A compliance system that flags problems and records no response documents what the employer knew and not what it did. A half-closed loop is a worse artifact than no loop at all.
By Floburn · MicroForensics, built and run for California employers
When we look at an employer's existing compliance tooling, we have learned to skip the dashboard and go straight to the oldest open item.
Not the newest. The oldest. If the system lets an item stay open with nothing entered under it, the oldest one will be a flag raised in some previous year, still sitting in the queue, still marked open, with nobody assigned and no note under it. The dashboard above the queue can be very good: It detected the thing, it categorized the thing, it charted the thing over time.
That system is not neutral. It is producing evidence against the employer who bought it, at a steady rate, and it has been doing so since installation.
Work through what a plaintiff's firm does with a finding that has nothing after it.
Nearly every mechanism in California employment law that punishes an employer more for the same underlying conduct is built on the same two-part structure: The employer knew, and there is no documented response. Willfulness in final-pay penalties. Pattern-or-practice enhancement in misclassification. The heightened penalty tier in PAGA for conduct after a prior finding. The failure-to-prevent theory in harassment. Different statutes, different elements, same skeleton.
And here is the part that took us a while to appreciate properly: Not one of those mechanisms requires the response to have worked. They require a response to have existed and to have been documented. An employer who found a problem, did something reasonable about it, wrote down what it did, and had the problem recur anyway is in a categorically different position from an employer who found the problem and stopped there. That is not a matter of degree. It is the difference between a document that shows a functioning system and a document that shows notice without action.
Which produces the uncomfortable conclusion at the center of how we build: A detection system without an enforced response is an evidence-manufacturing operation pointed at its owner. It creates the knowledge element and then documents the absence of the other one.
Labor Code §2699(g)(2) says the same thing in its own vocabulary, and it is worth reading the enumerated examples with an eye on their verbs, not their nouns. Periodic payroll audits and took action in response to the results of the audit. Lawful written policies, disseminated. Supervisors trained. Corrective action taken as to supervisors. Every item in the list is a response, and the statute is explicit that it is illustrative, not exhaustive. The finding is not the reasonable step. What happened next is.
The rule in our system is that an item cannot be closed without an entry describing what was done. Not a status change. Not a checkbox labeled resolved. Text, entered by a person, with their name and a timestamp on it.
People push back on this in implementation, and the pushback is always some version of: This will slow the supervisors down, and some of these items are trivial. Both are true. We keep the rule anyway, for three reasons.
A trivial item takes eleven seconds to close. "Break taken late, employee confirms voluntary, no premium owed" is a complete entry. The cost of the rule is real and it is small, and it is paid on the good days rather than the bad one.
An optional field is an empty field. This is the least interesting reason and the most reliably true one. A field nobody is required to fill in gets filled in when someone has time, and a supervisor closing items at the end of a shift does not have time. If the entry matters when a notice arrives, it cannot be optional in March.
The absence of an entry is not neutral in discovery. A closed item with no disposition does not read as "handled and not worth noting." It reads as closed to clear the queue. We would rather the record show a thin response than no response, and we would much rather it show the actual one.
The same logic governs how a correction gets recorded, and this is where the obvious design goes wrong, for reasons that are entirely understandable.
If a supervisor enters the wrong reason code on Tuesday and fixes it on Thursday, the natural software instinct is to store the right answer. The field updates. The record now says the correct thing. Clean.
Assume the whole file is produced in discovery — and it will be, because that is what these records are for. A field that changed between the event and the production, with no trace of having changed, is an invitation to an argument about everything else in the file. The employer's own witness now has to explain, under oath, what the field said before, who changed it, when, and why — from memory.
So corrections in our system are entered beside the item, never over it. Tuesday's entry stays. Thursday's correction sits next to it, with its own author and timestamp, and the reason. The record is longer, messier, and harder to read than the clean version, and that is the point: The messy version is the one whose provenance is not in dispute. Alteration leaves a trace. That is a narrower claim than saying the record cannot be altered, and it is the true one.
The export is controlled by the employer's own authorized custodian of records, not by us, for the same reason. A chain of custody that runs through a vendor is a chain of custody with a vendor-shaped question in the middle of it.
We describe the product as five layers, and the honest framing is that the first one is the least valuable.
Detection — the per-period attestation, fired on unrounded punch times, in Spanish where the workforce needs it — is the layer everyone wants to talk about, and it is table stakes. Working each flag to a close under the attorney-reviewed protocol, the pay period it happens, is where the operational value is. The routing that sends a short course to a repeat offender and to their supervisor is where two of §2699(g)(2)'s enumerated items actually get produced. The record kept so that alteration leaves a trace is what makes the first three worth having. And the production posture is the point of the whole exercise: When a lawyer's letter demanding records arrives, or a PAGA notice after it, the employer's own authorized custodian of records answers it from one place.
The manager protocol that fires when an attestation flags is attorney-reviewed, which describes what it is: reviewed, by California labor and employment counsel, under an engagement. It does not make the output privileged and it is not legal advice, to us or to you. We are not a law firm. We build the record; your counsel makes the argument.
Detection alone is never the pitch. The statute names corrective action among its examples. Nothing in it names detection.
Ask to see the oldest open item in the demo environment. Then ask what the system does if a supervisor tries to close an item without entering anything.
If the answer is that it closes, you are looking at a system that will document your knowledge and not your response. That is not a feature gap. It is the wrong side of the structure every enhancement in this area is built on.
If your current system already closes the loop and keeps the trace, we will tell you that and will not sell you a second one. If you want it read against the structure above — what it detects, and what it can prove you did afterward — the free 30-minute call is where we do that.
Free · 30 minutes. If it fits, the next step is the records diagnostic, a fixed fee quoted on the call, and anything paid after that is a separate agreement you sign first.