I-9 Audit

If you hire in the United States, your Form I-9 files are among the compliance records the federal government is most likely to ask for. On March 16, 2026, U.S. Immigration and Customs Enforcement (ICE) reclassified more than 10 common paperwork errors as substantive violations, ending the 10-day correction window employers had relied on for nearly three decades. Penalties run $288 to $2,861 per form, so 200 flawed files can reach six figures.

This guide covers what an I-9 audit is, who runs it, what auditors look for, what the March 2026 rules changed, and how to review your own records before a Notice of Inspection arrives.

What is an I-9 audit?

An I-9 audit is a review of your Form I-9 records to confirm you properly verified the identity and work authorization of every person you hired. You may run one yourself, or the government may run one after serving a Notice of Inspection.

The obligation comes from the Immigration Reform and Control Act of 1986, which requires every U.S. employer to complete an employment eligibility verification form for each employee hired after November 6, 1986. IRCA applies regardless of your headcount or industry.

The distinction that matters most is scope. An audit examines your paperwork, not your employees. Form I-9 compliance is a recordkeeping duty that sits inside HR compliance, and federal immigration law penalizes the recordkeeping failure independently of who you actually hired.

Types of I-9 audits

You will encounter two kinds, and only one of them is voluntary. Knowing the difference shapes how much control you have over the outcome:

• Internal self-audits: You or your counsel review your own records and correct errors on your own schedule. An internal audit is the only mechanism that lets you fix problems without penalty exposure, and it carries no obligation to report findings to the government.
• Government audits: ICE initiates these by serving a Notice of Inspection, or NOI. You get a fixed window to produce records, no ability to correct substantive errors after service, and a real prospect of civil fines.

Self-audits are not risk-free. If you identify violations and then fail to remediate them, your own documentation can support an inference that you knew and left them alone. Run one only with a commitment to fixing what you find.

Who conducts an I-9 inspection?

Three groups may end up reviewing your files, and each has a different mandate. Understanding who is asking helps you calibrate your response:

• ICE and Homeland Security Investigations: HSI is the investigative arm of ICE. It serves the NOI, inspects your records, and calculates penalties, and it sits within the U.S. Department of Homeland Security (DHS).
• The Department of Justice: The Immigrant and Employee Rights Section (IER) of the DOJ Civil Rights Division enforces the anti-discrimination provisions of the Immigration and Nationality Act (INA). IER investigates document abuse and citizenship status discrimination, which are separate from the paperwork issues ICE pursues.
• Third-party auditors and legal counsel: Immigration counsel or a qualified compliance vendor runs your internal reviews. Attorney-led audits also preserve privilege over the findings, which matters if a government audit follows.

What triggers an I-9 inspection?

You do not need to have done anything wrong to receive an NOI, and ICE is not required to explain why it selected you. A few patterns come up repeatedly.

Complaints are the most common individual trigger. A former employee, a competitor, or a union may report suspected unauthorized workers, and ICE can open an inspection on a tip alone. These often arrive after a termination or a labor dispute.

Sweeps are the second pattern. ICE worksite enforcement has historically concentrated on construction, agriculture, hospitality, staffing, and manufacturing, where high-volume hiring produces more paperwork gaps. That focus has broadened, and technology employers with H-1B or L-1 populations now draw attention.

E-Verify data is a third. Discrepancies between your E-Verify cases and your Forms I-9, or remote verification without active enrollment, can invite closer review. Reporting indicates ICE issued Notices of Inspection in 2025 at roughly 10 times the 2024 rate.

The inspection process: how a government audit works

Once you receive an NOI, the sequence is fixed and the deadlines are short. The I-9 audit process steps below run in the order you will encounter them:

1. Service of the Notice of Inspection. ICE serves the notice in person or by mail, and you have at least three business days to produce the records. The demand typically covers Forms I-9 plus payroll records, tax filings, and a current employee list.
2. Document production. You deliver the records and supporting documentation to ICE. If you do not comply voluntarily, ICE can compel production through an administrative subpoena, so negotiating an extension is safer than missing the deadline.
3. Inspection and review. Auditors compare your forms against the requirements in effect when each was completed. Review can take weeks or months depending on your headcount.
4. Notices of findings. ICE issues one or more written notices, which may include a Notice of Suspect Documents, a Notice of Discrepancies, a Notice of Technical or Procedural Failures, or a compliance letter if you are clean.
5. Penalty determination. If violations warrant it, ICE serves a Notice of Intent to Fine setting out the charges and amount.

Important note: You may request a hearing before the Office of the Chief Administrative Hearing Officer within 30 days of receiving a Notice of Intent to Fine. Missing that window forfeits your ability to contest the penalty, so calendar the date the moment it arrives.

Form I-9 requirements and what auditors examine

Auditors work section by section, and each part of the form carries its own failure modes. Start by confirming you are using the right version.

As of August 1, 2026, the only Form I-9 acceptable for new hires is one showing an expiration date of 05/31/2027. U.S. Citizenship and Immigration Services (USCIS) publishes the current edition, dated 01/20/25, and the earlier printing that expired 07/31/2026 is no longer usable.

Check the edition date in the bottom left corner and the expiration date in the top right. Auditors then work through each part of the form in turn:

• Section 1, employee attestation: The employee completes this during onboarding, no later than the first day of employment, with full legal name, date of birth, address, attestation of status, signature, and date. Noncitizens must supply a USCIS number or admission number where applicable.
• Section 2, employer verification: You complete this within three business days of the start date, recording the document title, issuing authority, document number, and expiration date, plus the first day of employment and your representative’s name, title, business name, and address.
• Supplement A, preparer and translator certification: Anyone who helps the employee complete Section 1 signs here. Incomplete preparer data is now substantive.
• Supplement B, reverification and rehires: Use this when work authorization expires or you rehire within three years. Never reverify a U.S. passport, permanent resident card, or List B identity document.

Employees choose which documents to present. One List A document establishes both identity and work authorization, or they may present one List B document for identity plus one List C document for work authorization. Requiring a List A document is itself a discrimination violation.

Common I-9 violations auditors find

Your ability to fix an error depends entirely on how ICE classifies it. The line between I-9 substantive vs technical violations moved sharply in March 2026, and errors you could once correct are now fineable immediately.

Technical violations are minor deficiencies that still carry a 10-business-day cure period after written notice. Substantive violations go to the heart of the verification duty and carry a penalty as soon as they are found.

On March 16, 2026, ICE updated its Form I-9 inspection fact sheet. The update effectively superseded the 1997 Virtue Memorandum, the Immigration and Naturalization Service guidance that had governed this distinction for nearly 30 years.

The fact sheet now lists 28 categories of substantive violations, and more than 10 previously correctable error types moved into that column.

One change is easy to miss. Retaining a copy of an employee’s document no longer cures missing Section 2 data. Under prior guidance you could transcribe the document number from a retained copy within 10 days, and now the omission is substantive regardless of what is in your file.

Separately, INA 274C covers document fraud, which reaches knowingly accepting or using forged or fraudulently obtained documents. Backdating a form or altering an entry after the fact can move a paperwork problem into fraud territory, which carries heavier consequences than a fine.

I-9 audit penalties 2026: outcomes and fine amounts

ICE assesses fines per form, which is why a small error rate across your files produces a large number. The I-9 fines per form below reflect the DHS inflation adjustment published in the Federal Register on January 2, 2025 and codified at 8 CFR 274a.10:

ICE calculates a base fine by dividing substantive violations by the total number of Forms I-9 that should have been presented. It then adjusts within the range using five statutory factors: business size, good faith, seriousness, whether unauthorized workers were employed, and prior violation history. Each factor can move the fine up or down by 5%.

Not every audit ends in money. A clean inspection produces a compliance letter, and minor issues may draw only a warning notice. Serious cases go further, into debarment from federal contracts, criminal referral where a pattern or practice exists, and separate sanctions from state licensing authorities.

Your employees have protections throughout. You cannot terminate, suspend, or reduce hours based on an ICE notice alone without giving the employee a chance to respond, and you cannot demand specific documents or reverify existing staff selectively. Those actions expose you to IER enforcement on top of whatever ICE assesses.

How to conduct an internal I-9 self-audit

An internal I-9 audit is the only point where you control the outcome, so treat it as a project rather than a spot check. Work through these steps in order and document each one:

1. Gather every record. Pull Forms I-9 for all current employees and every former employee still inside the retention window, plus any attached document copies.
2. Fill the gaps. Where a form is missing, complete a new one using today’s date. Never backdate it to the original hire date.
3. Verify each section against the rules in force at completion. Check Section 1 for the fields now treated as substantive, Section 2 for complete document data, and Supplement B for reverification that came due.
4. Categorize what you find. Sort errors into missing forms, substantive violations, and technical failures. The March 2026 reclassification means earlier audit findings need re-examination.
5. Correct using proper procedure. Draw a single line through the incorrect entry, write the correct information, then initial and date the change. Do not use correction fluid or erase anything.
6. Update your records. Attach a memo to each corrected form explaining what changed and why, then reconcile your I-9 inventory against your current employee roster.
7. Document the process and schedule the next one. Record the scope, dates, methodology, and remediation on your HR compliance calendar. Annual reviews are a reasonable baseline.

Timing carries legal weight. Correction after an NOI is served does not reduce liability for substantive violations, but remediating beforehand starts the five-year statute of limitations clock and builds the good faith record that shapes penalty size.

Form I-9 correction rules: fixing what your audit finds

Once you have categorized your errors, the method depends on what went wrong. These Form I-9 correction rules apply to paper and electronic files alike.

For errors on an existing form, annotate rather than replace. Draw a single line through the error, write the correct information beside it, then initial and date the change.

If the error is extensive enough that annotation would render the form unreadable, complete a new Form I-9, attach it to the original, and write a short explanation of why both exist.

Where possible, the person who made the original entry should correct it. If they have left, a current authorized representative can do so and note the circumstances. The employee must correct Section 1 errors themselves, since it is their attestation.

Missing or expired documents need care. You may not reverify List B identity documents or permanent resident cards, and an expired document in Section 2 is not automatically a violation if it was valid when presented. Where reverification came due and was missed, complete Supplement B now with the current date and document the delay.

How to prepare when you receive an ICE audit notice

If an ICE notice of inspection arrives at your office, what you do in the first 48 hours shapes everything that follows. The time to learn how to prepare for an I-9 audit is before one lands, so build the plan now and keep it where your team can find it.

Note the exact date and time of service, since your production deadline runs from that moment. Do not hand over documents on the spot, and do not let a manager improvise a response.

Engage immigration counsel before you respond. Counsel can negotiate an extension of the production window, which ICE frequently grants, and review your files under privilege before anything leaves the building. Produce copies rather than originals, and keep a duplicate set of everything you submit.

Brief the people who might receive the next visit. Front-desk and site staff should know who to call and that they need not permit access to non-public areas without a judicial warrant. Your obligation under an NOI is document production, not site access.

I-9 retention requirements and recordkeeping rules

Your retention obligation outlasts the employment relationship, and destroying a form early is its own violation. The I-9 retention requirements are simple to state and easy to get wrong in practice.

Keep each Form I-9 for three years after the date of hire, or one year after employment ends, whichever is later. For current employees, the retention period runs indefinitely. Calculate it per employee rather than purging by calendar year, and check the current rules on USCIS I-9 Central before you dispose of anything.

Store I-9s separately from personnel files. Segregation limits what you hand over during an inspection and reduces the chance that status information influences unrelated employment decisions. Paper and electronic storage are both permitted.

Electronic systems carry their own requirements. DHS requires audit trails recording who accessed or modified each record and when, compliant electronic signature protocols, indexing that permits retrieval, and documented security controls. Deficiencies in any of these became substantive violations in March 2026, so ask your vendor to evidence each control.

E-Verify and I-9 compliance: how enrollment changes your risk

E-Verify sits on top of Form I-9, not in place of it. E-Verify and I-9 compliance are worth understanding together, because enrollment changes both what you are permitted to do and how much risk you carry.

E-Verify compares Section 1 and Section 2 data against DHS and Social Security Administration records after you complete the form.

Enrollment is mandatory for federal contractors holding the Federal Acquisition Regulation (FAR) E-Verify clause and for employers in 11 states that require it for all or most private employers, including Alabama, Arizona, Florida, Georgia, and South Carolina. Thresholds vary, so confirm the rule where each of your employees works.

Voluntary enrollment carries two benefits. In many states it creates a rebuttable presumption, meaning the state assumes you complied unless evidence shows otherwise, that you did not knowingly hire an unauthorized worker. Federally, enrollment is a prerequisite for remote document examination.

Tentative nonconfirmations need careful handling. A tentative nonconfirmation (TNC) is not a finding that someone is unauthorized. Notify the employee within 10 federal working days, give them the referral information, and take no adverse action while they contest it. Terminating or suspending someone during an open TNC is a violation in its own right.

Internal I-9 audit checklist for employers

Use this internal I-9 audit checklist as the working document for your review. Keep the completed version, because it is the good faith evidence that matters most in a penalty calculation. Work through it in three passes:

• Before you start: Confirm your form version, pull your full employee roster, define the scope in writing, engage counsel, and decide how you will document findings.
• Section by section: For each form, confirm that Section 1 was completed by the first day of employment with all now-substantive fields present, Section 2 within three business days with full document data, Supplement A where a preparer assisted, Supplement B for any reverification, and the correct edition throughout.
• After the review: Correct errors by annotation, complete missing forms with current dates, remediate every finding rather than logging it, update your I-9 inventory, retrain your onboarding staff, and set the date for your next review.

How remote and hybrid hiring affects your I-9 compliance

If you hire remotely, your verification method is itself an audit issue. These rules changed in 2023 and tightened again this year.

You have two compliant paths. The first is an authorized representative: you designate any person, such as a notary or a trusted contact near the employee, to physically examine the documents and complete Section 2 for you. You remain liable for their errors, so brief them properly.

The second is the DHS alternative procedure, which permits live video examination of documents alongside retained copies. It is available only to employers enrolled in E-Verify and in good standing, and you must use it consistently for all remote hires at a given site.

Documentation is the step most often missed. You must check the alternative procedure box in Section 2 or Supplement B, and you must have been actively enrolled in E-Verify at the time of each remote verification. Failing either is now a substantive violation, so audit your remote hires specifically.

Where to start this week

The classifications changed in March, and the errors sitting in your files were reclassified without a notice going out to employers. Pull a sample of 20 forms, check them against the fields that are now substantive, and let the error rate you find set the size of your response.

How Lighthouse supports employer immigration compliance

Your I-9 file and your visa files describe the same workforce, and gaps in one often signal gaps in the other. If you sponsor H-1B, L-1, O-1, or green card cases, you carry both obligations at once.

Lighthouse prepares employment-based immigration petitions for startup and technology employers, with attorney review included in every case and applications completed in under three weeks.

For companies with 25 or more employees, the Plus plan adds compliance support, consolidated billing, and long-term immigration programming, so your sponsorship work and your compliance posture stay in one place.

Talk to our team about your immigration program.

Frequently asked questions on I-9 audits

Is ICE doing I-9 audits?

Yes, at elevated volume. Reporting indicates Notices of Inspection in 2025 ran at roughly 10 times the 2024 rate, and ICE tightened its violation classifications further in March 2026.

Are I-9 audits random?

Not entirely. ICE selects employers based on complaints, industry sweeps, prior enforcement history, and data from other agencies, but it need not disclose why it selected you, and companies with no prior issues do receive notices.

How do you perform an I-9 audit?

Gather all forms within the retention window, verify each section against the requirements in effect at completion, categorize errors as missing, substantive, or technical, correct them by annotation with initials and dates, and document the process.

Who conducts an I-9 audit?

Homeland Security Investigations runs government inspections on behalf of ICE. The Department of Justice enforces related anti-discrimination provisions, and employers use immigration counsel or compliance vendors for internal reviews.

Which Form I-9 should I use?

The edition dated 01/20/25 with an expiration date of 05/31/2027. Since August 1, 2026, forms showing the earlier 07/31/2026 expiration are not acceptable for new hires.

What triggers a Form I-9 audit?

Complaints from former employees or competitors, industry enforcement sweeps, E-Verify discrepancies, prior violations, and referrals from other agencies are the most common triggers.

How often should employers conduct internal audits?

Annually as a baseline, and more often if you hire at volume, operate across multiple states, or use remote verification. Anyone who audited before March 2026 should re-examine those findings under the current classifications.