Compliance on paper isn’t compliance on the ground.

A Compliance Audit is an independent, systematic review of whether an organisation is actually meeting every legal obligation that applies to it - under Labour, EHS, Secretarial, Regulatory, Finance and Taxation, FEMA, Municipal and Industry-specific laws - at each of its establishments, verified on paper and on the ground.

The scale of the rulebook is why it needs a structured audit. Businesses in India are governed by 1,536 Acts and Rules carrying 69,233 compliances, of which 26,134 carry an imprisonment clause (Jailed for Doing Business, ORF and TeamLease RegTech). These obligations come from the Union, 28 states, 8 union territories and local bodies, and they keep moving: TeamLease RegTech tracked 12,973 regulatory changes in 2025, up from 3,577 in 2021.

Imprisonment, daily-fine and personal-liability figures reflect what the relevant statute provides. Statutory exposure is not a prediction of prosecution.

Because compliance on paper and compliance on the ground are rarely the same, and the law acts on what is on the ground. An audit surfaces regulatory gaps, penalty exposure, operational risk and control weaknesses while they are still cheap and quiet to fix - before they turn into notices, prosecution, closure orders or reputational damage.

Across our wider enterprise audits, 79% compliance was the best score we found - not the average, the best. The consequences are not theoretical: the Sterlite copper plant at Thoothukudi was ordered permanently shut over consent-to-operate and hazardous-waste lapses, and MPCB have sealed units in Pune and Panipat for operating without valid consents or flouting pollution norms.

Imprisonment, daily-fine and personal-liability figures reflect what the relevant statute provides. Statutory exposure is not a prediction of prosecution.

Each audit protects something different, and none substitutes for the others:

• Statutory audit - tests financial statements, taxation and the accuracy of the books.
• Internal audit - tests business processes, SOP adherence and operational controls.
• Secretarial audit - tests Companies Act, SEBI and corporate-governance compliance under Section 204.
• Compliance audit - tests the law of the land: every applicable central, state and local requirement including licenses condition and covering each department and category of law including EHS, Labour, Secretarial, Finance, Industry Specific & Local laws. It not only includes verification of documentation but also includes physical verification of site to check all infrastructural compliances.

Yes. Software records what the team reports; SOPs describe what should happen; an audit tests what is actually happening. Most enterprises run on “registered compliance” - the assumption that a ticked box in a system matches the reality on the shop floor. That assumption is the biggest hidden risk.

Imprisonment, daily-fine and personal-liability figures reflect what the relevant statute provides. Statutory exposure is not a prediction of prosecution.

A Compliance Audit provides a comprehensive assessment of all laws applicable to a unit at the Central, State, and local levels. It covers the verification of all relevant licenses, registrations, approvals, and their respective conditions, including Consent to Operate (CTO), Environmental Clearance (EC), Fire NOC, Shop and Establishment registration, and other applicable statutory requirements.

Our auditors systematically evaluate every applicable category of law, including EHS, Labour, Secretarial, Finance, Industry-Specific, and Local Laws, based on the nature and operations of the unit.

The audit goes beyond document verification to include physical site inspections to assess on-ground compliance, validate infrastructure-related requirements, and identify gaps in the implementation of applicable statutory obligations.

EHS gaps are fewer than labour gaps but far more severe: four in five EHS findings were rated Critical or High. (Two unclassifiable findings are included in the total.)

Imprisonment, daily-fine and personal-liability figures reflect what the relevant statute provides. Statutory exposure is not a prediction of prosecution.

A small set of statutes accounts for most of the exposure, and several of them are criminal in almost every instance.

Note the pattern: 533 of 536 Factories Act findings and 244 of 245 contract labour findings carry imprisonment. These are not paperwork laws.

Imprisonment, daily-fine and personal-liability figures reflect what the relevant statute provides. Statutory exposure is not a prediction of prosecution.

Yes. Many Indian laws name individuals, not only the company. The Companies Act reaches the “officer who are in default” (MD, whole-time directors, CEO, CFO, CS); the Factories Act makes the occupier and manager liable under Section 92; the Contract Labour Act reaches the principal employer; the EPF and ESI Acts reach employers, directors and persons in charge; the Environment (Protection) Act reaches directors, plant heads and anyone responsible for the conduct of the business; state Shops & Establishments Acts reach the employer and manager.

Imprisonment, daily-fine and personal-liability figures reflect what the relevant statute provides. Statutory exposure is not a prediction of prosecution.

Across India’s full business rulebook, about 37.8% of compliances (26,134 of 69,233) carry an imprisonment clause. In our audits, 46.1% of the gaps found did. Enterprises fail disproportionately in the criminalised part of the rulebook - because the laws that carry jail terms (factory safety, contract labour, wages, social security) are also the ones that need on-ground discipline.

An imprisonment clause is a statutory exposure, not a prediction of prosecution. But it is what an inspector, a complainant or a regulator can invoke, and what a Board is accountable for.

Yes - and they are also the easiest wins. Displays, registers and returns are the most common gaps and the cheapest to close, yet many carry the same penalties as substantive breaches.

Imprisonment, daily-fine and personal-liability figures reflect what the relevant statute provides. Statutory exposure is not a prediction of prosecution.

Risk follows the sites leadership visits least. Every establishment type carried gaps:

Warehouses are the least visited and least monitored part of the footprint: they had the highest share of jail-bearing gaps (52.2%), and in our wider enterprise audits scored the lowest compliance (61%, against 70% for branches, 75% for registered offices and 79% for manufacturing). In one pharma enterprise, 84-86% compliance in core units still hid gaps of 15-35% in warehouses and branch offices. Even corporate offices averaged 57 non-compliances each.

Imprisonment, daily-fine and personal-liability figures reflect what the relevant statute provides. Statutory exposure is not a prediction of prosecution.

Very often - which is why a multi-location audit pays for itself. A gap repeated across sites usually means the requirement was never mapped as applicable at the centre, so fixing it once fixes it everywhere.

The audit covers all seven categories of law, across Union, State and local levels:

• Labour & Employment Laws, including contract labour and social security
• Environment, Health & Safety (EHS) - pollution consents, waste, fire, electrical and machinery safety
• Secretarial & Corporate Laws - Companies Act, SEBI LODR
• Finance & Taxation - GST, TDS/TCS, Professional Tax, statutory payments
• FEMA, Foreign Trade Policy & Customs
• Commercial Laws - Legal Metrology, COTPA, IT Act, MSMED Act
• Industry-specific regulations - e.g. FSSAI, Clinical Establishments, Mines & Minerals
• Factory & industrial laws, Shops & Establishments Acts, municipal and local laws
• Licences, registrations, NOCs, consents and their renewals and conditions

Coverage is customised to the organisation’s business, locations and activities.

Any organisation with a physical footprint in India, across industries - manufacturing plants, corporate and registered offices, warehouses and distribution centres, R&D centres, mines, branch, regional and zonal offices. TeamLease RegTech manages compliance for enterprises across 45+ industries, from manufacturing conglomerates to pharma, logistics and BFSI.

Yes. Audits run across multiple states, cities and establishments, with each location’s requirements mapped separately. This matters because the same central Act is implemented through different state rules, forms, registers and timelines.

No. Depending on scope, audits cover corporate offices, factories, warehouses, R&D centres, branches and every other establishment. Restricting an audit to the head office misses most of the risk.

Yes. Requirements are mapped by state, local jurisdiction, establishment type, headcount, business activity and equipment (boilers, DG sets, lifts, hazardous chemicals, groundwater use). Applicability is where most gaps begin: a requirement that was never mapped can never be complied with.

Typically 12 months, customisable to the client’s needs. Ongoing reviews can be scheduled quarterly, half-yearly or annually.

The lookback matters because the rulebook moves fast - a 12-month window in 2025 spanned nearly 13,000 regulatory changes - and because 31% of the gaps we find attract a fine for every day they continue, so the period over which a gap has persisted directly shapes the exposure.

The scope and coverage of the Compliance Audit can be customized based on the customer’s specific requirements. Customers can select individual categories of law or opt for a department-specific audit covering areas such as Labour, EHS, Finance, Secretarial, and Industry-Specific Laws.

The audit period can also be tailored to align with the customer’s requirements and objectives.

Additionally, customers can choose from flexible audit delivery models, including:

• Online / System Audit: Review of compliance records, documentation, and evidence through online systems.
• Physical Audit: On-site verification of infrastructure and implementation of applicable compliance requirements.
• Hybrid Audit: A combination of online/system-based review and physical site visits for comprehensive compliance validation.

This flexible approach enables customers to design an audit engagement that aligns with their priorities, operational needs, and desired level of assurance.

Yes, our Compliance Audit services can be extended to contractors and third-party service providers to assess their adherence to applicable statutory and regulatory requirements.

The audit can cover contractor compliance across key areas, including Labour Laws, EHS, licenses and registrations, statutory returns, employee welfare, wage and benefits compliance, and other applicable legal obligations.

Our auditors verify relevant documentation, statutory records, and compliance evidence, along with physical site inspections, wherever required. The scope can be customized based on the nature of the contractor’s activities, the services provided, the applicable laws, and the customer’s specific requirements.

This enables organizations to identify compliance gaps, mitigate third-party compliance risks, and strengthen their overall compliance oversight across their vendor and contractor ecosystem.

Imprisonment, daily-fine and personal-liability figures reflect what the relevant statute provides. Statutory exposure is not a prediction of prosecution.

A proven four-phase method, from understanding the business to verifying it on the ground:

1. Business understanding & information discovery - kick-off with key stakeholders; Business Discovery Questionnaire (BDQ); agreement on scope, methodology, timelines, roles and escalation.
2. Compliance applicability assessment - identify applicable laws; build the compliance universe and audit checklist; share the Initial Data Requirement (IDR) and collect documents.
3. Data verification & physical visit - review records; verify licences, registers, displays, infrastructure and safety on site; discuss preliminary observations with process owners.
4. Gap report finalisation - share the draft report with departments; incorporate responses; issue the final report with risk ratings and corrective actions; present to management and the Board.

Depending on scope: licences, registrations, consents and NOCs (and their conditions), returns, statutory registers, policies, agreements and contractor records, notices, approvals, certificates (lifts, boilers, pressure vessels, electrical installations), board minutes, filings and payment evidence.

Yes, our Compliance Audit includes a two-day physical site visit conducted by our auditors to verify infrastructure-related and on-ground compliance requirements.

Certain compliance aspects, such as safety arrangements, workplace infrastructure, and the actual implementation of statutory requirements, cannot be adequately assessed through documentation or compliance management tools alone. These requirements may often go unnoticed during a system-based review.

Therefore, physical site inspections play a crucial role in identifying gaps between documented compliance and actual on-site practices, enabling organizations to achieve a more comprehensive assessment of their compliance status.

Yes, and they are central to the method. Our auditors visit factories, warehouses, offices and other establishments to verify on-ground compliance and implementation - fire exits, extinguishers, machine guarding, lifting equipment, PPE, crèche and welfare facilities, waste storage, statutory displays and the conditions written into consents and licences.

It depends on the number of locations, scope, number of laws, document readiness and physical-visit requirements. A single-location audit is completed far faster than a multi-state engagement. For reference:

• A 61-factory, pan-India audit was completed over a six-month engagement.
• For a large auto-component enterprise with 7 plants and 5 warehouses, the audit generated 3,800+ compliance obligations and uncovered 800+ non-compliances.

• List of establishments and locations, with addresses
• Nature of business and activities at each site
• Workforce details - employees, contract workers, apprentices, headcount by site
• Existing licences, registrations, consents and NOCs
• Major equipment and hazardous processes (boilers, DG sets, lifts, chemicals)
• Key contact persons by function and site
• Previous audit reports and inspection notices, if available

This is gathered through the Business Discovery Questionnaire, followed by the Initial Data Requirement list once applicability is confirmed.

No. It also identifies control gaps, process weaknesses, documentation gaps, expired or incorrect licences, unmet consent conditions, missing approvals and applicability blind spots, along with opportunities to strengthen compliance management. Recurring patterns across sites are flagged so they can be fixed at the root.

Each observation is rated Critical, High, Medium or Low on its legal impact, business impact, recurrence and urgency, and tagged with the consequence the law attaches to it - imprisonment, continuing daily fine, personal liability, or licence cancellation and closure. This lets management prioritise by real exposure, not by volume.

Yes. Every observation is mapped to the Act, Rule or regulation, section or rule reference, requirement, observed status, gap, risk rating, penalty and recommended corrective action.

Example: Hazardous-waste authorisation not obtained - Environment (Protection) Act, 1986 read with the Hazardous and Other Wastes Rules, 2016 - a gap that recurred across eight states in our audits.

• Compliance universe / applicable legal framework for each location
• Business Discovery Questionnaire and Initial Data Requirement list
• Compliance checklist
• Location-wise audit observations with law, section and penalty
• Gap analysis and risk categorisation (Critical / High / Medium / Low)
• Corrective-action recommendations with priorities and owners
• Consolidated management report and Board presentation
• Compliance roadmap

Yes. Each gap comes with practical corrective and preventive actions, a suggested priority and the responsible function. Many fixes are quick: putting up a statutory display, constituting a committee, appointing a designated officer or updating a register can often be done in days.

Imprisonment, daily-fine and personal-liability figures reflect what the relevant statute provides. Statutory exposure is not a prediction of prosecution.

Yes. Location-wise findings are rolled up into a management-level report showing critical observations, recurring gaps, location and category comparisons, and overall compliance trends - a risk-ranked, decision-ready view the Board can act on.

Yes. Dashboards give visibility into critical observations, location-wise compliance status, open and closed findings, risk categories and corrective-action progress, so leadership can track closure rather than re-reading reports.

Yes. The audit lets organisations find and fix gaps before an inspector, a notice or an enforcement action does, and keeps every filing, licence, certificate and record organised and retrievable - so there is no scramble before an inspection.

The four Labour Codes - on Wages, Industrial Relations, Social Security, and Occupational Safety, Health and Working Conditions - came into force on 21 November 2025, consolidating 29 central labour laws. Obligations, forms, registers, thresholds and penalties have changed, and state rules are still being notified. The audit maps each legacy obligation to its Code equivalent and tests the organisation against the current position.

Yes. A follow-up or closure audit verifies that gaps have actually been closed, with evidence. This matters because 31% of the gaps we find attract a continuing daily fine - exposure keeps accruing until closure is proved.

Yes. Observations can be loaded into TeamLease RegTech’s compliance management platform to assign actions, set due dates, monitor closure and store evidence. The platform today manages 19,000+ establishments across 3,300+ business entities for 60,000+ enterprise users, covering 11,000+ legislations and regulatory instruments.

At least annually, with quarterly or half-yearly reviews for high-risk sites such as factories and warehouses. An audit is also advisable whenever the business changes: a new location, product, equipment or process, market expansion, a change in law, or an upcoming labour inspection.

With nearly 13,000 regulatory changes a year - about 50 for every working day - a compliance position verified a year ago cannot be assumed to hold today.

Yes. Compliance due diligence identifies existing regulatory exposures, pending obligations, missing licences and approvals, and potential liabilities before a deal closes, a merger or demerger is executed, or a draft offer document is filed. An acquirer inherits the target’s gaps - and some of them can stop operations.

Imprisonment, daily-fine and personal-liability figures reflect what the relevant statute provides. Statutory exposure is not a prediction of prosecution.

Experienced legal, labour, EHS and regulatory professionals from TeamLease RegTech (formerly Avantis RegTech), a subsidiary of the listed TeamLease Services. The audit is independent, technology-enabled and backed by pan-India coverage of 28 states and 8 union territories, with on-ground audit teams across Ahmedabad, Bengaluru, Chennai, Delhi-NCR, Hyderabad, Kolkata, Mumbai and Pune.

• Book a Compliance Health Check - see your real compliance status, mapped against the law, not the checklist.
• Get a Risk Exposure Review - a no-obligation view of where your highest exposure sits today.
• Present findings to your Board - a risk-ranked roadmap your leadership can act on immediately.

The engagement begins with a discussion of your operations, locations and objectives, followed by scope definition, a proposal and audit kick-off on confirmation.

[email protected]+91 98992 45318www.teamleaseregtech.com

Yes. A large part of the audit can be conducted remotely through document review and evidence validation. Depending on the scope, remote and on-site assessments may be combined.

A Compliance Audit is a comprehensive evaluation of an organization’s adherence to applicable Central, State, and local laws, including verification of statutory licenses, registrations, returns, records, and compliance with prescribed conditions. It may include documentation review, system-based verification, and physical site inspections to assess actual compliance.

A Gap Assessment focuses on identifying gaps between the organization’s existing compliance practices and the applicable legal and regulatory requirements. It helps determine what is missing, what needs improvement, and what corrective actions are required to achieve compliance.

Key Difference:

• Compliance Audit: Assesses the organization’s compliance status against applicable legal requirements and identifies instances of non-compliance.
• Gap Assessment: Identifies deficiencies in existing processes, documentation, and practices and recommends measures to bridge those gaps.

We follow strict confidentiality practices and handle all business information and documents with appropriate security controls and professional standards throughout the engagement.