Form I-9 Audit: Why You Should Conduct One and How to Build an I-9 Audit Checklist

Every legitimate U.S. business must complete a Form I-9 for each of its employees. Those that don’t do it timely or accurately could face:

• fines ranging from $288 to $28,619
• lost profits from correcting erroneous filings
• a federal audit

In certain cases, egregious I-9 problems can force an employer to suspend or even end its operations.

With so much at stake, organizations should conduct their own Form I-9 audit to help avoid facing steep — and preventable — penalties. But when I-9 compliance isn’t always straightforward, how does a company ensure its HR team considers every possible blind spot?

It’s easier than you might think. By building a Form I-9 audit checklist, HR gains a priceless resource to lean on and integrate into any compliance strategy. Let’s explore:

• why Form I-9 audits matter
• what to do before your internal audit
• how to ace I-9 compliance in seven simple steps

What is an internal Form I-9 audit?

Businesses conduct Form I-9 audits to find:

• errors
• missing information
• potential liability

While no authority mandates these reviews, they still help businesses get ahead of potential costly fines by identifying where their I-9 process — or lack thereof — fails.

Types of Form I-9 audits

Form I-9 audits can take place internally as part of a regular diagnostic process or externally, usually in the form of a government-conducted audit. The inciting action and outcomes of these audits are often quite different, so it’s important to know the difference.

Internal Form I-9 self-audits

Internal audits give an employer a snapshot of the current Form I-9 status of its workforce. These audits can be regularly occurring, or they can be initiated by leadership as the need arises.

Government-conducted Form I-9 audits

Government-conducted Form I-9 audits can happen at any time and may be triggered by:

• complaints from current or former employees
• concerns raised about the business to immigration authorities
• employers operating in industries known for Form I-9 violations

Why conducting an internal Form I-9 audit is important

Beyond how they strengthen compliance, internal I-9 audits give employers a jump on issues that HR would have to rush to fix later. Additionally, these audits help businesses spot missing I-9s and crucial employee legal information like:

• names
• addresses
• work authorizations

Because I-9s contain so much personal data, audits help employers spot errors in employee records.

How employers can prepare for an internal Form I-9 audit

Before building your Form I-9 audit checklist, companies need to consider why an internal audit is necessary. This could be because of:

• a fine the business received
• an upcoming acquisition or reorganization
• a recent wave of growth and new hires

Solid compliance demands agility, but it’s not always prioritized. Smaller companies might focus on operations that drive revenue, especially if their workforce is relatively small. Even enterprises and larger organizations may have a harder time justifying conducting a self-audit if they haven’t encountered issues in the past. (Of course, that doesn’t mean they’re immune to faulty I-9s.)

Here’s the hard truth: While important, those factors don’t outweigh compliance. For example, an overlooked or missing batch of I-9s could be enough to shut down some companies. Executives and HR alike should be prepared to escalate and champion the need for an internal audit, in hopes of avoiding a government one.

After all, in curbing regulatory problems, too much urgency doesn’t exist. Certain situations may merit an immediate internal audit, including:

• a merger
• a push to secure startup funds
• an anonymous tip about unauthorized labor
• working in an industry specifically targeted by DHS
• and more, depending on a business’s needs

Before starting a self-audit, an employer should ask:

• Is the employee roster up to date?
• Do we have I-9s for every current employee?
• Do we have I-9s for former employees since we must retain them for up to three years?
• Are we aware of the most recent version of the I-9?
• Do we have the bandwidth to conduct an immediate audit?
• How often should we conduct this audit?
• Who will take part in and oversee the audit?

Other employer to-dos before conducting an internal I-9 audit

To avoid missing data and duplicate work, it’s crucial to brainstorm with HR about everything the I-9 covers. This could include:

• basic employee info (names, addresses, dates of birth, etc.)
• forms of identification like passports and driver’s licenses
• employment authorizations like green cards and work permits
• new hire start dates
• former employees’ end dates

Remember, no piece of data is too miniscule to include. Something as seemingly minor as an incorrect digit in an employee’s house number can result in a noncompliant form.

In general, it’s not wise to announce an internal audit to your workforce. At the same time, communication will be vital in addressing outstanding issues. Consult with HR about the best way to address problematic I-9s with affected employees.

Above all, don’t assume an employee is lying about their identity. Like other tax forms, mistakes happen. Go over the questionable I-9 in detail so it’s abundantly clear where the issue lies.

7 steps for conducting an internal Form I-9 audit

Once everyone understands the need for an audit, it’s time to put it into motion. But where to start? Use these seven steps to help you conduct the most successful Form I-9 audit possible.

1. Gather employee information

Ensure every employee has completed or received a Form I-9. You should also make note of all former employees hired after Nov. 6, 1986 (when the Immigration and Nationality Act was signed). Keep in mind employers have to retain I-9s only from whichever is later:

• three years from when the I-9 was completed
• one year after an employee’s termination date

2. Collect I-9s

Ensure you collect all digital and physical I-9s. Depending on a company’s size and history, these may be stored in separate locations. Wherever they are, gather them and set up a consistent way of storing them moving forward. A single HR software with a convenient tool for storing documents makes this process exponentially easier.

3. Verify completed I-9s

Determine which employees have and have not completed I-9s. If HR has the bandwidth, it further helps to identify which employees have received a Form I-9 but haven’t returned it.

Afterward, make a code to quickly identify employees who don’t require additional action. This helps HR focus its efforts on workers who actually need assistance.

4. Audit and review I-9s

Perhaps needless to say, this step is the heart of your internal audit. HR should review each Form I-9 section by section to avoid making mistakes. For larger businesses, it could help to incorporate secondary reviewers to step in after a first glance. (Think of their role as an editor or proofreader.)

Keep the following details in mind for each of these three sections.

Section 1

Ensure accuracy and completeness of:

• names, addresses and dates of birth
• Social Security numbers (mandatory for employers using E-Verify)
• the citizen/immigration status box
• Alien Registration Numbers (A-Numbers or A#s) or USCIS numbers
• a signature dated no later than the employee’s start date
• the preparer section if they received help completing the form

Section 2

Verify employees have:

• entered their name as it appears in Section 1
• listed a Social Security, Alien Registration or USCIS number that correlates with the citizenship/immigration status box
• provided and correctly entered one document from List A (or one document from List B and another from List C)
• noted the right start date
• completed the certification section
• obtained their employer’s (or an authorized representative’s) signature, name and full address

Supplement A

Supplement A is relevant if a preparer or translator assists an employee in completing Section 1 of Form I-9. If you require this supplement, ensure that all fields are completed for each preparer or translator.

Supplement B (formerly Section 3)

Supplement B is relevant only if the employee’s:

• work authorization expired
• name legally changed
• Form I-9 was completed over three years ago (applies only to rehired workers)

5. Correct errors

Make any necessary changes after reviewing each employee’s form. HR should note these adjustments and document any recurring issues, as this could reveal a deeper, systemic issue with I-9 processing.

To correct errors in Form I-9:

• draw a line through the incorrect information.
• add the correct information to the correct field or as close to the correct field as possible.
• initial and date the correction.

Most importantly, remember an employer can’t correct the employee portion of the I-9 directly. The recommendations must be returned to the relevant individual, who must do it themselves.

6. Complete the audit

Once HR addresses all I-9 errors, reorganize and store every form in a way that’s clear and accessible. Be sure to memorialize the storage process; it’ll help HR easily retrieve the forms for future audits.

7. Document processes and regular audits

In the post-audit phase, consider what was most effective, as well as areas needing improvement. If this is an inaugural audit, set a standard operating procedure for everyone in HR to reference. This should also include the timing of the audit, which will vary based on company needs.

Finally, schedule annual training to educate employees on:

• the importance of I-9s
• how to complete them
• understanding acceptable documents and deadlines
• anything else they should know about the audit procedure

What to do if you receive an ICE Form I-9 audit notice

A Form I-9 audit is initiated when the Department of Homeland Security’s Immigration and Customs Enforcement (ICE) Homeland Security Investigations (HSI) agency serves an employer with a written Notice of Inspection (NOI). The NOI generally includes:

• the time and date the agency expects to conduct the inspection
• contact information for the ICE agent who is in charge of the inspection
• the documents to be inspected
• deadline by which the employer must respond to the NOI

How to respond to a Notice of Inspection (NOI) for an I-9 audit

After receiving an NOI, it’s important to cooperate with agents and be aware of your rights. Here are some tips for responding to an NOI:

• Confirm the time and date of the NOI with the ICE agent in charge of your inspection.
• Contact your legal counsel.
• Gather the necessary documentation prior to the confirmed audit time.
• Cooperate with ICE agents.

Timeline and employer rights during an I-9 audit

Typically, employers have three business days to produce the materials for an audit after receiving the NOI.

It is important to note that employers and their employees still have certain rights during a Form I-9 audit. Some important factors to keep in mind:

• Employers can take the three full business days following receipt of the NOI to collect documentation and consult legal counsel.
• Immigration officials are not allowed to enter private (non-public) areas of a business without consent from an employer or a warrant signed by a U.S. District Court or State Court judge.
• Employers have the right to thoroughly view the judicial warrant and ensure that ICE agents adhere to the terms of the warrant.
• Employers have the right to remain silent and not sign any documents during the audit.

Seeking legal advice and counsel regarding an I-9 audit

A Form I-9 audit can result in fines or penalties, so it is recommended that employers seek legal counsel if subject to a government audit or investigation.

How Paycom helps with Form I-9

Paycom’s single software simplifies Form I-9 audits by automating employment identification and verification. Our E-Verify® tool allows HR to quickly confirm a new hire’s eligibility and prepopulate new cases.

Need to prep for audits? No problem. You can safely and securely store completed I-9s in Paycom alongside your workforce’s other important documents. Plus, our E-Verify tool automatically prepopulates employee information when creating new cases. That’s because employees only need to enter their data once, and it automatically and seamlessly flows throughout Paycom’s tools.

Employers using Paycom will also receive notifications for expiring documents to:

• easily complete the rehire and reverification supplement
• complete and verify I-9s on time
• strengthen your I-9 self-audit with easy-to-use reporting tools

And Paycom’s easy-to-use dashboard helps employers immediately identify pending or incomplete I-9s and other action items.

What’s another way to help your workforce comply? Training! Paycom Learning, our intuitive learning management system, makes it easy to build and deliver compliance training that meets employees at their level. They can even complete learnings right from their phone!

Frequently asked questions

What triggers a Form I-9 audit?

An I-9 audit can be triggered by a number of things, but will most likely be initiated by:

• complaints from current or former employees
• red flags raised by immigration authorities
• employers operating in industries where I-9 violations are commonplace

How often should employers conduct internal audits?

Internal I-9 audit frequency is at the discretion of the employer.

Can employers conduct internal I-9 audits selectively?

Yes, and periodic internal audits of an employer’s I-9 documentation are recommended.

How long should employers retain Form I-9s to stay compliant?

An organization must retain an employee’s completed Form I-9 three years after the date of hire, or one year after the employee leaves the organization, whichever is later. These retention periods are triggered at separation. Organizations should always retain active employees’ Form I-9s.

How can Form I-9 audits help employers stay compliant?

Internal Form I-9 audits help employers identify I-9 errors, missing information or other potential liabilities.

What happens if an error is found on an I-9 form?

If the audit is internal, the employer should fix the error. If an error is found as result of an I-9 audit initiated by the government, employers can correct the error, typically within 10 business days of the violation being reported.

What documents should employees present for I-9 audit verification?

For a list of documents acceptable for Form I-9, please visit the USCIS website.

Are remote employees subject to the same I-9 requirements?

Yes. Form I-9 requirements are the same for both remote and in-person employees.

Can an employer correct an I-9 form after an audit has started?

Yes, typically within 10 business days of the error being reported.

What can employers do to prepare for an audit?

To prepare for an I-9 audit, consider the following steps:

• Develop a plan of what to do during an audit, whether it’s announced or unannounced.
• Train your personnel on how to respond during an audit.
• Ensure your entire workforce understands the importance of not interfering with or evading during an I-9 audit.

What are the key differences between a self-audit and an ICE audit for Form I-9?

Self-audits are initiated by the employer and can happen at any time or even not at all. ICE audits are initiated by the government, and the ICE agent in charge will determine the time, place and scope of the audit.