30/90/180 Day OFCCP Hiring Plan for U.S. Federal Contractors

Federal contractors with 50 or more employees and covered contracts must maintain current written Affirmative Action Programs, accurate applicant records, and a documented veteran hiring benchmark. Confirming this coverage status is the first task. The next step is a 30-day audit of thresholds, self-identification data, and recordkeeping systems to confirm nothing is missing before a Scheduling Letter arrives.

TL;DR:

• Contractors must continuously verify their contract values and employee counts, updating thresholds and audit data whenever a new agreement or employment change occurs.
• Maintaining a well-organized internal audit process, including tracking outreach effectiveness and validation status of selection tools, is essential for ongoing OFCCP compliance.
• Documenting veteran outreach efforts with measurable results, and retaining supporting data for at least three years, strengthens defense during compliance evaluations.
• Electronic applicant records must be kept in accessible, exportable formats for at least two years, with shorter retention periods allowed for smaller contractors.
• Ongoing training for HR and hiring managers on fair hiring practices and proper recordkeeping reduces the risk of noncompliance and prepares organizations for audits.

Table of Contents

• Overview of OFCCP authority and the 2026 enforcement context
• Jurisdictional thresholds and coverage: a quick eligibility checklist
• Affirmative Action Programs: required components and internal controls
• VEVRAA hiring benchmark and veteran outreach: setting and documenting a benchmark
• Recordkeeping and the Internet Applicant rule: retention, electronic records, and audit readiness
• Selection procedures and validation: adverse impact and UGESP compliance
• Scheduling letters and compliance evaluations: common data requests and how to respond
• Practical compliance checklist: a 30/90/180-day plan and red flags to fix now
• Employee and applicant notification requirements under OFCCP
• Training requirements for HR and hiring managers on OFCCP compliance
• How to handle OFCCP compliance with subcontractors and suppliers
• What experienced talent leaders get wrong about audit readiness
• How IXCommunities can help with training, benchmarking, and resources
• Sources
• FAQ

Overview of OFCCP authority and the 2026 enforcement context

The Office of Federal Contract Compliance Programs enforces three authorities that shape hiring practices for federal contractors. Executive Order 11246 addresses discrimination based on race, color, religion, sex, and national origin. Section 503 of the Rehabilitation Act covers individuals with disabilities. The Vietnam Era Veterans' Readjustment Assistance Act, known as VEVRAA, covers protected veterans. Each authority carries its own recordkeeping and outreach expectations.

Enforcement intensity has shifted over recent years, but the underlying obligations have not disappeared. Even during periods of reduced audit activity, OFCCP's core requirements around Section 503, VEVRAA, and EO 11246 remain in effect. The practical posture for 2026 is what many compliance professionals describe as quiet preparation: keeping documentation current and measurable rather than waiting for a scheduling letter to trigger a scramble.

A compliance evaluation typically reviews:

• Written AAP components and utilization analyses
• Applicant and hire records tied to self identification data
• Outreach and recruitment documentation with effectiveness measures
• Compensation data across defined snapshot periods

As of October 2025, OFCCP applies a $20,000 jurisdictional threshold for Section 503 and a $200,000 threshold for VEVRAA, with written AAPs required at 50 or more employees and qualifying contract values, according to the Department of Labor. Confirming where your organization sits against these figures is the starting point for everything that follows.

Jurisdictional thresholds and coverage: a quick eligibility checklist

Coverage depends on contract value, subcontract relationships, and employee count, not just the size of a single agreement. The Department of Labor's jurisdictional thresholds page sets Section 503 coverage at contracts of $20,000 or more and VEVRAA coverage at $200,000 or more. Written AAPs become mandatory once an organization has 50 or more employees and holds a covered contract at or above the applicable threshold.

Use this checklist to confirm status:

• Does any single contract or subcontract meet or exceed the $20,000 or $200,000 thresholds
• Does the organization employ 50 or more people across covered establishments
• Do multiple smaller contracts aggregate toward a covered threshold within the same contract period
• Has a recent merger, acquisition, or subcontract arrangement changed the employee count or contract exposure

Aggregation rules matter here. A contractor with several subcontracts that individually fall under the threshold can still be covered if the combined value crosses it within the same performance period.

Pro Tip: Rerun your thresholds and headcount check every time a new contract is signed or a subcontractor relationship changes, not just once a year.

Affirmative Action Programs: required components and internal controls

A written AAP is not a static document. OFCCP expects an internal audit and reporting system that functions as the backbone of the entire program, tying analysis to action and action to results.

1. Organizational profile and workforce analysis: a current snapshot of job titles, reporting relationships, and demographic composition
2. Utilization and placement analyses: comparisons of incumbency against availability for women, minorities, protected veterans, and individuals with disabilities.
3. Action oriented programs: specific steps tied to any identified underutilization, with target dates and named owners.
4. Designation of responsibility: a named official accountable for AAP implementation and results.
5. Internal audit and reporting system: a recurring process that checks whether action items are being completed and whether results are moving in the right direction.

The cadence matters as much as the content. Quarterly internal reviews, followed by an annual report to senior leadership, give an organization a defensible trail showing good faith effort rather than a document created once and left untouched. Documentation should show measurable outcomes, not just activity: how many outreach events were held, and what hiring or applicant flow resulted from them.

Pro Tip: Store AAP review minutes and leadership reports in the same file structure as the AAP itself, so a Scheduling Letter response does not require reconstructing a year of activity from scattered records.

VEVRAA hiring benchmark and veteran outreach: setting and documenting a benchmark

VEVRAA requires every covered contractor to establish an annual hiring benchmark for protected veterans, using one of two methods described in OFCCP guidance materials. The first is adopting the published national benchmark. The second is calculating an individualized benchmark using a five factor method, which draws on local veteran labor force availability, the number of veterans applying, the number hired, past outreach effectiveness, and any additional relevant data the contractor identifies.

Whichever method is chosen, documentation of that choice and its supporting data must be retained for three years, per the same OFCCP materials.

Outreach documentation should go beyond a list of job fairs attended. OFCCP's promising practices guidance emphasizes measuring the effect of outreach efforts, not just participation. Useful tracked activities include:

• Applications received per outreach event or partner organization
• Hires resulting from specific veteran service organization referrals
• Year-over-year changes in veteran applicant flow tied to specific outreach channels

Recordkeeping and the Internet Applicant rule: retention, electronic records, and audit readiness

Recordkeeping failures are one of the most common gaps found during compliance evaluations, often because retention periods differ by contractor size and record type.

1. Standard retention is two years from the date a record is created or a personnel action is taken.
2. Smaller contractors, those with fewer than 150 employees or without a covered contract of at least $150,000, may retain records for one year instead of two.
3. Certain AAP supporting data, including outreach and hiring benchmark documentation, should be kept for three years to align with VEVRAA's own retention expectation.

The Internet Applicant rule defines who counts as an applicant when hiring happens online, and that definition drives what must be retained: the search criteria used to identify candidates, the dates searches were run, and the resumes or profiles of individuals considered. A 2005 Federal Register rule clarifies that screenshots alone may not satisfy this requirement if OFCCP cannot reproduce the contractor's selection process from them.

Electronic systems introduce their own risks. Contractors must ensure records remain accessible, backed up, and exportable in a readable format, since OFCCP's electronic records guidance notes that a URL pointing to a system is not sufficient if the underlying content cannot be produced on request.

Pro Tip: Confirm in writing that any applicant tracking system vendor can export full applicant history, including search criteria and dates, before a Scheduling Letter forces the question.

Selection procedures and validation: adverse impact and UGESP compliance

Any tool used to screen, rank, or select candidates counts as a selection procedure under the Uniform Guidelines on Employee Selection Procedures, commonly called UGESP. This includes cognitive tests, scored structured interviews, resume screening algorithms, and AI based assessment tools.

OFCCP evaluates these tools for adverse impact using statistical methods described in its selection procedures guidance:

• The impact ratio, commonly called the four-fifths rule, compares selection rates across groups
• The Two Independent Sample Z Test measures whether a selection rate difference is statistically meaningful
• Fisher's Exact Test is used for smaller sample sizes where the Z test may be unreliable

When a selection procedure produces adverse impact, contractors must supply validation evidence consistent with UGESP, according to OFCCP's own FAQs, regardless of whether a vendor markets the tool as already validated or compliant. Validation can take the form of content validity, criterion related validity, or construct validity, but the responsibility to produce that evidence sits with the contractor, not the vendor. A vendor's internal testing does not transfer automatically. If a tool was validated elsewhere, the contractor needs a documented transportability justification showing the original study applies to its own workforce and job requirements.

Scheduling letters and compliance evaluations: common data requests and how to respond

A compliance evaluation typically begins with a Scheduling Letter and an accompanying Itemized Listing. According to OFCCP's own FAQ page, these requests generally require the current year AAP along with supporting data from the immediately preceding AAP year, and contractors usually have 30 calendar days to respond unless an extension is granted.

Common Itemized Listing requests include:

• Item 15, the veteran hiring benchmark and the method used to set it
• Item 19, applicant and hire data supporting utilization analyses
• Item 21, personnel policies and any technology used in recruitment or selection
• Item 22, a compensation evaluation, typically covering two employee level snapshot dates within the AAP period

Organizing responses before a letter arrives saves significant time during the 30 day window. Practical steps include maintaining an index of where each Itemized Listing item's supporting file lives, keeping compensation data exportable by snapshot date, and confirming early who within the organization is authorized to request an extension if 30 days proves insufficient.

Pro Tip: Build a standing Itemized Listing index that maps each numbered item to a specific file location, updated whenever the AAP is refreshed.

Practical compliance checklist: a 30/90/180-day plan and red flags to fix now

Turning these obligations into a working timeline helps HR teams prioritize without losing track of anything.

1. Within 30 days: confirm contract and employee thresholds, audit self-identification response rates, inventory current AAP documents by establishment, and verify backups exist for applicant tracking system data.
2. Within 90 days: establish or refresh internal audit routines for AAP action items, build an inventory of every selection tool in use with its validation status, and set up outreach effectiveness tracking tied to specific veteran and disability recruitment channels.
3. Within 180 days: update AAP action oriented programs based on the latest utilization analysis, deliver a formal report to senior leadership, and review vendor contracts to confirm data export and retention obligations are met.

Common red flags include self-identification response rates that have gone unreviewed for a full cycle, selection tools with no documented validation status, and outreach activity logs that record attendance but not applicant or hire outcomes.

Pro Tip: Treat the 30/90/180 day plan as a recurring cycle tied to each AAP anniversary, not a one-time cleanup project.

Employee and applicant notification requirements under OFCCP

Federal contractors must post and communicate specific notices to both employees and applicants as part of their affirmative action obligations. This includes the "Equal Employment Opportunity is the Law" poster, which must be displayed in locations visible to applicants and employees, and applies to obligations under EO 11246, Section 503, and VEVRAA together.

Contractors must also invite applicants and employees to voluntarily self identify as a protected veteran or individual with a disability, using specific language OFCCP has approved for this purpose. This invitation typically happens at the pre offer stage and again after a job offer is extended, since the acceptable timing and content differ for veteran versus disability self identification.

Internal communication matters as well. Employees should be able to locate the AAP's policy statement and know who within the organization is responsible for its administration. Job postings for openings, where legally required, should be listed with the appropriate state workforce agency or through other channels that support outreach documentation.

Missing or outdated notification language is a common gap found during evaluations, particularly when a contractor has updated its self identification forms for one protected group but not the other, or when poster versions in physical locations have not been refreshed after a regulatory update.

Training requirements for HR and hiring managers on OFCCP compliance

OFCCP does not publish a single mandated training curriculum, but its compliance evaluations consistently look for evidence that hiring managers and HR staff understand how to apply AAP related policies in practice, not just that a policy document exists.

Effective training programs typically cover a few core areas: how to properly invite self identification without pressuring a candidate, how to document outreach activities in a way that supports effectiveness measurement, and how to recognize when a selection procedure might create adverse impact before it becomes a pattern across many hires.

Hiring managers in particular benefit from training on interview documentation practices, since inconsistent notes are a frequent source of difficulty when OFCCP requests an explanation for why one candidate was selected over another. HR staff responsible for AAP administration need a working understanding of utilization analysis and the internal audit cycle, since they are often the ones translating a compliance obligation into a measurable action item.

Refresher training tied to the AAP's annual update cycle keeps the material current, particularly when jurisdictional thresholds, benchmark methods, or notification requirements change.

How to handle OFCCP compliance with subcontractors and suppliers

Coverage obligations can extend down a supply chain through the flow down clauses required in covered subcontracts. A prime contractor is generally responsible for including the appropriate equal opportunity clauses in qualifying subcontracts, and subcontractors that meet the same jurisdictional thresholds carry their own independent AAP and recordkeeping obligations.

Practical management of this relationship starts with a subcontractor inventory: which vendors hold contracts or subcontracts at or above the Section 503 and VEVRAA thresholds, and which of those vendors have confirmed they maintain a current written AAP. Contract renewal cycles are a natural checkpoint to request this confirmation, along with contact information for whoever administers the subcontractor's own compliance program.

Where a subcontractor supplies staffing or recruitment services directly, additional care is needed around applicant record ownership. If the subcontractor's system is the one generating applicant flow data, the prime contractor needs a documented agreement establishing that records remain accessible and exportable if a Scheduling Letter arrives, consistent with the same electronic records expectations that apply internally.

Flow down clause language and subcontractor confirmations should live in the same file structure as the AAP itself, so a subcontractor's compliance status is not a separate research project when an evaluation begins.

What experienced talent leaders get wrong about audit readiness

Many organizations treat OFCCP compliance as a documentation exercise finished once a year when the AAP is filed. The more durable approach treats it as an ongoing measurement discipline, where outreach effectiveness, applicant flow, and selection tool validation are tracked continuously rather than reconstructed under a 30 day deadline.

The gap that catches contractors off guard is rarely the absence of a policy. It is the absence of evidence that the policy produced a measurable result, whether that is a veteran hire traced to a specific outreach channel or a validation study on file before a selection tool ever creates adverse impact. Peer benchmarking within talent leadership communities tends to surface these gaps faster than internal review alone, since comparing outreach effectiveness measures across organizations of similar size makes it easier to see which practices actually move applicant flow rather than just generating activity logs.

— Simon

How IXCommunities can help with training, benchmarking, and resources

Building the internal audit and reporting system OFCCP expects takes more than a policy template. It takes access to peers who have already worked through the same benchmark methodology questions and selection tool validation gaps.

Certain peer networks support talent acquisition and recruiting leaders working through these questions:

• TLIX Membership connects talent leaders in a confidential peer forum for benchmarking AAP practices and outreach effectiveness measures against similar organizations.
• ESIX Membership and DSIX Membership extend the same peer network to executive search and diversity strategy leaders managing related compliance obligations.
• On demand, live, and team intact courses cover practical skills such as selection procedure validation basics, starting from $350 for on demand access and $750 for live online sessions.
• The ExecSmart database and Talent Acquisition Books give members a vetted consultant directory and reference guides that support AAP template development.

Visit IXCommunities to review membership options that match your team's compliance priorities.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

What is OFCCP compliance recruiting?

OFCCP compliance recruiting refers to hiring practices that satisfy the affirmative action and equal opportunity obligations under EO 11246, Section 503, and VEVRAA, including documented outreach, self identification invitations, and hiring benchmark tracking. It requires maintaining records that show outreach efforts produced measurable applicant and hire results, not just participation.

Is OFCCP dismantled?

OFCCP continues to operate and enforce its core authorities, though enforcement intensity has shifted over recent years. Contractors' substantive obligations under Section 503, VEVRAA, and EO 11246 remain in place, which is why many compliance teams are focusing on keeping documentation current rather than assuming reduced scrutiny removes the requirement.

Can a US company hire a foreign contractor?

This question depends on immigration and labor law rather than OFCCP's affirmative action rules, which govern how covered federal contractors recruit and select candidates rather than who is eligible to work in the United States. Organizations should consult immigration counsel for worker eligibility questions separate from their OFCCP recordkeeping and benchmark obligations.

What key hiring requirements does OFCCP enforce for federal contractors?

OFCCP requires covered contractors to maintain written Affirmative Action Programs, set and document a veteran hiring benchmark, retain applicant and hire records for the periods its recordkeeping rules specify, and validate any selection procedure that produces adverse impact. Coverage begins at $20,000 for Section 503 and $200,000 for VEVRAA, with written AAPs required once a contractor reaches 50 or more employees.