Form I-9 Audit: Why You Should Conduct One and How to Build an I-9 Audit Checklist

Every legitimate U.S. business must complete a Form I-9 for each of its employees. Those that don’t do it timely or accurately could face:

• fines ranging from $288 to $2,861 per form
• lost profits from correcting erroneous filings
• a federal audit

In certain cases, egregious I-9 problems can force an employer to suspend or even end its operations.

Plus, recent updates to the Department of Homeland Security’s (DHS) Immigration and Customs Enforcement’s (ICE) I-9 inspection guidance have made potential risks even harder to ignore. Several I-9 issues that may have once been viewed as routine paperwork problems could produce substantive violations and leave your organization vulnerable during an inspection. That’s why it’s vital for employers to review and bolster their I-9 processes before a Notice of Inspection (NOI) arrives.

With so much at stake, organizations should conduct their own I-9 audit to help avoid facing steep — and preventable — penalties. But when I-9 compliance isn’t always straightforward, how does a company ensure its HR team considers every possible blind spot?

It’s easier than you might think. By building an I-9 audit checklist, HR gains a priceless resource to lean on and integrate into any compliance strategy. Let’s explore:

• why I-9 audits matter
• what to do before your internal audit
• how to ace I-9 compliance in seven simple steps

What is an internal Form I-9 audit?

Businesses conduct I-9 audits to find:

• errors
• missing information
• potential liability

While no authority mandates these reviews, they still help businesses get ahead of potential costly fines by identifying where their I-9 process — or lack thereof — fails.

Types of Form I-9 audits

Form I-9 audits can take place internally as part of a regular diagnostic process or externally, usually in the form of a government-conducted audit. The inciting action and outcomes of these audits are often quite different, so it’s important to know the difference.

Internal Form I-9 self-audits

Internal audits give an employer a snapshot of the current Form I-9 status of its workforce. These audits can be regularly occurring, or they can be initiated by leadership as the need arises.

Government-conducted Form I-9 audits

Government-conducted Form I-9 audits can happen at any time and may be triggered by:

• complaints from current or former employees
• concerns raised about the business to immigration authorities
• employers operating in industries known for I-9 violations

Why conducting an internal Form I-9 audit is important

Beyond how they strengthen compliance, internal I-9 audits give employers a jump on issues that HR would have to rush to fix later. Additionally, these audits help businesses spot missing I-9s and crucial employee legal information, like:

• names
• addresses
• work authorizations

The stakes are especially high under ICE’s updated inspection framework. Organizations could face even greater noncompliance exposure from missing or incomplete details related to:

• an employee’s date of birth
• Section 1 signature date
• employer representative name and title
• first day of employment
• List A/B/C document information
• preparer or translator information
• the remote verification alternative procedure box

In other words, a self-audit should not be treated as a cleanup exercise alone; it should help HR identify blind spots in an I-9 strategy before its business faces penalties.

How employers can prepare for an internal Form I-9 audit

Before building your I-9 audit checklist, companies need to consider why an internal audit is necessary. This could be because of:

• a fine the business received
• an upcoming acquisition or reorganization
• a recent wave of growth and new hires

Solid compliance demands agility, but it’s not always prioritized. A smaller company might focus on operations that drive revenue, especially if its workforce is relatively small. Even enterprise and larger organizations may have a harder time justifying conducting a self-audit if they haven’t encountered issues in the past. (Of course, that doesn’t mean they’re immune to faulty I-9s.)

Here’s the hard truth: While important, those factors don’t outweigh compliance. For example, an overlooked or missing batch of I-9s could be enough to shut some companies down. Executives and HR alike should be prepared to escalate and champion the need for an internal audit, in hopes of avoiding a government one.

After all, in curbing regulatory problems, too much urgency doesn’t exist. Certain situations may merit an immediate internal audit, including:

• a merger
• a push to secure startup funds
• an anonymous tip about unauthorized labor
• working in an industry specifically targeted by DHS
• and more, depending on a business’s needs

Before starting a self-audit, an employer should ask:

• Is the employee roster up to date?
• Do we have I-9s for every current employee?
• Do we have I-9s for former employees since we must retain them for up to three years?
• Are we aware of the most recent version of the I-9?
• Do we have the bandwidth to conduct an immediate audit?
• How often should we conduct this audit?
• Who will take part in and oversee the audit?

Other employer to-do’s before conducting an internal I-9 audit

To avoid missing data and duplicate work, it’s crucial to brainstorm with HR about everything the I-9 covers. This could include:

• basic employee info (names, addresses, dates of birth, etc.)
• forms of identification like passports and driver’s licenses
• employment authorizations like green cards and work permits
• new-hire start dates
• former employees’ end dates

Remember, no piece of data is too minuscule to include. Something as seemingly minor as an incorrect digit in an employee’s house number can result in a noncompliant form.

In general, it’s not wise to announce an internal audit to your workforce. At the same time, communication will be vital in addressing outstanding issues. Consult with HR about the best way to address problematic I-9s with affected employees.

Above all, don’t assume an employee is lying about their identity. Like other tax forms, mistakes happen. Go over the questionable I-9 in detail so it’s abundantly clear where the issue lies.

7 steps for conducting an internal Form I-9 audit

Once everyone understands the need for an audit, it’s time to put it into motion. But where to start? Use these seven steps to help you conduct the most successful I-9 audit possible.

1. Gather employee information

Ensure every employee has completed or received a Form I-9. You should also make note of all former employees hired after Nov. 6, 1986 (when the Immigration Reform and Control Act was signed). Keep in mind employers have to retain I-9s of terminated employees only from whichever is later:

• three years from when the I-9 was completed
• one year after an employee’s termination date

2.Collect I-9s

Ensure you collect all digital and physical I-9s. Depending on a company’s size and history, these may be stored in separate locations. Wherever they are, gather them and establish a consistent way of storing them moving forward. A single HR software with a convenient tool for storing documents makes this process exponentially easier.

3. Verify completed I-9s

Determine which employees have and have not completed I-9s. If HR has the bandwidth, it further helps to identify which employees have received a Form I-9 but haven’t returned it.

Afterward, make a code to quickly identify employees who don’t require additional action. This helps HR focus its efforts on workers who actually need assistance.

4. Audit and review I-9s

Perhaps needless to say, this step is the heart of your internal audit. HR should review each Form I-9 section by section to avoid making mistakes. For larger businesses, it could help to incorporate secondary reviewers to step in after a first glance. (Think of their role as an editor or proofreader.)

As you review each form, pay close attention to the fields ICE now identifies as substantive if missing or incomplete, which include:

• employee date of birth
• employee signature date
• complete document details in Section 2
• employer representative name and title
• first day of employment
• applicable preparer/translator information
• and remote verification indicators when an alternative procedure is used

Keep the following details in mind for each of these three sections.

Section 1

Ensure accuracy and completeness of:

• names, addresses and dates of birth
• Social Security numbers (mandatory for employers using E-Verify)
• the citizen/immigration status box
• Alien Registration Numbers (A-Numbers or A#s) or USCIS numbers
• a signature dated no later than the employee’s start date
• the preparer section if they received help completing the form

Section 2

Verify employees have:

• entered their name as it appears in Section 1
• listed a Social Security, A-Number or USCIS number that correlates with the citizenship/immigration status box
• completed List A, B or C data, including document titles, the issuing authority, document number(s) and expiration date(s), if applicable
• noted the right start date
• completed the certification section
• obtained their employer’s (or an authorized representative’s) dated signature, printed name, title and full address
• the alternative procedure box checked when remote document examination is used, if applicable

Supplement A

Supplement A is relevant if a preparer or translator assists an employee in completing Section 1 of Form I-9. If you require this supplement, ensure all fields are completed for each preparer or translator, which includes their:

• complete name
• address
• date signatures

Supplement B (formerly Section 3)

Supplement B is relevant only if the employee’s:

• work authorization expired
• name legally changed
• rehire date was within three years of when their last I-9 was completed

5. Correct errors

If HR identifies errors during an internal audit, address them promptly and document how the corrections were made. Because ICE’s updated guidance treats many common omissions as substantive violations, employers shouldn’t see a government inspection as an opportunity to fix I-9 issues. Consult a licensed legal professional for questions about how to correct specific forms or how to handle identified issues after a Notice of Inspection.

To correct errors in Form I-9:

• Draw a line through the incorrect information.
• Add the correct information to the correct field or as close to the correct field as possible.
• Initial and date the correction.

Most importantly, remember that an employer can’t correct the employee portion of the I-9 directly. The recommendations must be returned to the relevant individual, who must do it themself.

6. Complete the audit

Once HR addresses all I-9 errors, reorganize and store every form in a way that’s clear and accessible. Be sure to memorialize the storage process; it’ll help HR easily retrieve the forms for future audits.

7. Document processes and regular audits

In the postaudit phase, consider what was most effective, as well as areas needing improvement. If this is an inaugural audit, set a standard operating procedure for everyone in HR to reference. This should also include the timing of the audit, which will vary based on company needs.

Finally, schedule annual training to educate employees on:

• the importance of I-9s
• how to complete them
• understanding acceptable documents and deadlines
• anything else they should know about the audit procedure

What to do if you receive an ICE Form I-9 audit notice

A Form I-9 audit is initiated when the Department of Homeland Security’s ICE Homeland Security Investigations (HSI) agency serves an employer with a written NOI. The NOI generally includes:

• the time and date the agency expects to conduct the inspection
• contact information for the ICE agent who is in charge of the inspection
• the documents to be inspected
• deadline by which the employer must respond to the NOI

How to respond to an NOI for an I-9 audit

After receiving an NOI, it’s important to cooperate with agents, be aware of your rights and understand that the classification of any identified error matters. Technical or procedural mistakes may still come with an opportunity to correct them, but substantive violations can result in penalties. Employers should involve legal counsel early and avoid assuming that every issue can be corrected after an inspection begins.

Here are some tips for responding to an NOI:

• Confirm the time and date of the NOI with the ICE agent in charge of your inspection.
• Contact your legal counsel.
• Gather the necessary documentation prior to the confirmed audit time.
• Cooperate with ICE agents.

Timeline and employer rights during an I-9 audit

Typically, employers have three business days to produce the materials for an audit after receiving the NOI.

It is important to note that employers and their employees still have certain rights during a Form I-9 audit. Some important factors to keep in mind:

• Employers can take the three full business days following receipt of the NOI to collect documentation and consult legal counsel.
• Immigration officials are not allowed to enter private (nonpublic) areas of a business without consent from an employer or a warrant signed by a U.S. District Court or State Court judge.
• Employers have the right to thoroughly view the judicial warrant and ensure that ICE agents adhere to the terms of the warrant.
• Employers have the right to remain silent and not sign any documents during the audit.

Seeking legal advice and counsel regarding an I-9 audit

An I-9 audit can result in fines or penalties, so it is recommended that employers seek legal counsel if subject to a government audit or investigation.

How Paycom helps with Form I-9

With more I-9 details carrying potential fine exposure, prevention matters.

Paycom’s single software simplifies I-9 audits by automating employment identification and verification in a single database, helping eliminate duplicate entry, centralize records, create a clear audit trail, simplify reporting and remind HR about needed verification. And our E-Verify^® tool allows HR to quickly confirm a new hire’s eligibility and prepopulate new cases.

Need to prep for audits? No problem. You can safely and securely store completed I-9s in Paycom alongside your workforce’s other important documents. Plus, our E-Verify tool automatically prepopulates employee information when creating new cases. That’s because employees only need to enter their data once, and it automatically and seamlessly flows throughout Paycom’s tools.

Employers using Paycom will also receive notifications for expiring documents to:

• easily complete the rehire and reverification supplement
• complete and verify I-9s on time
• strengthen your I-9 self-audit with easy-to-use reporting tools

And Paycom’s easy-to-use dashboard helps employers immediately identify pending or incomplete I-9s and other action items.

What’s another way to help your workforce comply? Training! Paycom Learning, our intuitive learning management system, makes it easy to build and deliver compliance training that meets employees at their level. They can even complete learnings right from their phone!

Frequently asked questions

What triggers a Form I-9 audit?

An I-9 audit can be triggered by a number of things, but will most likely be initiated by:

• complaints from current or former employees
• red flags raised by immigration authorities
• employers operating in industries where I-9 violations are commonplace

How often should employers conduct internal audits?

Internal I-9 audit frequency is at the employer’s discretion.

Can employers conduct internal I-9 audits selectively?

Yes, and periodic internal audits of an employer’s I-9 documentation are recommended.

How long should employers retain Form I-9s to stay compliant?

An organization must retain an employee’s completed Form I-9 three years after the date of hire, or one year after the employee leaves the organization, whichever is later. These retention periods are triggered at separation. Organizations should always retain active employees’ Form I-9s.

How can Form I-9 audits help employers stay compliant?

Internal Form I-9 audits help employers identify I-9 errors, missing information or other potential liabilities.

What happens if an error is found on an I-9 form?

If the audit is internal, the employer should fix the error. If an error is found as a result of an I-9 audit initiated by the government, employers may have an opportunity to correct it. But remember, substantive issues could come with an immediate fine and shouldn’t be considered rectifiable.

What documents should employees present for I-9 audit verification?

For a list of documents acceptable for Form I-9, please visit the USCIS website.

Are remote employees subject to the same I-9 requirements?

Yes. Form I-9 requirements are the same for both remote and in-person employees.

Can an employer correct an I-9 form after an audit has started?

It depends on how ICE classifies the issue. Some mistakes may be correctable, but others may be considered a substantive violation that brings immediate monetary penalties.

What can employers do to prepare for an audit?

To prepare for an I-9 audit, consider the following steps:

• Develop a plan of what to do during an audit, whether it’s announced or unannounced.
• Train your personnel on how to respond during an audit.
• Ensure your entire workforce understands the importance of not interfering with or evading during an I-9 audit.

What are the key differences between a self-audit and an ICE audit for Form I-9?

Self-audits are initiated by the employer and can happen at any time or even not at all. ICE audits are initiated by the government, and the ICE agent in charge will determine the time, place and scope of the audit.