What is the 15% PAGA penalty cap?

California’s Private Attorneys General Act caps civil penalties at 15% of the statutory maximum for employers who took “all reasonable steps” toward compliance before a PAGA notice arrived — or before an employee’s personnel or payroll records request, which often comes first — and can show it. Steps toward prospective compliance taken within 60 days after the notice cap penalties at 30%. Whether the steps were enough is the court’s call, on the totality of the circumstances. The cap is in Labor Code §2699, as amended by AB 2288 and SB 92 (2024). It is conditional on evidence, not policies. No record, no cap.

What counts as “reasonable steps” under amended §2699?

The statute names four examples: periodic payroll audits, written policies disseminated to employees, supervisor training on Labor Code and Wage Order compliance, and corrective action when violations are surfaced. Each must be shown — with timestamps, signatures, and a chain of custody that survives discovery. MicroForensics produces all four as evidentiary artifacts. Policies that exist only in a handbook do not count.

What do AB 2288 and SB 92 actually require employers to document?

Together, the 2024 reforms require employers claiming the §2699 cap to demonstrate four things contemporaneously: that policies were written and distributed, that supervisors were trained, that the employer audited compliance periodically, and that surfaced violations were corrected. LWDA’s February 2026 proposed regulations raise that documentary bar further. Demonstration is by evidence, not assertion — meaning a per-pay-period record tied to specific employees, dates, and times.

Does our BusyBusy or ExakTime data already satisfy the per-pay-period attestation requirement?

BusyBusy and ExakTime produce time data — clock-in, clock-out, GPS, geofencing. They do not produce attestation. The §2699 record requires the employee’s contemporaneous affirmation or dispute that meal and rest breaks were taken, hours are accurate, and pay matches expectation. MicroForensics rides on top of BusyBusy or ExakTime, ingests the time data, and routes per-pay-period attestations to each hourly employee — with the employee’s signature and timestamp joining the audit trail.

We use ADP or Paylocity for payroll. Do we have to migrate to use MicroForensics?

No. MicroForensics is the orchestration layer above your existing HRIS, timekeeping, and payroll systems. We integrate with ADP Workforce Now, Paylocity, Gusto, BusyBusy, ExakTime, Samsara, Motive, and Geotab. You keep your stack. We orchestrate. We don’t replace.

Doesn’t our EPLI policy cover this?

Usually not the way owners assume. California EPLI policies commonly exclude wage-and-hour claims outright or sublimit them to defense costs only — the statutory penalties and premiums a PAGA matter stacks are typically not covered. Ask your broker to show you the wage-and-hour endorsement language before assuming coverage. Insurance is, at best, money after the fact; the §2699 caps turn on the record you built before.

What is the difference between a one-time hire-day waiver and a per-pay-period meal break attestation?

A waiver signed at hire establishes that the employee was informed of the meal-break rule. It does not establish that any particular break on any particular day was taken or knowingly waived. Donohue v. AMN Services (Cal. 2021) held that noncompliant time records create a rebuttable presumption of violation; contemporaneous attestation — captured when the exception occurs — is the rebuttal evidence the California Supreme Court contemplated. The hire-day signature is policy. The contemporaneous attestation is evidence — the Donohue rebuttal.

A PAGA notice just landed. What does MicroForensics do for us now?

If all reasonable steps were taken and documented before the notice, the statute caps civil penalties at 15% — applied by the court on a totality-of-the-circumstances showing. If documentation is incomplete, you have 60 days to take and demonstrate reasonable steps toward prospective compliance and qualify for the 30% cap. MicroForensics can be implemented inside that 60-day window — that is the cure-provision use case. Employers with 100 or more employees can request a court-supervised early evaluation conference, which gives Floburn time to implement and your counsel time to build a defensible record; employers under 100 have a confidential LWDA cure path with its own short clock. The earlier we start, the more material we can produce.

Floburn Inc — MicroForensics

Three California employers. Three contingency-firm probes. Zero dollars settled.

When the PAGA notice arrives, you have the record. MicroForensics is a defense-record service: Floburn builds it on the timekeeping and payroll you already run, and operates it for you. Every pay period your crews attest — in English or Spanish — that breaks were taken and hours are right. Real-time alerts reach supervisors before the fifth-hour window expires. Every signature lands on a timestamped record reviewed by California labor counsel.

Request a discovery call→

Built for hourly field and shift crews, roughly 25–250 employees, across fifteen California industries — deepest shape in Construction.

PeriodAttested & signedRecorded

P.12recorded 07:12

P.13recorded 18:04

P.14recorded 07:31

P.15exception — corrected same shiftrecorded 14:03

P.16recorded 07:26

P.17recorded 07:19

P.18recorded 07:08

Fig. 01 — The record accrues, pay period by pay period.

What we’ve shipped

Three implementations. Three different stacks. One outcome — to date.

These were custom builds, refined across three engagements. MicroForensics is the productized framework that came out of them. Zero dollars paid in settlements.

Sector benchmark. For California employers in the under-50-employee band these three engagements covered, wage-and-hour matters at this scale typically settle in the $50k–$500k+ range. Statewide, most PAGA settlements land between $100k and $500k; the average, near $900k, is pulled up by a handful of large cases (state-reported settlement data, 2026). At larger headcounts, the cap delta and the avoided exposure scale accordingly.

Ink-line illustration of a foreman in a hard hat standing in a site trailer, reviewing a tablet showing a two-column bilingual attestation form with two signature marks highlighted in amber; a coffee mug sits on the table beside him. — Fig. 02 — End of cycle: the attestation log, reviewed before payroll closes.

01
A Reno-based commercial construction firm holding Tesla and T-Mobile contracts across California
Headcount
10–50 (seasonal)
Stack
BusyBusy time tracking + Gusto payroll (migrated from QuickBooks)
What we built. Exports from BusyBusy fed a bi-weekly DocuSign attestation routed to every hourly employee — capturing explicit acknowledgments on overtime, missed breaks, and other compliance signals before payroll ran.
Outcome. A contingency-fee firm pursued a wage-and-hour claim. We produced the audit trail. No action was filed; the firm walked away. Zero dollars settled.
02
A Salinas Valley winery — the #1 direct-to-consumer wine seller in the country in 2024
Headcount
~20
Stack
Gusto (timekeeping + payroll)
What we built. Same bi-weekly DocuSign attestation flow, this time fed by Gusto’s native timekeeping. Cleaner data in, same defensible record out.
Outcome. A contingency-fee firm came probing. We produced the bi-weekly attestation log; the firm did not pursue. Zero dollars settled.
03
One of the largest home staging businesses in the greater Sacramento area
Headcount
11
Stack
QuickBooks → Gusto + a custom AI application
What we built. A purpose-built AI application that routes per-cycle compliance and time-keeping questionnaires to every employee — with far greater granularity than the DocuSign approach. The owner sees exceptions in near-real time and acts before payroll closes.
Outcome. Same pattern. A contingency firm tested for exposure; after the records were produced, no action was filed. Zero dollars settled.

Identifying details anonymized at each client’s preference. Direct references available on request, under NDA, once the audit conversation gets specific. Three matters, all small employers; no outcome is guaranteed, and every matter turns on its facts.

The math — why the 2024 reform changed it

The 15% cap doesn’t apply itself.

AB 2288 and SB 92 amended Labor Code §2699 in 2024. The reform kept PAGA in force and raised the documentary bar.

The cap is conditional, not automatic. Penalties are capped at 15%if the employer can show “all reasonable steps” were taken beforea PAGA notice arrived — or before an employee’s records request, which often comes first — and at 30% if within 60 days after. Whether the steps were enough is the court’s call, on the totality of the circumstances. No documentation, no cap.

Reasonable steps must be evidentiary. The statute lists examples: periodic payroll audits, written policies, supervisor training, and corrective action when violations are surfaced. Each one has to be shown, not asserted — with timestamps, signatures, and a chain of custody that survives discovery.

The volume keeps rising. LWDA logged 8,846 PAGA notices in fiscal 2024–25 — roughly 34 every working day — and 2026 filings are pacing past 10,000. Most California PAGA settlements land between $100k and $500k; the average, pulled up by a handful of large cases, runs near $900k. The delta between the 15% and 30% caps on that reference case is roughly $135k. That is the dollar number MicroForensics is built around.

PAGA is the multiplier, not the whole bill. Most demand-letter dollars are statutory penalties paid directly to employees — §226 wage statements, §203 waiting time, §226.7 meal and rest premiums, §2802 reimbursement — with §2699 civil penalties layered on top (65% to LWDA, 35% to employees). The same record addresses both surfaces: the reasonable-steps cap compresses the PAGA layer, and the per-period attestations answer the claims beneath it.

The damage isn’t only the settlement. It’s twelve to eighteen months of legal fees, executive distraction, and the morale hit of a wage-theft accusation — usually for paperwork failures, not actual underpayment.

Table 01 — §2699 cap delta on a $900k reference case

No documented steps: full exposure
Steps shown within 60 days of notice: 30% cap
Steps documented before notice: 15% cap
Penalty exposure at 30%: ~$270k
Penalty exposure at 15%: ~$135k
Cap delta: ~$135k

Reference figures based on state-reported settlement data. Real numbers vary by industry, headcount, and fact pattern. We run yours in the audit.

Where the gaps usually live

We have audited compliance at six California employers and built for three. None were trying to cheat. All of them had gaps.

01
Attestation lives at hire, not per pay cycle.
The ‘I waived my break voluntarily’ acknowledgment is signed on the first day of employment and never refreshed. It says nothing about any specific pay period. Donohue v. AMN Services (Cal. 2021): time records showing missed, short, or late meal periods raise a rebuttable presumption of violation — and contemporaneous attestation, captured when the exception occurs, is the evidence the court contemplated to rebut it.
02
Timesheet corrections leave no defensible audit trail.
Hours get adjusted — sometimes legitimately, sometimes by a manager — without a structured record of who changed what, when, and why the employee agreed.
03
Time-tracking, HR, and payroll don’t talk.
Three systems, three sources of truth. When a notice arrives, no one can produce a single queryable record of what each employee was paid and what they signed off on. Field-heavy operators almost always run two or three systems that were never wired to each other.
04
Communication is verbal, not signed.
Foremen and dispatchers tell crews about meal-break rules. Crews nod. The system captures none of it. In court, that conversation never happened.
05
Violations get caught after payroll runs, not before.
By the time anyone reviews the cycle, the historical record is locked. Real-time correction prevents the violation; biweekly review only documents it. The 15% cap requires prevention, not after-the-fact reporting.

What employers do instead

Every alternative produces something. None of it is the record.

A handbook signed at hire
Policy, not evidence. It says nothing about any specific pay period — which is where the presumption lives.
The payroll app’s clock-out checkbox
Time data, not the employee’s contemporaneous affirmation — and the platforms most sub-100-employee companies actually run (Gusto, QuickBooks Time, ExakTime) don’t even offer the checkbox.
A PEO
Co-employment leaves wage-and-hour compliance responsibility with you. The PEO relies on the hours you report; the record problem stays yours.
A one-time law-firm audit
A memo that starts decaying the day it’s delivered. Point-in-time, no operating layer, no standing record between audits.
Self-serve compliance software
You configure it, drive crew adoption, and operate it yourself — exactly the job a company without an HR department cannot staff.
EPLI and hope
California EPLI policies commonly exclude or sublimit wage-and-hour claims. Insurance is money after the fact at best; the §2699 caps turn on the record built before.

The record is the product. Everything else is an input.

Ink-line illustration of a worker's hand tapping a ruggedized wall-mounted kiosk tablet on a jobsite; the screen shows an attestation checklist as placeholder lines, with one status highlighted in amber. — Crews clock in before light. The record starts where the day does.

What MicroForensics is

The orchestration layer that produces the record.

MicroForensics is not an HRIS, a 50-state content library, or a PEO. It is the layer that stitches your existing time, payroll, and HR systems into a defensible record — in real time, in English and Spanish, on the platforms your crews already use. We orchestrate. We don’t replace. Built for foremen, drivers, and warehouse crews — not desk workers.

01
Real-time attestation, configurable cadence
Per-shift, end-of-day, end-of-week, or per pay cycle — whichever fits the operation. Captures meal and rest break compliance, hours accuracy, and pay-match in the employee’s own words. The same flow doubles as the attestation surface for SB 553 workplace violence reporting, §3395 outdoor and §3396 indoor heat, and observed-incident logging. Bilingual by default.
02
AI guidance during the shift
Alerts the foreman or dispatcher before the §512 fifth-hour window expires, before unapproved overtime accrues, before a missed-break premium triggers. The point is to prevent the violation, not to count it after the pay run closes. Real-time guidance is what moves the cap from 30% to 15%.
03
Adaptive courses for repeat offenders
When the same employee misses three breaks in two weeks, they get a short, role-relevant course — not blanket annual training the whole crew sat through. Behavior triggers learning. Completion lands on the audit trail with a timestamp.
04
The defensible record
Structured. Queryable. Timestamped. Bilingual. Reviewed by named California labor counsel before launch and on every statutory update. The kind of record that has made contingency-fee firms walk away before filing — three times, to date, zero dollars settled.

Paper, phone, or SMS — every path lands in the same record.

Built and operated by Floburn

We build it for your stack, then we run it.

MicroForensics is not an off-the-shelf SaaS. It’s a configurable orchestration layer Floburn’s engineering team builds and operates per customer — real-time attestation flows, shift-event guidance, and adaptive course routing on top of the customer’s existing timekeeping and payroll stack. Three implementations to date, across three different stack combinations. Two to four weeks from diagnostic to go-live, depending on stack complexity.

01
Custom integration to your existing stack.
Gusto, BusyBusy, QuickBooks Time, Deputy, Rippling, ADP, Paychex, Justworks — or your specific combination. We build the adapters; you keep your tools. Where APIs exist, we use them. Where they don’t, we use exports, SFTP, or structured manual entry that flows into the same audit trail.
02
AI assistance, narrowly bounded.
We use AI where it earns its keep — defense narrative drafting, anomaly detection, bilingual employee Q&A, weekly digests for owners. We do not use AI to fire attestations, modify the audit trail, or generate legal opinions. Every AI action is logged with prompt, input, and output, so any finding can be reconstructed and explained.
03
Manual paths preserved as first-class.
Some clients automate end-to-end; some still hand out paper attestations to crews without phones. Both flow into the same audit trail with the same chain-of-custody integrity. Automation is leverage, not a prerequisite.
04
We operate it. You don’t maintain it.
Floburn runs the platform configuration on your behalf, updates the rules library as California labor law changes, and produces the reports your CFO and counsel actually use. You get the audit-defensible record without owning the maintenance.

Where the record runs

Fifteen California industries, ranked by fit.

Each page covers that industry’s own exposure pattern, the stacks it already runs, and the questions its buyers ask first.

Also served, inbound: logistics fleets.

Frequently asked

Questions worth answering before a call.

01
What is the 15% PAGA penalty cap?
California’s Private Attorneys General Act caps civil penalties at 15% of the statutory maximum for employers who took “all reasonable steps” toward compliance before a PAGA notice arrived — or before an employee’s personnel or payroll records request, which often comes first — and can show it. Steps toward prospective compliance taken within 60 days after the notice cap penalties at 30%. Whether the steps were enough is the court’s call, on the totality of the circumstances. The cap is in Labor Code §2699, as amended by AB 2288 and SB 92 (2024). It is conditional on evidence, not policies. No record, no cap.
02
What counts as “reasonable steps” under amended §2699?
The statute names four examples: periodic payroll audits, written policies disseminated to employees, supervisor training on Labor Code and Wage Order compliance, and corrective action when violations are surfaced. Each must be shown — with timestamps, signatures, and a chain of custody that survives discovery. MicroForensics produces all four as evidentiary artifacts. Policies that exist only in a handbook do not count.
03
What do AB 2288 and SB 92 actually require employers to document?
Together, the 2024 reforms require employers claiming the §2699 cap to demonstrate four things contemporaneously: that policies were written and distributed, that supervisors were trained, that the employer audited compliance periodically, and that surfaced violations were corrected. LWDA’s February 2026 proposed regulations raise that documentary bar further. Demonstration is by evidence, not assertion — meaning a per-pay-period record tied to specific employees, dates, and times.
04
Does our BusyBusy or ExakTime data already satisfy the per-pay-period attestation requirement?
BusyBusy and ExakTime produce time data — clock-in, clock-out, GPS, geofencing. They do not produce attestation. The §2699 record requires the employee’s contemporaneous affirmation or dispute that meal and rest breaks were taken, hours are accurate, and pay matches expectation. MicroForensics rides on top of BusyBusy or ExakTime, ingests the time data, and routes per-pay-period attestations to each hourly employee — with the employee’s signature and timestamp joining the audit trail.
05
We use ADP or Paylocity for payroll. Do we have to migrate to use MicroForensics?
No. MicroForensics is the orchestration layer above your existing HRIS, timekeeping, and payroll systems. We integrate with ADP Workforce Now, Paylocity, Gusto, BusyBusy, ExakTime, Samsara, Motive, and Geotab. You keep your stack. We orchestrate. We don’t replace.
06
Doesn’t our EPLI policy cover this?
Usually not the way owners assume. California EPLI policies commonly exclude wage-and-hour claims outright or sublimit them to defense costs only — the statutory penalties and premiums a PAGA matter stacks are typically not covered. Ask your broker to show you the wage-and-hour endorsement language before assuming coverage. Insurance is, at best, money after the fact; the §2699 caps turn on the record you built before.
07
What is the difference between a one-time hire-day waiver and a per-pay-period meal break attestation?
A waiver signed at hire establishes that the employee was informed of the meal-break rule. It does not establish that any particular break on any particular day was taken or knowingly waived. Donohue v. AMN Services (Cal. 2021) held that noncompliant time records create a rebuttable presumption of violation; contemporaneous attestation — captured when the exception occurs — is the rebuttal evidence the California Supreme Court contemplated. The hire-day signature is policy. The contemporaneous attestation is evidence — the Donohue rebuttal.
08
A PAGA notice just landed. What does MicroForensics do for us now?
If all reasonable steps were taken and documented before the notice, the statute caps civil penalties at 15% — applied by the court on a totality-of-the-circumstances showing. If documentation is incomplete, you have 60 days to take and demonstrate reasonable steps toward prospective compliance and qualify for the 30% cap. MicroForensics can be implemented inside that 60-day window — that is the cure-provision use case. Employers with 100 or more employees can request a court-supervised early evaluation conference, which gives Floburn time to implement and your counsel time to build a defensible record; employers under 100 have a confidential LWDA cure path with its own short clock. The earlier we start, the more material we can produce.

MicroForensics — Diagnostic

Before the implementation, a fixed-scope diagnostic.

Most California employers don’t need a custom-build conversation on the first call. They need a clear answer to a different question: given what we have today — the timekeeping, the policies, the records — where does our PAGA exposure actually sit, and what would it take to close it?

The MicroForensics Diagnostic answers that question in two weeks. We pull and review your time, payroll, and attestation records; interview your HR, payroll, and operations leads; and deliver a written report with three things in it.

01
A finding-by-finding map of which §2699 reasonable steps your current records can prove — and which they cannot.
Meal/rest break attestations, accrual tracking, training records, equipment certifications, missing signatures, audit-trail integrity, and the surfaces no one else looks at.
02
A draft of the defense narrative your attorney could tell today with the records you have today.
This is the section most clients keep. Knowing the story your existing data already supports is what separates a posture from a guess.
03
A remediation roadmap.
What you can fix in the tools you already use. What requires the MicroForensics implementation. What is genuinely optional.

The diagnostic stands on its own. You can take the report and act on it without ever buying anything else from us. About a third of clients do exactly that.

Two ways to engage the diagnostic

The right structure depends on what you want the diagnostic to do. We don’t push one over the other; we pick the right one with you on the discovery call.

Standard diagnostic

Fixed fee

Engagement: Floburn ↔ You
Privilege: None
Discovery exposure: Findings discoverable
Timeline: 14 calendar days
Best fit: Baseline assessment, no specific dispute on the horizon

Diagnostic through counsel

Fixed fee, via counsel

Engagement: Your counsel ↔ You; counsel engages Floburn
Privilege: Asserted through counsel’s engagement (Kovel structure)
Discovery exposure: Findings positioned for protection; privilege is always the court’s determination
Timeline: 14–21 calendar days
Best fit: Post-notice, M&A diligence, prior settlement, board mandate

Privilege is a function of the engagement structure, not the work itself — and whether it holds is always the court’s determination, which is why the engagement is papered by counsel, not by us. We can route the diagnostic through your existing employment counsel or introduce you to firms we work with regularly. Some firms in this category add “attorney-reviewed” framing to non-privileged reports and imply protection that isn’t there. We don’t. If it ever matters, that pretense doesn’t survive scrutiny.

For defense counsel

Your clients’ reasonable-steps record, under your engagement.

Firms defending California wage-and-hour matters already tell clients to document reasonable steps. MicroForensics is the documentation layer: the per-pay-period record, built from the timekeeping and payroll systems the client already runs, produced in the shape a §2699 defense actually uses.

We work through your engagement — the diagnostic runs under counsel direction, and the standing record is built to be produced, not privileged. Your firm stays the advisor; we operate the machinery. For firms with a book of employer clients, the record can carry your firm’s name on the client-facing reporting.

Start a firm conversation→

Or start with a conversation

Free 30-minute discovery call.

A fit conversation, not a sales call. Tell us about your timekeeping and payroll setup, your headcount, and what’s prompting the conversation. We’ll tell you whether the diagnostic makes sense for you, which engagement structure (standard or through counsel) fits your situation, and what to expect if you proceed. No deck, no deliverable, no commitment. If we’re not the right fit, we’ll say so.

Request a discovery call→

MicroForensics’s attestation workflows, notice language, and record formats are reviewed by California labor and employment counsel at launch and on each statutory update. Counsel advises Floburn on system design and does not represent your company; retain your own counsel for advice specific to your situation. Floburn Inc. is not a law firm and does not provide legal advice.

Three California employers. Three contingency-firm probes. Zero dollars settled.

Three implementations. Three different stacks. One outcome — to date.

A Reno-based commercial construction firm holding Tesla and T-Mobile contracts across California

A Salinas Valley winery — the #1 direct-to-consumer wine seller in the country in 2024

One of the largest home staging businesses in the greater Sacramento area

The 15% cap doesn’t apply itself.

We have audited compliance at six California employers and built for three. None were trying to cheat. All of them had gaps.

Attestation lives at hire, not per pay cycle.

Timesheet corrections leave no defensible audit trail.

Time-tracking, HR, and payroll don&rsquo;t talk.

Communication is verbal, not signed.

Violations get caught after payroll runs, not before.

Every alternative produces something. None of it is the record.

A handbook signed at hire

The payroll app’s clock-out checkbox

A PEO

A one-time law-firm audit

Self-serve compliance software

EPLI and hope

The orchestration layer that produces the record.

Real-time attestation, configurable cadence

AI guidance during the shift

Adaptive courses for repeat offenders

The defensible record

We build it for your stack, then we run it.

Custom integration to your existing stack.

AI assistance, narrowly bounded.

Manual paths preserved as first-class.

We operate it. You don&rsquo;t maintain it.