Are Your Compliance Costs Missing From Your HR Budget?

People costs rise every budget cycle, and most of that increase is predictable: payroll tax rates adjust, wage-base limits shift, unemployment insurance resets based on claims history, and benefits premiums and workers’ compensation renew on schedule.

Compliance gets treated differently. Finance teams typically roll that budget line forward with a small inflation bump, assuming the costs underneath it will hold steady year to year.

The underlying costs often move whether or not headcount does. A state paid leave contribution rate can reset every January, and a retirement mandate penalty can double after 12 months of noncompliance — but neither waits for you to hire anyone.

Knowing where these costs originate, how often they shift, and what to lock in before the year starts gives you a compliance number grounded in the actual rate changes affecting your business this year.

State Paid Leave Rates Reset Every Year

Today, 14 states plus Washington, D.C., now require paid family and medical leave, and the map is still filling in. Minnesota and Delaware started paying benefits in January 2026. Virginia enacted its program in April 2026, with benefits beginning in 2028.

Those rates aren't fixed at enactment. States set them based on program funding, and funding needs shift year to year, so the rate shifts with them. You already check payroll tax rates every year for this same reason, and Paid Family and Medical Leave (PFML) contribution rates deserve the same treatment.

PFML contribution rates by state, 2025-2026

If you run a 100-person distribution company with most of your payroll in Washington, you’ll see your compliance line move without adding a single employee or raising a single salary. The state's annual PFML adjustment does that automatically. Carry last year's rate forward as a placeholder and the gap shows up as a year-end variance instead of a number you planned for.

Each additional state compounds it. Every PFML program runs its own rate, wage base, and adjustment calendar. Three states mean three numbers moving independently of each other.

Pull the current employer contribution rate for every PFML state where you have payroll before you lock the line.

Retirement Mandate Penalties are Built to Escalate

State retirement mandates run on a different clock. Registering with the program, enrolling eligible employees, and setting up payroll deductions is finite work with an end date. The penalty for skipping it grows the longer you wait.

More than a dozen states now require employers without a qualifying retirement plan to enroll eligible employees in a state-run program. Several thresholds start as low as five employees. With so few employees, a first-year penalty might not feel like an emergency — at 50, it is one.

Illinois shows the structure clearly. Under Secure Choice, a noncompliant employer owes $250 per employee for the first calendar year. In the second year, the per-employee rate doubles to $500, and it stays there every year after.

Illinois retirement mandate penalty costs by year

Carrying that noncompliance for three years costs five times the first-year total because the per-employee rate climbs after year one and stays up.

New Jersey starts with a written warning, then moves to escalating per-employee fines. Vermont will raise its own per-employee penalty in late 2026. Every state runs this differently, but all of them work the same way: Waiting costs more than complying.

Some employers treat the penalty as a cost of doing business, betting it stays cheaper than adding a plan. That math just considers the fine, but you can close this risk permanently. Register, enroll, set up the deduction, and the exposure drops to zero and stays there. A private plan that meets your state's requirements works too, and it comes with more flexibility over plan design than the state-run default.

But this isn’t solely a compliance concern. A retirement plan also works as a recruiting and retention tool in a tight labor market, and it gives employees a path toward financial stability in retirement that shows up today in tenure and engagement.

Employers setting up a retirement plan for the first time can also claim federal tax credits that offset a share of the startup and administration costs.

What CPEO Status Covers

If your HR provider is a professional employer organization (PEO), that can be a source of compliance risk in its own right, separate from anything a state requires. Whether your provider is IRS-certified determines how much of that risk lands on you.

Working with a PEO that isn't IRS-certified means you stay jointly and severally liable for federal employment taxes, even after paying the provider to handle them. If the provider doesn't remit payments, the IRS comes to you for the shortfall.

Certification under the IRS CPEO program transfers that liability to the certified provider and is backed by two things you can easily verify.

1. The bond. Every CPEO maintains an IRS bond equal to the greater of $50,000 or 5% of its prior year's federal employment tax liability, capped at $1 million. The IRS publishes the list of certified PEOs, so any provider claiming CPEO status should appear on it. Checking takes under a minute.
2. Wage-base continuity. CPEOs don't restart FICA and FUTA wage bases when a client joins mid-year. Without that protection, switching HR providers partway through the year triggers duplicate Social Security and FUTA withholding until employees hit the cap again, a real cost that rarely shows up in a PEO comparison — but it lands on a paycheck.

CPEO status addresses who's liable if the provider fails to remit federal employment taxes. But paid leave administration, retirement mandates, multistate filings, and worksite posting still sit with you. A provider that tells you exactly where that CPEO coverage stops is telling you something about how it operates. One that lets you assume it covers everything is telling you something, too.

G&A Partners holds CPEO status, which takes the remittance risk off your plate entirely. No matter what PEO or CPEO you work with, you’ll need to forward any notice from a state or federal taxing authority to your provider reasonably soon after it arrives. A liability shift can’t happen if your provider isn’t aware of the notice that triggers it. That's how the relationship works best. A PEO like G&A carries the compliance infrastructure, watches for relevant law and rate changes, and flags updates as they land. You keep your provider in the loop on what's showing up on your desk, and the decision on how to respond stays with you. The more your team and ours share, the fewer things slip through.

Every New State Adds Its Own Compliance Calendar

Not every state runs a paid leave program or retirement mandate. The ones that do each set their own rate, threshold, penalty structure, and filing calendar, so the tracking work grows with every jurisdiction you enter. Your headcount is irrelevant to the equation.

Take the same 100 employees and spread them across five states instead of one. Headcount hasn't moved. You're now tracking five paid leave programs, five retirement mandate rule sets, and five filing calendars. Each one changes on its own schedule. Annual rate changes, newly enacted programs, and state-specific penalties move next year's number while headcount stays flat.

Give each state footprint its own line in your forecast that’s separate from headcount. Track states as closely as you track headcount.

Worksite Posting Is the Fine No One Budgets For

Federal law requires you to keep current, legible workplace notices conspicuously posted that cover the Employee Polygraph Protection Act (EPPA), the Occupational Safety and Health Administration Act (OSHA), Equal Employment Opportunity Commission (EEOC) guidance, and the Family and Medical Leave Act (FMLA).

Each worksite is assessed separately, so the penalty multiplies by location count. Individual fines run from $216 per violation under the FMLA to $26,262 per violation under the EPPA. A company with employees in 10 states that misses required updates after a rule change faces up to $43,700 in fines per location. Regulators treat repeat failures as willful, and a willful finding brings harder enforcement and a bigger litigation risk.

Posting compliance is easy to miss for the same reason paid leave and retirement mandates are. It isn't a recurring line item until a rule changes, and then it becomes one. It's also the cheapest of the four to stay ahead of, especially when someone owns the update cycle.

Some cities and counties add their own posting rules on top of the federal ones, so it's worth checking local requirements too.

What to Check Before You Lock the Line

No two companies carry the same compliance exposure. State footprint, headcount, current retirement and leave obligations, and the number of locations you run all change the shape of it.

There's no single figure to plug in. Know which variables apply to your company and how each is likely to move this year.

Four things to confirm before the line closes:

1. Current employer PFML contribution rate for every state where you have payroll
2. Whether any state where you operate has a retirement mandate you haven't registered for
3. Whether your provider appears on the IRS list of certified PEOs
4. When your worksite postings were last updated, per location

G&A's HR compliance team tracks rate changes and mandate updates across all 50 states, so a shift in Illinois or Washington reaches you before it reaches your filing deadline. G&A holds CPEO status, which shifts federal employment tax remittance liability off your plate. G&A’s multiple employer plan for 401(k) is one route to satisfying a state retirement mandate, and joining it moves the plan’s fiduciary responsibility and the Form 5500 filing off your company. On service, G&A answers 88% of calls within 20 seconds, and 97% of clients say expectations met or exceeded what they expected going in.