What Is an I-9 Audit?

An I-9 audit is a systematic review of an employer's Form I-9 records to verify compliance with 8 U.S.C. section 1324a, the federal law requiring verification of identity and employment authorization for every person hired after November 6, 1986. The audit examines whether each I-9 was completed properly, retained correctly, and supported by acceptable documentation, with the goal of identifying and correcting errors before U.S. Immigration and Customs Enforcement (ICE) initiates its own inspection. For compliance consulting firms and in-house counsel at mid-sized employers, the I-9 audit is both a defensive measure and a billable engagement with specific procedural requirements under the Department of Homeland Security's regulations at 8 CFR 274a.

How the Audit Works in Practice

The Two Paths: Internal Self-Audit vs. External Engagement

An I-9 audit can be conducted internally by HR and legal staff, or performed by an external compliance consultant or law firm. The external path is common when a company lacks dedicated immigration counsel, has undergone a merger or acquisition, or faces a specific trigger such as a contractor's complaint, an E-Verify mismatch, or a notice of inspection from ICE.

The external auditor typically begins with a document request: all current I-9s, a sample or complete set of terminated employee I-9s (retained for three years after hire or one year after termination, whichever is longer), and the employer's written policies on remote verification, reverification, and E-Verify use. The auditor then reviews each form against the current version of Form I-9 (as of 2024, the edition dated 08/01/23) and the Lists of Acceptable Documents.

Classification of Violations

Violations fall into two categories under ICE guidance. Technical or procedural violations include missing dates, incomplete fields, or failure to update an employee's reauthorization status promptly. Substantive violations are more severe: missing I-9s entirely, accepting fraudulent documents without good faith examination, or completing the form after the third business day after hire. The auditor codes each finding, calculates a violation rate, and recommends corrective steps.

The Correction Protocol

For technical violations, the employer may correct errors by drawing a line through the mistake, entering the correct information, and initialing and dating the change. For substantive violations, the options are narrower. A missing I-9 for a current employee must be completed immediately, with the current date noted and an explanation attached. For a terminated employee with a missing I-9, no correction is possible; the violation remains and factors into any penalty calculation.

Why It Matters to the Compliance Firm Owner

Penalty Exposure Has Increased

ICE penalties for I-9 violations are adjusted annually for inflation. As of 2024, the civil penalty for a first-offense substantive paperwork violation ranges from $272 to $2,701 per violation. A pattern or practice of knowingly hiring unauthorized workers carries penalties starting at $6,946 per unauthorized worker. For an employer with 200 employees and a 30% substantive violation rate, the exposure is not theoretical. The compliance firm that can document a pre-inspection audit and correction often reduces or eliminates these penalties.

The Audit Creates a Billable Relationship

For regulatory compliance consulting firms, the I-9 audit is a natural entry point. It requires on-site or remote document review, interviews with HR staff, and a written report. It often leads to ongoing work: training programs, policy drafting, E-Verify enrollment, or mock ICE inspections. The engagement also positions the firm for M&A due diligence, where I-9 compliance is a standard reps-and-warranties item.

The Firm's Own Exposure

Compliance consulting firms that place staff at client sites or hire subcontractors themselves must maintain their own I-9 programs. A firm advising others on I-9 compliance while holding deficient records is a liability. The principal should treat the firm's own audit as a non-negotiable annual exercise.

Where Practitioners Get It Wrong

Treating E-Verify as a Substitute

Some firms believe E-Verify enrollment eliminates the need for careful I-9 maintenance. E-Verify confirms employment authorization against federal databases but does not replace the I-9. A company can pass E-Verify while holding I-9s with substantive violations. ICE inspects the I-9, not the E-Verify query log.

The "Backdating" Error

The most common specific mistake in correction is backdating. An auditor discovers a missing Section 2 completion date, and HR fills it in with the actual hire date. This is a new violation. The correction must use the current date, with an explanation that the form was completed late upon discovery. Backdating converts a correctable technical error into a false statement, which ICE treats as evidence of bad faith.

Retention Confusion

Employers frequently discard I-9s for terminated employees too early, or retain them too long without a purge policy. The retention rule is precise: three years from the date of hire, or one year from the date of termination, whichever is later. A firm that keeps I-9s indefinitely increases its violation exposure in any inspection. A firm that discards them early destroys evidence that might have supported a good-faith defense.

Related Terms

Practitioners in the regulatory compliance vertical should also understand E-Verify, the federal electronic employment verification system that supplements but does not replace the I-9; ICE Notice of Inspection, the administrative subpoena that triggers a formal I-9 inspection with specific response deadlines; 8 CFR 274a.2, the regulation specifying Form I-9 completion and retention requirements; Good Faith Defense, the employer's argument that technical violations should not result in penalties if the I-9 substantially complies; and Reverification, the process of updating Section 3 when an employee's work authorization expires.

If your firm advises employers on immigration compliance or conducts I-9 audits as a service line, see how ROI Wire builds qualified engagement for regulatory compliance consulting firms. For more terms in this division, return to the regulatory and compliance glossary hub.