Annual Legal Audit for Texas Businesses: Entity, Contract, Employment, IP, and Privacy Review

By Hank FasthoffJuly 6, 2026

Your company changes each time you add an owner, hire in another state, introduce a product, sign a large customer, or give a vendor access to personal data. Corporate records, contracts, insurance, employment practices, and public filings should reflect the company you operate now.

An annual legal review compares those records and practices against current operations. You should conduct it on a fixed schedule, assign each follow-up item to a person, and calendar the filing or contract deadline that completes the work. A review that ends with a list of concerns and no assigned responsibility has preserved the problem for another year.

Confirm Entity Status and Authority

You should begin with every entity in the organizational structure, including subsidiaries and entities formed for a specific property or venture. You should confirm each legal name, jurisdiction, registered agent, registered office, assumed name, ownership record, and state of foreign qualification. Texas domestic and foreign filing entities must continuously maintain a registered agent and registered office in Texas, and the Texas Secretary of State explains the filing required when either changes.

Ownership records should agree across the company agreement, stock ledger, capitalization table, subscription documents, tax records, and certificates. If the company issued equity, redeemed an owner, transferred an interest, granted an option, or changed voting rights during the year, you should confirm that the governing body approved the transaction and that every affected record uses the same numbers.

You should also examine the approvals required by the certificate of formation, bylaws, company agreement, shareholder agreement, and loan documents. Annual meetings, written consents, manager approvals, and board resolutions depend on the entity and its governing documents. You should locate each signed approval and prepare any missing record based on what the decision makers authorized at the time.

File the Correct Texas Reports

Texas changed its franchise tax filing system for reports due on or after January 1, 2024. A taxable entity with annualized total revenue at or below the no tax due threshold generally doesn't file a No Tax Due Report. It generally must file a Public Information Report (PIR) or Ownership Information Report (OIR), subject to exceptions for entities such as qualifying passive entities, exempt entities, and qualifying new veteran-owned businesses during their exemption period.

For 2026 reports, the no tax due threshold is $2.65 million. The Comptroller's 2026 filing page identifies the report required for an entity below the threshold, an entity above it, a combined group, a passive entity, and other special filers. Franchise tax reports and information reports are generally due May 15, with the next business day applying when May 15 falls on a Saturday, Sunday, or legal holiday.

You should verify the entity's Comptroller account status after filing rather than rely on proof that a preparer transmitted a form. Failure to file a required PIR or OIR can result in forfeiture of the right to transact business even when the entity owes no franchise tax. The Comptroller's PIR and OIR guidance also identifies which report applies and which entities qualify for an exception.

You should apply current FinCEN rules separately from state ownership reports. As of the date of this article, FinCEN exempts entities created in the United States and their beneficial owners from Corporate Transparency Act reporting under its March 2025 interim final rule. A foreign entity formed under another country's law and registered to do business in the United States may qualify as a reporting company, so you should analyze foreign entities separately.

Review Contracts Before Notice Windows Close

Your contract list should identify the parties, effective date, term, renewal provision, notice address, termination rights, amendment history, and person responsible for the relationship. You should obtain the signed agreement and every amendment rather than rely on a sales summary or an unsigned draft stored under a final filename.

You should calendar each auto-renewal provision by its notice deadline. A contract that renews on December 31 may require notice 30, 60, or 90 days earlier, and the agreement may prescribe a delivery method that ordinary email doesn't satisfy. You should decide whether to renew or renegotiate while the company can use a termination right as bargaining power.

Material customer and vendor agreements require a business review as well as a legal one. You should confirm that pricing, service levels, data access, intellectual property rights, insurance requirements, indemnities, liability limits, and security obligations reflect current performance. A company that expanded the relationship through purchase orders, emails, or operational practice may have assumed obligations that the original agreement never addressed.

You should identify consent requirements before a financing, ownership change, asset sale, or internal reorganization. Assignment restrictions and change of control provisions can require third-party consent even when the operating team treats the transaction as internal. Loan covenants may also restrict distributions, additional debt, liens, acquisitions, affiliate transactions, or changes in management.

Reconcile Intellectual Property Ownership

An intellectual property schedule should identify each trademark, domain name, copyright, patent, trade secret category, software repository, social media account, and material license. You should identify the legal owner, registration or account number, renewal date, authorized users, and agreement supporting the company's rights.

Federal trademark registrations require maintenance filings between the fifth and sixth years after registration, between the ninth and 10th years, and every 10 years after that. The USPTO's maintenance guidance also requires the owner to confirm current use for the goods and services listed in the registration. You should remove goods or services that are no longer in use in commerce and don't qualify for excusable nonuse, then verify the ownership and correspondence information before filing.

Domain names and platform accounts depend on contract terms and account control. You should verify the registrant name, administrative email, payment method, multifactor authentication, renewal setting, and recovery credentials. A former employee's email address shouldn't control a domain, source code repository, advertising account, or app store profile.

Copyright arises when original expression is fixed in a tangible medium. Registration provides separate litigation and remedy advantages. Section 411 generally requires registration or refusal before an infringement action concerning a United States work, subject to statutory exceptions. Section 412 generally bars statutory damages and attorney's fees for infringement that began before registration, while providing a three-month period after first publication for qualifying published works.

You should confirm ownership before filing a copyright application. Under Section 201(b), an employer is considered the author of work made for hire that an employee prepares within the scope of employment and owns the copyright unless a signed agreement provides for different ownership. Work supplied by a contractor often requires a signed assignment, so website code, photographs, videos, designs, training materials, and marketing copy can expose missing ownership documents when the company paid an invoice without obtaining the copyright interest.

Trade secret protection depends on operational secrecy measures. Under 18 U.S.C. Section 1839, federal law protects information when the owner takes reasonable measures to keep it secret and the information derives economic value from secrecy. You should review access permissions, confidentiality agreements, vendor restrictions, device return procedures, and exit practices against the information the company treats as proprietary.

Test Employment Practices Against Current Roles

Job titles and old agreements provide weak evidence when daily work changed. You should compare each worker's current duties and working relationship against employee or contractor status, exempt or nonexempt classification, compensation terms, commission plans, and leave eligibility. The related article on employment law for Texas businesses addresses the federal and Texas rules that govern those decisions.

Your review should compare offer letters, employment agreements, commission plans, bonus terms, and the employee handbook against payroll practice. If a policy promises paid leave, remote work, expense reimbursement, discipline procedures, or severance, managers and payroll personnel should administer the same rule. State supplements may be required when employees work outside Texas.

You should use a controlled process to review Form I-9 records. The process should use the current form, separate I-9 records from personnel files, calendar reverification only when required, and correct errors without concealing the original entry. Any internal audit should follow the federal guidance for internal Form I-9 audits and apply the same procedure without discrimination based on citizenship status or national origin.

Posting duties depend on the statutes that cover the employer. The Department of Labor's Poster Advisor identifies federal notices by coverage, while Texas and industry-specific requirements require separate review. A business subject to the Family and Medical Leave Act has different posting duties from a smaller employer outside that statute.

Examine Workers' Compensation Status

Texas private employers generally may choose whether to obtain workers' compensation coverage. If you subscribe, you should confirm the policy, covered entities, payroll classifications, locations, certificates, claim reporting instructions, and employee notices. Contractual requirements may require coverage even when state law permits a private employer to operate without it.

A Texas nonsubscriber has recurring duties beyond the decision to forgo coverage. The Division of Workers' Compensation requires an annual notice of no coverage between February 1 and April 30, notice to employees, and additional reporting after specified injuries, illnesses, or deaths. The Division's nonsubscriber guidance states the filing events and explains the additional injury reporting requirements for employers with five or more employees.

You should compare the company's coverage decision against its current workforce and operations. A larger payroll, new field work, customer contract, or serious injury history can change the economic exposure. Insurance, occupational accident benefits, arbitration provisions, and safety programs require separate legal analysis and shouldn't be treated as substitutes for a workers' compensation policy without that review.

Match Insurance to Contracts and Operations

You should review each policy against the risks the company now assumes, including general liability, property, professional liability, cyber, crime, employment practices, directors and officers, automobile, and umbrella coverage. Revenue alone doesn't set an adequate limit. Contract limits, maximum plausible loss, customer concentration, regulated activity, property values, and the cost of defending a claim provide a better basis.

You should review named insureds, locations, covered operations, exclusions, retentions, claim notice requirements, and renewal applications. You should compare customer and lease insurance requirements against the policies and endorsements, then verify additional insured status when the contract requires it. Certificates summarize coverage but don't amend the policy or establish every required right.

Review Privacy and Security Practices

You should identify the personal data the company collects, the purpose for each use, where the data resides, who receives it, and how long the company keeps it. Website language should match those operations. A policy copied from another business can misstate tracking, advertising, retention, vendor sharing, consumer rights, and security practices.

The Texas Data Privacy and Security Act applies based on the company's Texas activity, data processing, and available exemptions. A covered controller must provide the required privacy notice, administer consumer rights, limit collection, protect personal data, and document specified data protection assessments. Small businesses generally qualify for an exemption, but a small business must obtain consent before selling a consumer's sensitive data.

Vendor contracts should match the vendor's access and legal role. You should identify each processor or service provider, confirm the permitted use, require appropriate security, set breach notice duties, regulate subprocessors, and address deletion or return at termination. The related article on data processing agreements explains the provisions required by Texas and other state privacy laws.

You should test the incident response plan with the people who will use it. The plan should identify decision makers, forensic and insurance contacts, preservation duties, communication procedures, and the law governing notice. Texas imposes separate deadlines for notices to affected individuals and the Attorney General in covered breaches, as discussed in the article on Texas data breach notification.

Check Licenses and Multistate Operations

You should confirm that permits and professional licenses authorize every location, service, product, and regulated employee. You should verify the holder's legal name, renewal date, bond or insurance condition, qualifying individual, continuing education requirement, and notice duty after an ownership or address change. A permit assigned to the wrong entity may provide no authority to the company performing the work.

Operations outside Texas require more than a list of Secretary of State registrations. You should review foreign qualification, registered agents, annual reports, payroll and unemployment accounts, sales tax, employment rules, privacy laws, permits, and local business licenses in each state where the company has employees, property, or sustained operations. Each obligation uses its own legal test, so registering in one state doesn't resolve a tax or employment question in another.

Finish With Assigned Work and Dates

You should end the review with a written list that identifies the entity, document, filing, legal issue, responsible person, outside adviser, and completion date for each item. High-risk corrections should receive a deadline based on the applicable notice period, filing date, or legal exposure. You should also assign a date to lower-risk improvements so the responsible person can complete them.

Your compliance calendar should include government filings, license renewals, trademark maintenance, contract notice windows, insurance renewals, option and vesting dates, loan covenant deliveries, training, and policy reviews. The annual review tests the whole system once each year. Assigned responsibility and calendar control protect the company during the other 11 months.