Wage and hour liability accumulates quietly and surfaces all at once, usually as a collective claim. A periodic self-audit is the cheapest control available.
What to examine:
Exemptions. For each exempt role, test all three requirements — salary basis, current salary threshold, and actual duties. Titles prove nothing; what the person does day to day decides it.
Off-the-clock work. Time spent before and after shifts, during meal breaks, on remote systems and on messaging outside hours. If non-exempt staff answer messages in the evening, that is compensable time and it is recorded somewhere.
The regular rate. Overtime is calculated on the regular rate, which includes most non-discretionary bonuses and incentive pay — not just base salary. This is a very common and very expensive error.
Deductions and reimbursements. Improper deductions can defeat the salary basis for an entire class; unreimbursed business expenses can drive effective pay below the minimum.
Independent contractors. See separately; misclassification here is the same exposure by another route.
Do it under privilege, through counsel, so the analysis and any findings are protected while remediation is planned. And plan the remediation before the audit begins, because finding the problem creates knowledge of it.