Mastering compliance: A step-by-step guide on how to conduct an I-9 audit

Why I-9 audits matter—Avoid compliance errors and fines

Employee I-9s are among one of organizations’ most error-prone and most important processes. One small error for an individual employee can amount to a fine in the thousands of dollars—let alone when you’re dealing with a workforce of thousands.

Running an I-9 audit is your failsafe to not only avoid compliance penalties, but so you can build a more efficient I-9 process that avoids these errors in the first place.

In this article, we’ll tackle the topic of what an I-9 audit is, and how to conduct an internal I-9 audit.

Understanding the I-9 form

The Form I-9 is an essential legal component of new hire compliance. For organizations, it’s a standardized process of verifying their employees’ identity and legal right to work in the United States that ensures their employment practices stay compliant with immigration laws. But it’s also designed to protect employees from discrimination and exploitation, too.

US employers are required to complete and file the I-9 form for every new employee within three business days of their start date. The form contains two main parts:

• Section 1: Employees fill out their personal information, including their full legal name, address, and date of birth, and attest to their citizenship or immigration status alongside supporting documents.
• Section 2: The employer or authorized representative completes Section 2 following an inspection and verification of supporting documentation and certification.

The I-9 form also contains two supplementary sections. Supplement A is completed by translators or assistants helping employees fill out their forms, while Supplement B is used in the case of re-verification or rehire.

Self-audit versus external audit: What you need to know

There are two key types of audits associated with I-9 compliance: The self-audit and the external audit.

The external audit, run by the US Immigration and Customs Enforcement (ICE), is a formal legal process that requires organizations to present employees’ I-9 forms and supporting documentation. Organizations typically receive a Notice of Inspection three business days before their audit takes place. The process involves a thorough review to verify that all employees are legally authorized to work in the US and that their documentation is valid. If there are any discrepancies, employers may be subject to penalties.

By contrast, a self-audit is an optional internal process led by key stakeholders within the organization, such as HR, compliance teams, and other authorized representatives. It’s designed to help organizations spot and correct errors in their documentation.

Preparing for an internal I-9 audit

Internal and external I-9 audits are two key pillars in ensuring that your hiring practices stay within the boundaries of the law. And while one may be more “official” than the other, organizations should hold themselves to the same standards for their internal audit as their external one.

While the timescales for external audits may vary, we recommend running an internal audit every year at a minimum—but this may vary depending on your team, the organization’s size, and current standing with ICE.

When preparing for an audit, following the steps below will help teams create an efficient process while maintaining maximum compliance:

• Gather essential documentation: Collate I-9 forms and supporting documentation for both current employees (hired after and former ones, as long as these fall within the guidelines for the required retention period (this is three years after the date of hire or one year after the date employment ends, depending on which is later).
• Purge outdated information: Check your files for any employee information that falls outside of the retention requirements, and ensure this is deleted to avoid any potential penalties.
• Create your process checklist: Build a checklist that runs through your entire end-to-end audit process—see the link to our audit checklist at the end of this article to help you. Make sure you update your checklist in line with process changes, particularly when running your internal I-9 audits.

How to conduct an internal I-9 audit

Running a regular internal I-9 audit and documentation spot checks will help you make sure you’re always on top of essential compliance. But it’s also a great way of identifying inefficiencies in your compliance processes and making sure your team stays familiar with the end-to-end process.

There are three key steps to conducting an effective I-9 internal audit. We’ll run through the process below.

1. Review I-9 forms and supporting documentation for errors

The first step of every I-9 audit involves an error hunt: You’ll need to review each of your I-9 forms and their supporting documentation to check that they’re complete and error-free. You’ll need to cross-reference these forms with employee documentation to make sure the details match up.

• Completeness: Make sure all relevant fields of Sections 1 and 2 of the I-9 form are completed, signed, and dated. You’ll also need to make sure that all documentation used to prove identity and eligibility to work is attached to each file.
• Employee information: Cross-reference information from employees’ Form I-9s to their documentation, including details like the spelling of their name, current address, and digits in their Social Security number.
• Paperwork: Make sure the documentation matches the criteria set out in lists A, B, or C. You’ll also need to check that the version of the I-9 form used is accurate as of the employee’s hire date. If you’ve used the wrong version of the form for a recent new hire, for example, now’s the time to flag and resolve the error.

2. Address issues and correct I-9 errors

We’re all human, and errors happen even in the most watertight processes—no matter whether you’re hiring just a few employees, or mass hiring thousands each month. But what matters most is what you do once you’ve identified those errors.

Generally speaking, I-9 errors fall into two key categories:

• Substantive errors: High-penalty errors ranging from a failure to present an I-9 entirely to absent signatures, missing or incorrect documentation, and failure to file on time.
• Technical errors: Lower-penalty and correctable errors, including missing address or date of birth details, failure to date either section of the I-9, and missing employment start date.

Employees should correct technical errors in Section 1 of the form, while employers should do the same for Section 2. In either case, when implementing I-9 audit corrections, the correct protocol is to draw a line through the error, enter the correct information, and initial and date the changes. Add any details as to why the information was missing in the additional notes field.

For more details on this step, see our resource at the end of this article.

3. Log your audit and corrections

Recordkeeping is one of the most important parts of the I-9 process. From an internal perspective, keeping records on when an internal audit took place and its results help identify any issues with your processes that can prevent errors in the future.

But from an external perspective, they show a record of your due diligence and your actions taken to resolve any errors — which could stand in your favor in the event of a potential penalty.

At a basic level, your audit should record the dates the audit took place, auditors’ names, and full details of any errors you identified in your I-9 forms, including how you resolved the errors, and what follow-up measures will be taken.

Best practices for optimizing I-9 compliance

Building an efficient, compliant audit relies on policy, processes, and employee enablement. Here are six best practice tips for a streamlined process:

• Review changes to the law: The onus is on companies to stay in step with the law, so make it a practice to regularly review requirements relating to hiring or I-9 processes—this includes ensuring you’re using the most current version of the I-9 form.
• Build consistent record-keeping processes: Three business days isn’t a lot of time to collate all of your data for an external audit. Creating consistent record-keeping processes, including where and how files are stored and labeled, will help your team avoid a last-minute scramble.
• Implement regular training: Your team is best equipped to run an efficient, and compliant, audit process when they receive the right training. Running regular training that covers the fundamentals — such as how to complete the Form I-9 — as well as refreshing auditing processes and recordkeeping best practices, will ensure everyone’s skills stay in line with the law.
• Set up a self-audit: To stay audit-ready, we recommend organizations run an internal audit once a year at a minimum. But keep compliance top-of-mind by implementing additional check-ins or spot checks to help teams stay familiar with the process and scan for errors.
• Build policies to govern your audit: The most effective audits are standardized and consistent. Building a set of policies that address who owns the audit process, how often internal audits are run, and how often you’ll review and update your process.
• Opt for transparency: In a process that could impact your employees’ access to their paychecks, transparency is critical. Communicate with your employees as you start any audits, including whether they’re internal or external. If you identify any errors, make sure you inform the relevant employees privately and provide clear instructions on what to do next.

Stay audit-ready with WorkBright

Running an internal I-9 audit isn’t a legal requirement for organizations—but as fines for non-compliance continue to increase, it’s a critical failsafe that keeps teams prepared, reduces the risk of fines, and keeps compliance as an always-on process.

WorkBright’s free I-9 audit checklist can help teams build a scalable, standardized process that helps them run internal audits consistently and efficiently. Download our I-9 checklist here.