Timecard Edits and Punch Corrections: Audit Trail Controls

Timecard edits are where most FLSA recordkeeping risk lives, because every manual change replaces what the employee actually punched with what someone decided they worked. Control them by limiting who can edit, requiring a reason code for every change, getting the employee's acknowledgment, keeping an unalterable audit trail and reviewing edit patterns each pay period.

Disclosure: The author works at CloudApper, which makes CloudApper AI TimeClock, which is discussed in this article.

Key takeaways

• The FLSA requires accurate records of hours worked each workday and workweek. An edit that cannot be explained weakens the whole record.
• Separate the right to request a correction from the right to make it, and keep payroll out of routine edits.
• Every edit needs a reason code, the original punch, the editor, a timestamp and the employee's acknowledgment.
• Rounding is a policy applied to everyone the same way. Editing is a one-off decision. Do not let one disguise the other.
• Review edit reports by manager and by employee before close, not after a complaint.

Why are timecard edits the main FLSA recordkeeping risk?

Under 29 CFR 516.2, employers must keep, for each nonexempt employee, the hours worked each workday and the total hours worked each workweek, along with pay data. The Department of Labor's Fact Sheet 21 on FLSA recordkeeping says employers may use any timekeeping method they choose, but the information must be complete and accurate.

A raw punch is evidence created by the employee at the moment of work; an edit is a later statement by someone else. Rare, explained edits make records more accurate. Frequent, unexplained edits that reduce hours are the first thing an investigator looks at. Our guide to how employers respond to a DOL wage and hour investigation covers what happens once records are requested; this article is about making sure the edits inside them hold up.

Retention matters too. The DOL rule at 29 CFR 516.6 requires time cards showing daily start and stop times to be kept for at least two years, and payroll records for three under the companion rule. State rules can be longer, which is why the original punch and the edit history should be retained together under the longest applicable period. See our piece on resolving conflicting multistate HR records retention rules.

Who should be allowed to edit a timecard?

Most problems start with access that grew over time. A practical model separates four roles:

Role	Can do	Should not do
Employee	Request a correction, add a missed punch request, acknowledge edits	Change approved time directly
Direct manager	Make edits for own team with a reason code, approve requests	Edit own timecard or other teams' time
Timekeeping or HR admin	Edits for escalations, terminated employees, system errors	Edit without a ticket or manager request
Payroll	Review, sign off, post-close adjustments through a documented process	Routine punch edits during the period

Keep edit rights short and review them quarterly. If your process already separates approval from sign-off, as described in our UKG timecard approval and payroll close workflow guide, apply the same separation to edits.

What should every punch correction record?

A defensible edit captures the following, automatically where possible:

• The original punch, preserved and visible, not overwritten.
• The new value and the hours effect (added, removed or moved between days).
• Who made the edit and when, using a named account, never a shared login.
• A reason code from a short controlled list, plus a free-text note for anything unusual.
• The employee's acknowledgment, or a record that they disputed it.

A starter reason code list

• Missed punch, employee reported
• Device or connectivity failure
• Wrong job, department or pay code
• Meal period not taken or interrupted
• Approved schedule change

Avoid vague codes such as "adjustment." Notice there is no code for "reduce to scheduled hours." If time was worked, it is hours worked, even when it was not authorized. Handle unauthorized overtime through discipline, not through the timecard.

How is rounding different from editing?

The DOL's rule at 29 CFR 785.48 accepts rounding start and stop times to set increments, such as the nearest tenth or quarter of an hour, only if it does not, over time, result in employees being undercompensated. Rounding is a neutral rule applied by the system to every punch the same way. An edit is a human decision about a specific punch.

A manager who changes 7:52 to 8:00 on some timecards is not rounding, even if the result looks the same. Configure rounding in the system, document the policy, test it periodically to confirm it is neutral, and treat any manual change to a time as an edit with a reason code.

What edit patterns should trigger an internal investigation?

Run an edit report each pay period, grouped by editor and by employee. Look for:

• Edits that almost always reduce hours, or reduce hours close to the 40-hour threshold.
• Meal periods added after the fact to many timecards in the same location.
• One manager whose edit rate is far above peers with similar teams.
• Edits made after the employee's final paycheck or after a complaint.
• Edits with no acknowledgment, or acknowledgments collected in bulk on one day.

None of these prove a violation, but each deserves a conversation, a sample review against other evidence (door logs, POS logins, system activity) and, where hours were cut, back pay.

How to apply this: a worked example

Consider a hypothetical 300-person distributor with two warehouses. Payroll notices that one shift supervisor made far more edits than anyone else, most labeled "adjustment." A review shows many were missed meal punches being inserted, while others moved clock-outs back to the scheduled end time. The company responds in four steps: it removes the "adjustment" code and introduces six specific reasons; it switches meal compliance to a clock-out question so employees confirm or decline their break themselves (see our guide to clock-out attestations for breaks and injuries); it requires employee acknowledgment of any edit that removes time; and it reviews the supervisor's past edits against badge records, paying back any hours removed without support.

Common mistakes

• Letting payroll fix punches during close because it is faster.
• Treating employee acknowledgment as optional when hours are reduced.
• Keeping edit history in a system that purges it before the retention period ends.
• Fixing the edit symptom while ignoring the cause, such as a clock in the wrong place. Our guide to stopping buddy punching with face ID and geofencing safely covers the identity side of punch accuracy.

Where does CloudApper AI TimeClock fit?

The cheapest edit is the one you never need. CloudApper AI TimeClock is designed to reduce that upstream need. According to its product page, punch methods, data capture forms, prompts, attestations and overtime policies are configurable, and employees can punch by facial recognition, QR code, barcode or NFC on standard tablets, phones, web or desktop. Attestations collected at the punch are logged, which gives the employee's own confirmation of breaks or job details instead of a later manager edit. Offline capture records punches during an outage and syncs when connectivity returns.

The page also lists a Compliance Management Agent aimed at labor law compliance and an HR and Payroll Sync Agent that sends time data to major HR and payroll systems, including UKG, Workday, ADP and others. Edit permissions and edit history usually live in your timekeeping or HCM system of record, so confirm how the two fit together before you rely on either for audit evidence.

Questions to ask any vendor

• Is the original punch preserved and visible after an edit, and can anyone delete history?
• Can edit rights be limited by role, team and location, and can a manager be blocked from editing their own time?
• Can reason codes be made mandatory, and can we report on them by editor?
• How does the employee acknowledge or dispute an edit, and is that recorded?
• How long is edit history retained, and can we export it for an investigation?

Frequently Asked Questions

Is it legal for a manager to edit an employee's timecard?

Yes. Nothing in the FLSA forbids edits, and correcting a missed or wrong punch makes records more accurate. The problem is edits that remove time actually worked or cannot be explained. Require a reason code, preserve the original punch, notify the employee and keep the history for at least as long as the time records themselves.

Do employees have to sign off on timecard changes?

Federal law does not require an employee signature on each edit, so check your state rules and union agreements, and many internal policies expect it anyway. Acknowledgment is strong evidence that the corrected time is accurate. At minimum, notify employees of any edit that reduces hours and give them a simple way to dispute it before payroll closes.

How long should we keep timecard edit history?

Keep edit history with the time records it changes. Under 29 CFR 516.6, time cards must be kept for at least two years, and payroll records for three. State rules may be longer, and litigation holds override normal schedules. Many employers simply keep the original punch, edit log and payroll record together for the longest applicable period.

Can we automatically deduct meal breaks instead of editing timecards?

Automatic meal deductions are common but risky when employees work through breaks, because the deduction removes time without anyone checking. If you use them, give employees an easy way to cancel the deduction at clock-out and audit cancellations. Many employers prefer having employees punch or attest to the meal period instead.

Practical next steps for HR and payroll

1. Pull a list of everyone with timecard edit rights and remove anyone who does not need them.
2. Replace vague reason codes with a short, specific list and make the code mandatory.
3. Turn on employee notification or acknowledgment for edits that reduce hours.
4. Add an edit report by editor to your pre-close checklist.

For more wage and hour checklists, browse our payroll compliance guides.

Last reviewed: October 2026.

Sources

• Fact Sheet #21: Recordkeeping Requirements under the Fair Labor Standards Act, U.S. Department of Labor, Wage and Hour Division
• 29 CFR 516.2: Employees subject to minimum wage or minimum wage and overtime provisions, Electronic Code of Federal Regulations
• 29 CFR 785.48: Use of time clocks, Electronic Code of Federal Regulations
• CloudApper AI TimeClock, CloudApper