The Compliance Check Most Small Businesses Skip Until It's Too Late

The pattern was always the same: a lack of knowledge, or worse, a conscious decision not to invest in compliance. They knew something was probably wrong, but they hoped it wouldn't matter. It always mattered.

Here's a short, honest list of the regulatory blind spots that catch growing companies off-guard. If you recognize yourself in any of these, you need to act now.

"It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently."

Warren Buffett, Chairman and CEO, Berkshire Hathaway

The Hiring Gaps That Expose You

You bring someone in to manage payroll. They have a friendly interview and a good reference from their last job. You're hiring.

Six months later, you discover they had a felony conviction you never knew about. Or they falsified credentials. Or they never actually worked where they said they did.

Many small companies skip three critical steps in hiring:

• Drug testing. You don't need to test everyone, but if a role involves safety, driving, or handling controlled substances (especially in healthcare), drug screening is non-negotiable. It's not expensive, typically $50 to $100 per employee, but it's one of the strongest defenses against liability claims if something goes wrong.
• Background checks. For roles involving financial access, working with vulnerable populations, or operating company vehicles, a background check isn't optional. It's due diligence. Not having one is indefensible if something goes wrong later.
• Reference verification. Call the references yourself. Don't rely on what the candidate tells you a previous manager said. You need direct contact and documented conversations. This catches false references and incomplete work histories.

Outdated Handbooks and Policy Gaps

I cannot tell you how many employee handbooks I've reviewed that haven't been updated in five, ten, sometimes fifteen years.

Laws change. State employment laws change. Federal regulations change. If your handbook was written in 2010 and you're still using it today, it's almost certainly non-compliant with current requirements.

Here's what most outdated handbooks are missing:

• Accurate FMLA language. The Family and Medical Leave Act is federal law, but state laws often extend it. Your handbook needs to reflect what's required in your state.
• Sexual harassment policies that meet current standards. This isn't optional. The policy needs to be comprehensive enough to cover modern workplace dynamics, not just the standards of 2005.
• ADA accommodation procedures. You need a documented process for how employees request accommodations and how the company evaluates and implements them. Without clear procedures, you're vulnerable to complaints and lawsuits.
• Wage and hour clarity. Are you clear about overtime thresholds? Independent contractor vs. employee classification? Meal and break requirements in your state? Many wage-and-hour violations happen because the policy was never written clearly enough.
• Data privacy and confidentiality protocols. If you're collecting personal information from employees or clients, you need privacy policies that comply with state and federal law. And you need to actually follow them.

A solid employee handbook update costs $2,000 to $5,000 and should be reviewed by an employment attorney in your state. It's not a small investment. But a wage-and-hour lawsuit or sexual harassment claim can cost ten times that.

OSHA, ERISA, and the Regulations You've Never Heard Of

OSHA (Occupational Safety and Health Administration) regulations don't just apply to manufacturing plants. If you have employees, OSHA applies to you. That means workplace safety training, accident reporting, and documented safety procedures.

Most small business owners don't know these exist until they're already in violation.

Healthcare-Specific Compliance

If you operate in healthcare, whether a clinic, home health agency, hospice, or dental practice, you have layers of compliance that other industries don't face.

• HIPAA: Every single employee who touches patient information needs to be trained. You need privacy policies, breach notification procedures, and a documented plan for protecting patient data. Violations can result in penalties up to $1.5 million per violation category.
• Stark Laws and the Anti-Kickback Statute: These federal laws prohibit certain financial relationships between healthcare providers and referral sources. If you're referring patients to facilities you have financial interests in, you need to understand these laws or you risk violating them without realizing it.
• State licensing and credentialing: Every clinical staff member needs active, verified licenses. You need credentialing files, verification every two years, and documented proof that staff hold the right certifications for their roles.

I've seen clinics shut down operations temporarily because they couldn't produce proof that a clinician had an active license. I've seen home health agencies face massive penalties for HIPAA violations that could have been prevented with a $2,000 training program.

Vendor Contracts and Ethical Guidelines

Many small companies work with vendors, contractors, suppliers, and service providers with nothing but a handshake and an email.

Here's what you're missing: contracts that spell out payment terms, confidentiality agreements, liability clauses, and what happens if either party breaches the agreement.

You also need vendor compliance verification. Are they licensed? Insured? Do they comply with the regulations that apply to your industry? If you're a healthcare clinic using a cleaning contractor, that contractor needs to understand infection control protocols. If they don't and something goes wrong, you're liable.

Ethical guidelines for vendors matter too. Do you have standards about how vendors should handle your data, your clients' information, or your proprietary processes? Without documented guidelines, you can't enforce them.

"An ounce of prevention is worth a pound of cure."

Benjamin Franklin

The Real Cost of Non-Compliance

People often ask: "Can't we just hope nothing goes wrong?"

You can hope. But compliance violations don't discriminate based on company size. A wage-and-hour violation costs the same whether you're a 5-person operation or a 500-person company. A HIPAA breach notification can cost tens of thousands of dollars in legal fees alone, before any penalties.

In the extreme cases, the ones I watched unfold in court, a single compliance failure closed a business. Not because they were bad people running a bad company, but because they didn't invest in knowing the rules.

Where to Start

You don't need to fix everything at once. But you need a plan.

First: Identify which regulations apply to your industry and size. If you're in healthcare, start with HIPAA, Stark Laws, and state licensing. If you have employees, you need to know FMLA, wage-and-hour, and ADA requirements in your state.

Second: Audit your current state. Do you have an employee handbook? When was it last updated? Do you have documented hiring procedures? Vendor contracts? Data privacy policies?

Third: Bring in the right experts. You need an employment attorney to review your handbook, a compliance consultant or HR professional to assess your gaps, and a CPA who understands your industry's specific requirements.

This isn't something to do yourself or delay. The cost of getting it right is a fraction of the cost of getting it wrong.

Related: Your Greatest Asset Isn't Your Product. It's Your People.  ·  Building a Budget That Actually Helps You Grow