A 45-attorney law firm passed its first third-party HR data audit without a single finding by building automated access controls, a daily audit event log, and a retention schedule in Make.com and Airtable — all in 60 days before the audit window opened. Auditors reviewed 12 months of records and found full documentation, consistent controls, and a functioning retention process.

What HR data governance gaps created audit risk at the law firm?

Law firms handle client-privileged data and face state bar data protection requirements on top of federal employment law. This firm had grown from 12 to 45 attorneys over five years without updating its HR data practices. Employee records sat in personal Google Drive folders with inconsistent naming conventions. Access was granted by sharing individual documents — no revocable access control layer existed. No retention policy governed how long records were kept after termination. The firm had never run a data access audit and could not produce a list of who had access to which employee records.

When the firm’s malpractice insurance carrier required a third-party HR data audit as a condition of policy renewal, the HR director had 90 days to establish defensible data governance practices.

How did Make.com and Airtable create an auditable HR data governance structure?

The build had three components. First, centralized record storage: all employee records migrated from personal Google Drive folders to a shared drive with role-based access controls — HR admin received full access, department managers received read-only access to their direct reports, and auditors received view-only access to a sanitized audit log. Second, access event logging: a Make.com scenario monitored the shared drive activity log daily and wrote access events (who accessed what, when) to an Airtable audit log. Third, retention automation: a Make.com scenario ran monthly, flagging records for terminated employees that exceeded the 7-year retention policy, and sent a deletion authorization request to the HR director for approval before any record was removed.

The access log and retention schedule were the two documents auditors specifically requested. Both existed. Both covered the full audit period.

Expert Take

HR data governance audits fail for one reason: organizations cannot prove they did what they said they would do. The access log proves who touched employee data. The retention schedule proves records are managed according to policy. Make.com generates both automatically. The audit becomes a documentation review rather than a discovery exercise.

What did the audit find and what was the firm’s response?

Auditors reviewed 12 months of access logs, tested five random access events against employee role assignments, reviewed the retention schedule, and tested two termination records to confirm post-termination data handling. They found full access control documentation, consistent naming conventions, and a functioning retention process. The audit report noted one observation — not a finding: the firm had implemented governance practices but had not yet drafted a written HR data governance policy document. The HR director drafted the policy within the 30-day observation response period. The insurance policy renewed without condition.

Key Takeaways

• Third-party HR data audits require documented access controls, audit event logs, and retention schedules — all buildable through Make.com automation.
• Centralized record storage with role-based access replaced ad-hoc Google Drive sharing that left no access control trail.
• Daily access event logging to Airtable produced the audit evidence auditors specifically requested.
• Retention automation sends deletion authorization requests to HR rather than deleting records automatically — keeping human approval in the process.

HR Data Audit Preparation FAQ

How long does it take to build this HR data governance infrastructure?

The full implementation — record migration, access controls, audit logging, and retention automation — took 60 days at the law firm working part-time. Organizations starting with more disorganized record storage should budget 90 days for the data migration phase alone.

What is the correct HR data retention period?

Federal law requires most employment records to be retained for 3 to 7 years depending on record type. I-9 records must be retained for 3 years after hire or 1 year after termination, whichever is later. EEOC records require a 1-year minimum, extended to 2 years for federal contractors. Some states impose longer retention periods — consult employment counsel for your specific jurisdiction.

Does Google Drive’s native audit log provide sufficient evidence for a third-party audit?

Google Workspace Enterprise includes detailed audit logs in the Admin console. Standard and smaller plan tiers have shorter log retention windows that fall below what most audits require. Writing access events to a persistent Airtable log — as described in this case — provides audit evidence independent of the Google Workspace plan tier.

For a closer look at the data privacy mistakes that create audit exposure, see 12 critical HR data privacy mistakes your organization must prevent.