Why Your Salary Ranges Need a Compliance Audit Trail

The Friday-afternoon scenario no HR team wants

It's mid-afternoon on a Friday. You posted a Senior Marketing Manager role across three job boards last month. Today, a letter arrives from your state labor agency: a former applicant filed a complaint alleging the posted salary range was not grounded in a genuine pay scale for the position.

Your employment attorney calls within the hour. She needs, by Monday morning, documentation of how you set the range — the data source you used, the date you pulled it, the methodology you applied, and who signed off on the final numbers.

You open the spreadsheet. There is no version history. The cells that held the BLS figures are unlabeled. The formula column was overwritten during a later update. You are not sure whether the numbers reflect the market as of six months ago or two years ago. You have a range, but you have no audit trail.

This scenario is not hypothetical. As pay-transparency enforcement matures across more than sixteen states and Washington, D.C. — each with its own penalty structure and its own evidentiary expectations — the documentation behind a salary range is becoming nearly as important as the range itself. By the end of this article you will understand exactly what a salary range audit trail is, why it matters in an enforcement context, which jurisdictions impose explicit recordkeeping mandates, and what a defensible record looks like in practice.

---

What a salary range audit trail actually is

An audit trail, in the compensation context, is a timestamped, sequential record of every decision that produced a posted pay range — captured at the moment each decision was made, in a form that cannot be silently edited afterward.

It is not a summary memo written after the fact. It is not the current state of a living spreadsheet. It is a chain of evidence that lets an attorney, a labor agency investigator, or a pay-equity auditor reconstruct, step by step, how a specific range was built on a specific date using specific data.

A complete compensation documentation record for a single posting typically contains five elements:

1. Data source and vintage. Which wage dataset was used (for example, the Bureau of Labor Statistics Occupational Employment and Wage Statistics program, commonly called BLS OEWS), the specific occupational classification code (SOC code), the geography (national, state, or metropolitan area), and the reference year of the data release. The BLS OEWS program produces wage estimates for more than 800 occupations from a sample of approximately 1.1 million establishments; citing the release year tells a reviewer exactly which estimates were in effect when you built the range (BLS, May 2025).
2. Methodology. How you moved from the raw percentile figures to a min–mid–max band: which percentile you anchored to (often the 50th — the market median, meaning the wage below which half of workers in that occupation and geography earn), what range spread you applied (range spread is the width of the band expressed as a percentage of the midpoint), and any geographic or seniority adjustments you made.
3. Calculation date. The exact date the range was built — not the date the posting went live, not today's date, but the date the numbers were assembled. This establishes data vintage: the age of the market data relative to the posting date.
4. Approver and sign-off. Who reviewed and approved the range before it was posted, and in what capacity.
5. Version lock. A mechanism — a read-only PDF export, a database record with a write-protected timestamp, or a formal version number — that prevents the record from being altered retroactively.

Without all five, what you have is a range. What you do not have is a defensible salary range audit trail.

---

Why enforcement makes documentation non-negotiable

Pay-transparency enforcement is no longer theoretical. As of 2026, sixteen states plus Washington, D.C. mandate salary disclosure in job postings, with Delaware joining in 2027 (Paycor / Nesco Resource, 2026). Each jurisdiction has its own penalty structure, and each posting can constitute a separate violation.

Consider the scale of exposure. Colorado, whose Equal Pay for Equal Work Act has been in effect since January 1, 2021, had assessed $238,000 in fines across 1,634 complaints filed as of July 1, 2024 (Trusaic citing Colorado CDLE, 2024). Colorado's penalty range runs $500–$10,000 per violation (Colorado General Assembly, SB19-085, 2019). In New York City, civil penalties can reach up to $250,000 per violation, enforced by the NYC Commission on Human Rights (Trusaic, 2025). In California, each non-compliant posting can be treated as a separate violation, with civil penalties of $100–$10,000 per violation — so the same role posted simultaneously on five platforms without a range may represent five separate violations (Employment Law Aid, 2026; California Legislative Information, SB 1162, 2022).

The lesson is not to induce panic. The lesson is that when a complaint is filed, the employer's first line of defense is documentation. A labor agency investigator asking whether your range reflected a genuine pay scale for the position cannot be answered with a current spreadsheet that may have been edited a dozen times since the posting went live. They need the record as it existed on the day of the posting — timestamped, methodology intact, data source identified.

For a fuller breakdown of how penalty structures work across jurisdictions, see our guide to pay transparency penalties explained.

---

Jurisdictions that explicitly require you to keep salary range records

Beyond the general evidentiary logic, several jurisdictions impose explicit salary range records retention mandates. Confirm the current rule with the relevant authority or your employment counsel before relying on any figure below — these rules are amended frequently.

Illinois. Under HB 3129 amending the Equal Pay Act of 2003, effective January 1, 2025, employers with 15 or more employees must retain pay-scale and benefit information along with the posting itself for each position for five years (Greenberg Traurig / Illinois DOL, 2024). The Illinois Department of Labor is the relevant authority; verify the current requirement at illinois.gov/idol.

California. California Labor Code §432.3 requires employers to maintain job-title and wage-rate history records (Employment Law Aid citing CA Labor Code §432.3, 2026). The California Department of Industrial Relations (DIR) and the Labor Commissioner's Office are the relevant authorities; verify the current requirement at dir.ca.gov.

Ontario, Canada. Under pay transparency rules effective January 1, 2026, employers with 25 or more employees must retain each publicly advertised posting for three years after it is taken down (HRPA, 2026). Verify the current requirement with the Ontario Ministry of Labour at ontario.ca/labour.

These explicit mandates establish a floor. Even in jurisdictions without a stated retention period, your employment counsel will almost certainly advise you to keep compensation documentation for a period aligned with the applicable statute of limitations for wage claims in your state — which in many jurisdictions runs several years. Confirm the applicable period with counsel.

For a detailed look at what belongs in each posting, see what to include in a salary range posting.

---

The problem with spreadsheets as audit evidence

The near-universal default for building salary ranges at small and mid-sized organizations is a spreadsheet — often paired with a manual lookup in the BLS OEWS tables at bls.gov/oes. This approach uses defensible data. The gap is not the data source; it is the record.

A standard spreadsheet has no native mechanism for any of the five audit-trail elements described above. Version history, if enabled at all, is not designed to produce a legally meaningful, tamper-evident record — it is a convenience feature. A formula column can be overwritten without any trace. The data-pull date is typically not recorded in the file at all. There is no built-in approver workflow, no write-protected export, and no way to prove to a third party that the file on the server today is identical to the file that existed when the posting went live.

This means that an HR team using a spreadsheet may have done everything methodologically correct — anchored to the right BLS percentile, applied a reasonable range spread, made appropriate geographic adjustments — and still be unable to demonstrate any of it in an enforcement context. The documentation that would make the methodology defensible simply does not exist.

For a direct comparison of what a spreadsheet workflow can and cannot document versus purpose-built compensation software, see Google Sheets vs. salary range software. And for the methodology itself — how to build a range from BLS OEWS data through to a posted min–mid–max — see how to build a salary range.

---

What a defensible audit trail looks like in practice

Here is what the same Senior Marketing Manager range — discussed in the opening scenario — looks like when it is built with a proper pay range audit trail in place.

The range is anchored to the BLS OEWS May 2024 national median for Marketing Managers (SOC 11-2021): $161,030 (BLS OOH, May 2024). The builder selects the 50th percentile as the midpoint — the market median, the wage below which half of workers in this occupation nationwide earn — and applies a 50% range spread (a common spread for professional-level roles, meaning the band runs from 25% below the midpoint to 25% above it). The calculation date is recorded automatically: March 14, 2025. The approver — the Director of People Operations — reviews and signs off within the platform on the same date. The output is a watermarked, read-only PDF that carries the SOC code, the BLS release year, the geographic scope, the spread logic, the midpoint, the final min ($120,773) and max ($201,288), and the approver name and timestamp.

When the complaint letter arrives eight months later, the HR team emails counsel a single PDF. It answers every question the investigator is likely to ask before they ask it.

That is what a salary range audit trail is built to do.

To understand how this fits into a broader pay-equity review process — including how ranges interact with actual pay-in-band, compa-ratio (an employee's actual pay expressed as a percentage of the range midpoint), and range penetration (where in the band an employee sits, from 0% at the minimum to 100% at the maximum) — see our pay equity audit guide.

---

Practical steps to build your audit trail today

You do not need to wait for an enforcement event to build a defensible record. Here is where to start:

Step 1: Identify every active posting. List every role currently posted. For each, confirm whether the posting includes a salary range and whether a range-build record exists.

Step 2: Document the data vintage for existing ranges. For each range, record the BLS OEWS release year and SOC code used. If you cannot reconstruct the data vintage, note it — and treat those ranges as candidates for a rebuild with a clean record.

Step 3: Establish a forward methodology. Decide on your anchoring percentile (typically the 50th), your range spread by job family or level, and your geographic adjustment approach. Write it down in a format that does not change each time you open the file.

Step 4: Create a retention schedule. Align with counsel on how long to keep posting records in your jurisdiction. In Illinois, the statutory floor is five years (Greenberg Traurig / Illinois DOL, 2024); in Ontario, three years after the posting comes down (HRPA, 2026). Verify the current requirement with the relevant authority before setting your schedule.

Step 5: Lock and store. Export each completed range-build record in a read-protected format — a watermarked PDF or a write-protected database record — before the posting goes live. A record created after the fact is not an audit trail; it is a reconstruction.

If you are completing a broader pay-equity review at the same time, our Pay Equity Audit Checklist walks through the documentation a pay-equity auditor or employment attorney will typically request — covering range methodology, compa-ratio distribution, range penetration by demographic group, and remediation records.

---

Start with a trial

A spreadsheet that cannot be emailed to counsel as proof of methodology is not documentation — it is a liability. Salary Range Builder generates a timestamped, watermarked, read-only PDF for every range you build: SOC code, BLS release year, geographic scope, spread logic, approver, and calculation date, all captured at the moment the range is finalized.

Start your 14-day free trial at salaryrange.com and build your first auditable range today. No free tier, no credit card required to start — and one avoided enforcement penalty can cover several months of subscription. Confirm the applicable penalty for your jurisdiction with the relevant state or local authority before acting.