Separate required duties from recommended controls
Use this checklist to separate I-9 duties identified as required in the cited compliance guidance from optional controls intended to reduce risk.
- Required: Proper completion, document review, corrections, reverification when applicable, retention and reliable production of Form I-9 records.[1][2][3][4][5]
- Recommended: A voluntary internal control that may make compliance and record production easier.
Paycom describes an internal I-9 audit as an optional, employer-initiated review for identifying errors, missing information and potential liability.[1] The sources do not verify a federal audit-frequency mandate. Paycom says frequency is discretionary; Harris Sliwoski and OutSolve recommend annual reviews.[1][3][5]
Separate storage from general personnel files is also recommended rather than identified as legally required. The cited guidance says records should be secure, organized, legible and readily producible wherever they are stored.[3][4][5]
Put verified deadlines on one audit calendar
| Item | Timing | Audit action |
|---|---|---|
| Section 1 | On or before the employee’s first day of employment | Confirm the employee completed, signed and dated Section 1 by this point.[1][2][3][4][5] |
| Section 2 | Within three business days after the first day of employment; first day if employment lasts less than three business days.[7] | Check actual completion against that deadline, including the short-employment exception. Do not backdate a late completion.[7] |
| Reverification | On or before temporary work authorization expires | Track the expiration date and review applicable List A or List C work-authorization evidence.[2][4][5] |
| ICE Notice of Inspection | Generally at least three business days’ notice; warrant/subpoena exceptions.[7] | The regulation generally provides at least three business days’ notice before inspection; a subpoena or warrant can require production without that notice. Read the actual demand and consult counsel about its scope.[7] |
| Former-employee retention | Keep throughout employment, then until the later of three years after hire or one year after termination.[7] | Calculate both dates and use the later one. For example, hire 1 June 2024 and leave 1 December 2026 gives 1 December 2027. Suspend disposal where an applicable hold requires it.[7] |
| Recommended: internal audit | Employer-selected schedule | Some sources recommend annual reviews, but no federal frequency mandate was verified.[1][3][5] |
Define the scope before making corrections
Name an audit leader and document whether the review covers the entire workforce or a defined group. Include the paper files and electronic repositories within that scope.[1][4]
- Reconcile the population: Compare an updated employee roster with the I-9 inventory. Collect forms for current employees and former employees whose records remain retainable.[1][4]
- Gather related records: Obtain the applicable form instructions, acceptable-document lists and E-Verify records if the employer participates.[1][4]
- Create an issue log: Record findings before making corrections.[1][4] A practical format can identify the employee, form section, issue, responsible corrector, actual correction date and remediation status.
Check each form and supporting record
- Section 1: Check the employee’s full name, address, date of birth, required fields, signature and date. Confirm the employee selected one citizenship or immigration status and entered the applicable A-Number, USCIS Number or Form I-94 admission number.[1][2][3][4][5] The cited guidance treats a Social Security number as mandatory for an E-Verify employer and voluntary otherwise.[1][4]
- Supplement A: If a preparer or translator assisted, confirm each person entered the required name and address information, signed and dated the certification.[1][2][4]
- Section 2: Confirm the recorded documents are either one List A document or one List B document plus one List C document. The guidance cautions employers against requesting a particular document, accepting an invalid combination or recording more documents than the applicable combination requires.[3][4][5] Check each document’s title, issuing authority, number, applicable expiration date, apparent genuineness, relationship to the employee and whether it was ordinarily unexpired when presented.[2][3][4][5] Also check the employee’s name, actual first day of employment, employer name and address, certification, and the representative’s signature, printed name, title and date.[1][2][4]
- Supplement B: Check the reverification date, new document title, number, expiration date, employer signature and date. The cited guidance directs employers to use work-authorization evidence from List A or List C rather than an identity-only List B document.[2][4][5]
Communicate and correct errors without rewriting history
A correction notice should identify the affected section and the missing or inaccurate field. The cited guidance cautions employers against directing an employee to present a particular document.[3][4][5] Any response date set for an internal correction notice should be identified as a company deadline; the sources do not verify a standard federal employee-response period for internal corrections.
- Section 1: Ask the employee to make the correction. The cited guidance says the employer should not directly change the employee’s information or attestation.[1][5]
- Paper forms: Draw one line through the incorrect entry so it remains readable, enter the correction nearby, and have the person making the correction initial and date it. The guidance says not to erase, use correction fluid, conceal the original entry or backdate the change.[1][3][4][5]
- Multiple or serious errors: If a replacement section or form is needed, retain the original, attach the replacement and explain what was corrected.[3][4]
- Late Section 2: Preserve the actual completion date. A late completion should be documented rather than backdated or presented as timely.[4]
Test electronic I-9 records for auditability
Review more than the completed form displayed on screen. The cited guidance calls for checking audit trails, access controls, protection against unauthorized changes, preservation of original data during corrections and production in the format ICE requests.[3][5]
| Recommended test | Pass | Fail |
|---|---|---|
| Audit trail | Entries and corrections identify the user and date. | Events, users or dates are missing. |
| Access controls | Role restrictions prevent unauthorized viewing and changes. | An unauthorized account can view or edit records. |
| Original-data preservation | A test correction preserves the previous value and correction history. | The previous value is silently overwritten. |
| Record production | A sample of current and retainable former-employee records exports legibly, completely, in organized form and in the requested format. | Records are incomplete, unreadable, disorganized or cannot be produced as requested. |
The sources do not identify a government certification or formal approval process for an employer’s electronic I-9 audit.[1][2][3][4][5][6]
Prepare for a three-business-day ICE response
Assign a response owner and backup before receiving a Notice of Inspection. The regulation generally provides at least three business days’ notice before inspection; a subpoena or warrant can require production without that notice. Read the actual demand and consult counsel about its scope.[7]
- Verify the notice: Confirm its details and production deadline with the named agent.[1]
- Contact counsel: Escalate questions about a warrant, production scope, substantive errors or requests to sign documents.[1]
- Control production: Gather the requested records and organize current-employee and former-employee files separately.[1][3][5]
- Log communications: Record contacts, requests, responses and materials produced.[1][3][5]
Close the audit and assign ongoing work
Document findings and remediation, organize records for retrieval, record the storage method, establish a standard procedure, track expiring work authorization, monitor form revisions and train responsible personnel.[1][2][3][5]
Recommended controls: annual refresher training, attendance and training records, role-specific instruction, periodic mock audits, a designated compliance officer and an audit-response protocol.[3]
The sources do not verify a government internal-audit or filing fee, a standard processing time beyond the Notice of Inspection response period, formal approval steps or a renewal fee.[1][2][3][4][5][6] The $288–$2,861 range comes from DHS’s 2025 adjustment for specified employment-verification failures, effective for penalties assessed after 2 January 2025 where the violation occurred after 2 November 2015. It is not a newly verified 2026 rate or a flat fine for every audit finding.[8] Confirm the applicable current schedule, assessment date, violation category and notice before estimating exposure.
Assign an owner and review date to each unresolved error, expiring authorization, electronic-system issue and item requiring legal escalation.[1][2][3][5] References
