What actually happens in a workers' compensation audit

The letter shows up, it says "audit," and most business owners assume they did something wrong.

They didn't. A workers' compensation audit is not an investigation, and nobody at your carrier thinks you're hiding money. It's arithmetic. You bought a policy twelve months ago based on what you guessed payroll would be. Now the year is over and everyone finds out what payroll actually was. That's the whole thing.

In a workers' comp audit, an auditor compares the payroll your premium was estimated on with the payroll you actually paid, confirms each employee's class code, and checks whether any subcontractors carried their own coverage. The carrier then bills or credits the difference.

The single biggest predictor of a painless audit is whether the business understands what's being asked for before it starts hunting for it. So here's the walkthrough.

Why is there a workers' comp audit?

Because the premium you paid all year was based on estimated payroll, and the audit replaces the estimate with actual payroll. At the start of the policy period you gave your carrier estimated payroll by job type. Roofers cost more to insure than the person doing your billing, so each group of employees gets a class code, and each class code has a rate. Estimated payroll times rate, adjusted for your experience mod, is roughly the premium you've been paying all year.

The audit replaces every estimate in that math with a real number. The audit premium estimator shows roughly how far that number moves once actual payroll replaces the estimate.

Sometimes you get money back, usually because you staffed up more slowly than you planned or a job you bid never happened. Sometimes you owe. Either way, nobody is being punished. The premium is just catching up to the business you actually ran.

What does a workers' comp auditor need?

Almost every workers' compensation audit runs on the same three things:

1. A payroll summary for the policy period, broken out by employee, with gross wages and overtime shown separately
2. Your quarterly federal tax returns (the 941s) covering that same period
3. A list of anyone you paid who wasn't on payroll, with certificates of insurance if they carried their own coverage

That's the core. Depending on the business, an auditor may also request a general ledger, 1099s, or job-cost detail if employees split time across trades. The audit checklist generator works out which 941 quarters your specific policy period covers and lists the rest, and the workers comp audit checklist walks through each document in turn.

Which figures inside those reports are actually subject to premium is a separate question, and a longer one: what payroll counts in a workers' comp audit covers the inclusions and exclusions line by line.

The 941s are the part people push back on most. "You already have the payroll report, why do you need the tax filings too?" Because the payroll report is something you generated and the 941 is something you filed with the IRS. When the two agree, the audit is done. When they disagree, that gap is the entire conversation. Getting all four quarters up front saves a week of email.

How long does a workers' comp audit take?

Once complete documents are in hand, the analysis usually takes a few days; most of the total time is spent waiting for records. A virtual audit generally runs on something like this schedule:

That's the catch. The auditor's clock is short. The clock that decides how long this takes is yours. An audit where the documents arrive complete on day two closes that week. An audit where payroll trickles in over three rounds of follow-up takes a month, and none of that month is fieldwork.

Many audit firms send provider-specific instructions for ADP, QuickBooks Online, and QuickBooks Desktop showing exactly which report to run and which boxes to check. If you're offered them, use them. The wrong export is the most common reason a document request gets sent twice.

What causes problems in a workers' comp audit?

Four things cause most of the friction: contractors without certificates of insurance, overtime reported at full value, payroll lumped into one class code, and not responding.

Contractors with no certificate of insurance. If you paid someone as a 1099 and they can't produce proof they carried their own workers' comp, most states let the carrier treat that payment as payroll. This is the single most expensive surprise in premium audit, and it's entirely preventable. Collect the certificate when you hire, not when the auditor asks. The subcontractor exposure calculator puts a dollar figure on a gap you already have.

Overtime reported at full value. In most states, the premium portion of overtime pay is excluded from the audit basis. If someone earned $30/hour and worked overtime at $45, only the $30 base counts. But this only works if your payroll report separates overtime from regular wages. If it's one lump number, there's nothing to split, and premium gets charged on the whole amount.

Everyone in one class code. If your payroll runs under a single code because that's how the policy was written, and half your people are actually doing lower-rated work — office staff who qualify as clerical office employees (8810), for example — you're overpaying. Job titles and duties in your records are what allow codes to be assigned correctly. The class code guides explain what the most common codes cover.

Silence. Ignoring the audit doesn't make it go away. Most policies let the carrier estimate your exposure when an insured won't cooperate, and those estimates are not built to be generous. Some states allow a non-compliance charge on top. Answer the email.

Why this matters more than it used to

For about a decade, falling loss costs quietly absorbed a lot of imprecision in workers' comp pricing. That cushion is thinner now. NCCI reported that both medical and indemnity claim severity rose 4% in 2025 while reserve redundancy narrowed, which means carriers have less room to eat errors in either direction.

Practically, that means audits are getting more scrutiny, not less. It also means a clean, well-documented audit is worth more to you than it was five years ago, because a documented number is a number you can dispute successfully if it's wrong.

When the notice arrives

Pull the four 941s first. They're the hardest to find and the most likely to be sitting with your accountant rather than in your own files. Everything else you can generate in ten minutes.

Then send everything at once. Partial submissions are what turn a three-day audit into a three-week one.

If something in your business changed mid-year — you dropped a service line, brought subcontracted work in-house, opened in a second state — say so in the first email. That context changes classification, and it's much easier to handle up front than to unwind after the report is written.

If the notice itself doesn't spell out which reports satisfy the request, the carrier's audit department can. Asking that question in week one costs nothing and prevents the delay that causes almost everything else.