal position needs review by a qualified employment adviser and when the conclusion is about the client's own internal standard.
A useful first-page line for the illustrative 25-person client is: “Two confirmed process gaps require owners: the retired reporting inbox and a missing handbook issue log. Three further items need records before we can judge practice. Six AI suggestions were incorrect on source review and were excluded.” This tells the client what to do without dressing a preliminary scan as an assurance opinion.
Deliver a read-only report and a working matrix that the client can update. Agree who resolves each item and how evidence of closure is accepted. A new policy text alone may not close a finding about inconsistent use. For the retired inbox, closure might require the updated handbook, a test message, evidence of staff notice and a named owner for future address changes. For a missing acknowledgement trail, closure may require a revised onboarding step plus a fresh sample after implementation.
If the client needs a broader service proposal, use the HR consultant proposal template to state sampling limits. For drafting policy changes after the audit, the HR consultant AI workflow covers source control. For an employee handbook rebuild, the handbook drafting tutorial covers that separate task. A client who wants to answer routine staff questions should read the HR helpdesk tutorial after the source policies have been approved.
Repeat a smaller check after the fixes
Before handing over the report, run a challenge meeting with the document owner. Read each confirmed finding aloud with its source citation and ask: “Is this the current version, is another document relevant, and what happens in practice?” The owner may reveal an unpublished manager procedure or an exception that changes the conclusion. Record the answer as a new evidence item, not as an informal promise that a gap has disappeared. A client should have a fair chance to correct the factual record before the report is final.
Use a compact row format that can be copied into a spreadsheet: ID, area, requirement or client standard, source checked, observed text or practice, status, consequence, evidence confidence, action, owner, due date and closure evidence. In an illustrative row, HR-04 is “handbook issue control”; the source is handbook version 3 and issue log dated 12 May; the observation is that seven of eight sampled acknowledgements are present; the status is “practice gap confirmed in sample”; the action is to trace the missing acknowledgement and change the checklist control. The row does not accuse a particular manager without evidence.
Another useful test is a deliberately contradictory pair of policies. Suppose the current contract template says leave requests require two weeks' notice, while the current handbook says one week. Ask AI to extract both passages into a comparison table, then verify the quotations. Do not tell it which one is legally correct. The finding is an internal inconsistency that may confuse staff; a qualified adviser and the client must decide the approved wording. Then check whether the employee-facing portal still hosts the older version. Fixing one master file without updating the portal would leave the issue live.
For a 25-person client, budget review time by evidence, not by the number of AI output rows. One possible internal plan is 90 minutes for intake and version control, two hours for source comparisons, two hours for record sampling, an hour for challenge questions and two hours for the report and sign-off. These are illustrative planning figures, not a market fee or guarantee. If the client supplies 40 extra case files, stop and agree a changed scope; otherwise the fixed fee will quietly become an open-ended investigation.
The final report should separate urgent operational fixes from legal interpretations. If a reporting address fails, the client can often assign an owner to test and correct the channel promptly. If a contract term may be invalid, the consultant should mark the clause for qualified advice before recommending replacement text. AI can generate alternative phrasing for review, but it should not decide which legal rule applies. When writing the report, use conditional language that reflects the evidence: “The supplied template does not state…” is stronger and more defensible than “the organisation has never told staff…”.
Check confidentiality at handover too. A matrix may contain quoted personnel details even if the AI prompt did not. Replace names with record IDs, keep the mapping in the restricted client file and send the report only through the agreed channel. Ask the client to name recipients rather than forwarding it to a broad management list. If a sample uncovers an urgent individual case, move that issue to a separate confidential advice path; do not bury it in the general audit appendix or ask a chat assistant to adjudicate it.
Lastly, compare the report against the agreed scope line by line. If it claims to assess implementation, confirm the sampling method is shown. If it claims only to compare documents, remove statements about manager behaviour. Count the confirmed, unverified and outside-scope findings once, and verify that the executive page matches the matrix. A reviewer should be able to reproduce the six remaining rows in the illustrative audit without reading all 17 AI suggestions.
Schedule a closure review rather than assuming the report ends the job. Ask for the revised document, approval record and one piece of evidence that the revised process is used. Re-run only the rows that changed, compare the new version against the earlier cited section and close a row with a date and reviewer name. If the owner declines a recommendation, record that decision and the reason without quietly deleting the finding.
A reproducible audit lets another consultant follow the file register, prompt, source citation and human decision for any row. It also makes the service safer to sell: the client receives a controlled checklist and a clear limit on the assurance provided, while AI handles comparison and drafting work that a human checks. The quality test is whether each reported gap can be traced back to real evidence and whether a client knows the next action.
Further reads
- HR Analytics and AI: Analyse Staff Turnover From a Spreadsheet Export — Add an aggregate staff-metrics check without sharing records.
- Employee Handbook Template for Clients: Build a Master Copy With AI — Build a controlled master handbook after the audit.
- HR Consulting AI: Sell an AI Policy and Handbook Update Package — Package an AI policy update as a separate deliverable.
- AI Survey Analysis for HR Consultants: Coding Employee Comments Safely — Handle employee feedback as a separate evidence stream.
- Free AI for HR Professionals: Are Free Plans Safe With Staff Data? — Review plan and confidentiality choices.
- AI Salary Benchmarking for HR Consultants: Sources, Bands and Checks — A repeatable method for turning survey and job-advert data into pay bands with AI, plus the checks that catch invented figures.
- HR Automation AI Tools: What a Small Business Can Automate Safely — A task-by-task boundary for small-business HR automation, with review gates and practical examples.
- Best AI for Human Resources: Can It Draft a Grievance Report? — Draft a grievance investigation report from coded interview notes: allegation list, evidence matrix, neutral findings, and what must never reach an AI tool.
- AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.
Sources: OpenAI Help Center, Data controls in ChatGPT (managed workspaces); Anthropic Privacy Center, Does Anthropic Act as a Data Processor or Controller?; data-protection regulator guidance on collecting and keeping employment records.