How to Conduct an Internal I-9 Audit | WorkBright

Why I-9 audits matter—Avoid compliance errors and fines

Employee I-9s are among one of organizations’ most error-prone and most important processes. One small error for an individual employee can amount to a fine in the thousands of dollars—let alone when you’re dealing with a workforce of thousands.

Running an I-9 audit is your failsafe to not only avoid compliance penalties, but so you can build a more efficient I-9 process that avoids these errors in the first place.

In this article, we’ll tackle the topic of what an I-9 audit is, and how to conduct an internal I-9 audit.

Understanding the I-9 form

The Form I-9 is an essential legal component of new hire compliance. For organizations, it’s a standardized process of verifying their employees’ identity and legal right to work in the United States that ensures their employment practices stay compliant with immigration laws. But it’s also designed to protect employees from discrimination and exploitation, too.

US employers are required to complete and file the I-9 form for every new employee within three business days of their start date. The form contains two main parts:

• Section 1: Employees fill out their personal information, including their full legal name, address, and date of birth, and attest to their citizenship or immigration status alongside supporting documents.
• Section 2: The employer or authorized representative completes Section 2 following an inspection and verification of supporting documentation and certification.

The I-9 form also contains two supplementary sections. Supplement A is completed by translators or assistants helping employees fill out their forms, while Supplement B is used in the case of re-verification or rehire.

Self-audit versus external audit: What you need to know

There are two key types of audits associated with I-9 compliance: The self-audit and the external audit.

The external audit, run by the US Immigration and Customs Enforcement (ICE), is a formal legal process that requires organizations to present employees’ I-9 forms and supporting documentation. Organizations typically receive a Notice of Inspection three business days before their audit takes place. The process involves a thorough review to verify that all employees are legally authorized to work in the US and that their documentation is valid. If there are any discrepancies, employers may be subject to penalties.

By contrast, a self-audit is an optional internal process led by key stakeholders within the organization, such as HR, compliance teams, and other authorized representatives. It’s designed to help organizations spot and correct errors in their documentation.

Preparing for an internal I-9 audit

Internal and external I-9 audits are two key pillars in ensuring that your hiring practices stay within the boundaries of the law. And while one may be more “official” than the other, organizations should hold themselves to the same standards for their internal audit as their external one.

While the timescales for external audits may vary, we recommend running an internal audit every year at a minimum—but this may vary depending on your team, the organization’s size, and current standing with ICE.

When preparing for an audit, following the steps below will help teams create an efficient process while maintaining maximum compliance:

• Gather essential documentation: Collate I-9 forms and supporting documentation for both current employees (hired after and former ones, as long as these fall within the guidelines for the required retention period (this is three years after the date of hire or one year after the date employment ends, depending on which is later).
• Purge outdated information: Check your files for any employee information that falls outside of the retention requirements, and ensure this is deleted to avoid any potential penalties.
• Create your process checklist: Build a checklist that runs through your entire end-to-end audit process—see the link to our audit checklist at the end of this article to help you. Make sure you update your checklist in line with process changes, particularly when running your internal I-9 audits.

How to conduct an internal I-9 audit

Running a regular internal I-9 audit and documentation spot checks will help you make sure you’re always on top of essential compliance. But it’s also a great way of identifying inefficiencies in your compliance processes and making sure your team stays familiar with the end-to-end process.

There are three key steps to conducting an effective I-9 internal audit. We’ll run through the process below.

1. Review I-9 forms and supporting documentation for errors

The first step of every I-9 audit involves an error hunt: You’ll need to review each of your I-9 forms and their supporting documentation to check that they’re complete and error-free. You’ll need to cross-reference these forms with employee documentation to make sure the details match up.

• Completeness: Make sure all relevant fields of Sections 1 and 2 of the I-9 form are completed, signed, and dated. You’ll also need to make sure that all documentation used to prove identity and eligibility to work is attached to each file.
• Employee information: Cross-reference information from employees’ Form I-9s to their documentation, including details like the spelling of their name, current address, and digits in their Social Security number.
• Paperwork: Make sure the documentation matches the criteria set out in lists A, B, or C. You’ll also need to check that the version of the I-9 form used is accurate as of the employee’s hire date. If you’ve used the wrong version of the form for a recent new hire, for example, now’s the time to flag and resolve the error.

2. Address issues and correct I-9 errors

We’re all human, and errors happen even in the most watertight processes—no matter whether you’re hiring just a few employees, or mass hiring thousands each month. But what matters most is what you do once you’ve identified those errors.

Generally speaking, I-9 errors fall into two key categories:

• Substantive errors: High-penalty errors ranging from a failure to present an I-9 entirely to absent signatures, missing or incorrect documentation, and failure to file on time.
• Technical errors: Lower-penalty and correctable errors, including missing address or date of birth details, failure to date either section of the I-9, and missing employment start date.

Employees should correct technical errors in Section 1 of the form, while employers should do the same for Section 2. In either case, when implementing I-9 audit corrections, the correct protocol is to draw a line through the error, enter the correct information, and initial and date the changes. Add any details as to why the information was missing in the additional notes field.

For more details on this step, see our resource at the end of this article.

3. Log your audit and corrections

Recordkeeping is one of the most important parts of the I-9 process. From an internal perspective, keeping records on when an internal audit took place and its results help identify any issues with your processes that can prevent errors in the future.

But from an external perspective, they show a record of your due diligence and your actions taken to resolve any errors — which could stand in your favor in the event of a potential penalty.

At a basic level, your audit should record the dates the audit took place, auditors’ names, and full details of any errors you identified in your I-9 forms, including how you resolved the errors, and what follow-up measures will be taken.

What to do if you receive an I-9 Notice of Inspection (NOI)

Getting an NOI from DHS/ICE can feel urgent, but it doesn’t have to turn into a fire drill. Here’s a simple response flow your team can follow.

1. Acknowledge and calendar the deadline immediately

Most employers have three business days to produce I-9s. Add the date to your HR/compliance calendar and notify anyone who touches onboarding.

2. Loop in counsel or your internal compliance lead

Share the notice, your onboarding/I-9 policy, and any previous audit logs. Centralizing communication helps avoid mixed messages to auditors.

3. Pull your I-9 inventory

Export or collect all active employee I-9s, plus forms that are still within the retention window for terminated employees. Keep a list of anyone who should have an I-9 but doesn’t.

4. Fix what you can — fast

Some errors can be corrected within the allowed window. Have the right person (employee for Section 1, employer/authorized rep for Section 2) make the correction, sign, and date it. Keep a short “corrections log” that shows what was fixed and when.

5. Keep documents organized the way auditors expect to see them

Deliver files in a clean, labeled format (current employees separate from former employees). Good organization reduces back-and-forth.

6. Designate a point of contact

Pick one HR or compliance owner to communicate with the auditor. That keeps your message consistent and prevents well-meaning managers from sending incomplete information.

7. Debrief afterward

Use the NOI as a trigger to tighten your I-9 process, training for authorized reps, and your internal audit cadence.

Remote I-9s and the DHS alternative procedure (for E-Verify employers)

Remote and distributed teams can still stay compliant — they just need clear rules.

If you participate in E-Verify and meet DHS criteria:

• You may use the DHS-authorized alternative procedure instead of in-person document inspection.
• Alternatively, you can use a reputable I-9 software and conduct a review using an authorized representative.
• You must conduct a live video interaction with the employee and review the same documents they sent.
• You must retain copies of the documents.
• You must note on the Form I-9 that you used the alternative procedure and include the date.

If you do not meet the criteria:

• You must have the employee’s documents examined in person — either by you or by a designated authorized representative (remote or in-person).
• The employer is still responsible for errors made by an authorized representative, so provide written instructions.

Add this to your policy: “Remote hires must follow the same timeline as onsite hires — Section 1 by Day 1, Section 2 by Day 3.” That keeps everyone on the same page.

Best practices for optimizing I-9 compliance

Building an efficient, compliant audit relies on policy, processes, and employee enablement. Here are six best practice tips for a streamlined process:

• Review changes to the law: The onus is on companies to stay in step with the law, so make it a practice to regularly review requirements relating to hiring or I-9 processes—this includes ensuring you’re using the most current version of the I-9 form.
• Build consistent record-keeping processes: Three business days isn’t a lot of time to collate all of your data for an external audit. Creating consistent record-keeping processes, including where and how files are stored and labeled, will help your team avoid a last-minute scramble.
• Implement regular training: Your team is best equipped to run an efficient, and compliant, audit process when they receive the right training. Running regular training that covers the fundamentals — such as how to complete the Form I-9 — as well as refreshing auditing processes and recordkeeping best practices, will ensure everyone’s skills stay in line with the law.
• Set up a self-audit: To stay audit-ready, we recommend organizations run an internal audit once a year at a minimum. But keep compliance top-of-mind by implementing additional check-ins or spot checks to help teams stay familiar with the process and scan for errors.
• Build policies to govern your audit: The most effective audits are standardized and consistent. Building a set of policies that address who owns the audit process, how often internal audits are run, and how often you’ll review and update your process.
• Opt for transparency: In a process that could impact your employees’ access to their paychecks, transparency is critical. Communicate with your employees as you start any audits, including whether they’re internal or external. If you identify any errors, make sure you inform the relevant employees privately and provide clear instructions on what to do next.

Stay audit-ready with WorkBright

Running an internal I-9 audit isn’t a legal requirement for organizations—but as fines for non-compliance continue to increase, it’s a critical failsafe that keeps teams prepared, reduces the risk of fines, and keeps compliance as an always-on process.

WorkBright’s free I-9 audit checklist can help teams build a scalable, standardized process that helps them run internal audits consistently and efficiently. Download our I-9 guide and checklists here.

Plus, WorkBright’s I-9 software automates E-Verify submissions and alerts, helping HR teams maintain compliance from onboarding through every audit cycle—so you’re never caught off guard.

Frequently asked questions

How long do employers need to keep I-9 records?

Employers must keep I-9 records for three years after the date of hire or one year after the date of termination, whichever is later. This means if an employee worked for less than two years, you must keep their form for three years from the hire date. If they worked longer, you must keep it for one year after they stopped working.

What triggers I-9 audits?

I-9 audits are triggered mainly by three things: complaints, data analysis, and government information. Learn more about additional I-9 audit triggers in our blog.

Who performs an I-9 audit?

An I-9 audit is performed by federal immigration officials, primarily by U.S. Immigration and Customs Enforcement (ICE), a branch of the Department of Homeland Security (DHS). Homeland Security Investigations (HSI), which is a division within ICE, may also conduct these audits.

How often should employers run internal I-9 audits?

At least once a year is a good baseline. Run them more often if you’re growing quickly, hiring remotely, or have had findings from DHS/ICE in the past. You can also trigger an audit after acquisitions, big HR system changes, or when onboarding is decentralized.

What’s the difference between a technical and a substantive error?

Technical errors are small/clerical and can usually be corrected (like a missing date or incomplete employer address). Substantive errors are bigger — like no employer signature in Section 2 or no document recorded — and can still lead to fines even after you fix them. Document both.

Are employers responsible if an authorized representative makes a mistake?

Yes, employers are legally responsible and fully liable for any mistakes or violations made by an authorized representative in completing or verifying Form I-9. This means if an authorized representative makes errors, such as accepting invalid documents or missing deadlines, the employer bears the consequences, including potential civil fines for non-compliance. That’s why written instructions, a sample completed I-9, and spot checks are so important.

What version of Form I-9 should employers be using?

Use the current edition published by USCIS. Older versions are only valid through the grace period announced by DHS — after that, using an outdated form can be cited in an audit.