Form I-9 Compliance: Rules, Audits & Penalties 2026

Section A: What Is I-9 Compliance?

Form I-9 compliance refers to an employer’s legal obligation to verify the identity and employment authorization of individuals hired to work in the United States. The requirement applies to almost every employer, regardless of size, industry or workforce composition, and forms a central component of the federal government’s worksite enforcement regime.

Employers are required to complete and retain a Form I-9 for each employee hired after November 6, 1986. The process requires both the employee and employer to complete specific sections of the form within prescribed timeframes and to review documentation establishing identity and work authorization.

I-9 compliance does, however, extend far beyond basic paperwork. Employers are expected to follow detailed rules governing document examination, retention periods, reverification procedures and record management. Errors can result in substantial civil penalties, even where every employee is legally authorized to work in the United States.

For many organizations, Form I-9 compliance also overlaps with broader workforce compliance obligations, including onboarding procedures, recordkeeping systems, remote hiring practices and, in some cases, participation in E-Verify.

As a result, the reality is that compliance failures usually arise out of weaknesses in internal processes rather than the employment of unauthorized workers.

1. Why Form I-9 Compliance Matters

The Form I-9 was introduced under the Immigration Reform and Control Act as part of a broader effort to prevent unauthorized employment. Federal enforcement agencies use the form to assess whether employers have met their obligations to verify workforce eligibility and maintain required records.

In recent years, worksite enforcement has returned to the forefront of federal immigration policy. Greater emphasis has been placed on preventing unauthorized employment, strengthening immigration enforcement and ensuring employers maintain effective workforce verification procedures. As a result, Form I-9 compliance has become an increasingly important area of operational and legal risk for US businesses.

Immigration enforcement activity regularly focuses on paperwork violations, missing forms, late completion, document errors and recordkeeping failures. An organization may face liability even where no unauthorized workers are identified.

Worksite enforcement also extends beyond traditional hiring compliance. During an audit or inspection, government officers may review whether forms were completed correctly, whether required reverifications were performed and whether records have been retained in accordance with federal requirements. A seemingly minor administrative error can therefore become a costly compliance issue.

2. What Employers Are Required to Do

At its core, I-9 compliance requires employers to verify that each new hire is authorized to work in the United States and to document that verification correctly.

Employees are responsible for completing Section 1 of Form I-9 no later than their first day of employment. Employers are required to examine acceptable documentation and complete Section 2 within three business days of the employee’s first day of work for pay.

The employee chooses which acceptable documents to present from the Lists of Acceptable Documents accompanying Form I-9. Employers generally cannot specify which documents should be provided or request additional documentation because of an individual’s citizenship, immigration status or national origin.

Employers should examine original documents unless they qualify to use a DHS-authorized alternative procedure. Documents should reasonably appear genuine and relate to the individual presenting them. Employers are not expected to be document experts, but they are expected to identify obvious inconsistencies or deficiencies.

Employers using DHS-authorized alternative procedures should ensure they remain eligible to do so and continue to satisfy all applicable E-Verify and procedural requirements.

Compliance obligations continue after onboarding. Employers may need to reverify certain employees’ work authorization, update records where appropriate and retain completed forms for the applicable retention period.

3. I-9 Compliance Is More Than a Hiring Requirement

Many employers view Form I-9 completion as a one-time onboarding task. That approach often creates compliance gaps that only become apparent during an internal review, government inspection or corporate transaction.

A compliant I-9 program typically includes documented onboarding procedures, trained personnel, quality control checks, record retention systems and periodic internal audits. Employers should also have procedures for correcting errors, addressing deficiencies and responding to government requests for records.

As organizations grow, open new locations, acquire businesses or adopt remote hiring practices, maintaining consistency across the workforce becomes increasingly difficult. Different hiring teams may interpret requirements differently, resulting in errors that accumulate over time and remain undetected until records are scrutinized.

For that reason, many employers treat I-9 compliance as an ongoing compliance function rather than an administrative formality. The sections that follow examine the specific employer requirements, common compliance failures, enforcement risks and practical measures organizations can take to reduce exposure.

Section B: Employer I-9 Compliance Requirements

Federal rules impose specific obligations on employers throughout the hiring process and, in some cases, during the employment relationship itself. Compliance failures often arise not because an employer knowingly hired an unauthorized worker, but because established procedures were not followed consistently.

Employers should have an up to date understanding of what the law requires at each stage of the process, from onboarding through to record retention and reverification where applicable.

1. Completing Form I-9 Correctly and On Time

The timing requirements for Form I-9 completion are strict. Employees should complete Section 1 no later than their first day of employment, while employers are required to complete Section 2 within three business days of the employee’s first day of work for pay.

Missing deadlines can create liability even where the form is ultimately completed. During an audit, enforcement officers routinely review completion dates and frequently identify late forms as violations.

Accuracy is equally important. Employers should ensure all required fields are completed, signatures are present where required and information is entered correctly. Common mistakes include missing hire dates, incomplete document information, omitted attestations, unsigned forms and the use of outdated versions of Form I-9.

A properly completed Form I-9 provides evidence that the employer followed the required verification process. An incomplete or inaccurate form can undermine that position during an inspection and may result in penalties even where the employee was authorized to work.

2. Reviewing Employment Authorization Documents

Employers are required to examine documentation presented by the employee from the Lists of Acceptable Documents accompanying Form I-9.

The employee chooses which acceptable documents to present. Employers generally cannot specify which documents should be provided, request more documents than required or reject acceptable documentation because of citizenship, immigration status or national origin. Such practices can create exposure under federal anti-discrimination provisions as well as immigration compliance rules.

When reviewing documentation, the employer should determine whether the documents reasonably appear genuine and relate to the individual presenting them. The standard is one of reasonableness rather than forensic examination.

Consistency is particularly important. Applying different document review standards to different employees can create discrimination concerns and increase enforcement risk.

Remote hiring arrangements can present additional challenges. Employers relying on DHS-authorized alternative procedures should ensure they satisfy all applicable eligibility requirements and follow the required process precisely. Failure to do so can invalidate the verification process and create compliance exposure.

3. Reverification and Employment Authorization Tracking

Some employees present evidence of employment authorization that expires. In those circumstances, employers may be required to reverify continued work authorization before the relevant authorization expires.

Reverification obligations do not apply to all employees or all documents. Employers generally should not reverify US citizens, noncitizen nationals or lawful permanent residents solely because a Permanent Resident Card has expired. Incorrect reverification practices can create both compliance and discrimination risks.

Many organizations rely on centralized tracking systems to monitor upcoming expiration dates and ensure reverification is completed within the required timeframe. Without a reliable process, employers may overlook required reverifications or conduct them unnecessarily.

An effective tracking system should also account for automatic extensions of employment authorization, receipt notices and other circumstances that affect work authorization validity. Employers that rely solely on document expiration dates without considering these rules may reach incorrect conclusions about an employee’s continued authorization to work.

4. Form I-9 Retention Requirements

Employers are required to retain Form I-9 records for specific periods after hire and termination. The retention rule is generally the later of three years after the employee’s date of hire or one year after employment ends.

Retaining forms for less than the required period can create compliance issues if records are requested during an inspection. Retaining forms indefinitely can also increase exposure because older records remain available for review if they continue to be maintained.

Many employers maintain separate I-9 files rather than storing forms within general personnel records. A dedicated filing system can simplify audits, reduce operational disruption during inspections and help protect confidential employee information.

Whether records are maintained in paper format, electronically or through a compliant electronic I-9 platform, employers should ensure forms can be retrieved promptly if requested by government authorities. Responsibility for compliance remains with the employer, even where third-party software providers or external vendors are involved in the recordkeeping process.

5. Establishing Consistent Compliance Procedures

One of the most common causes of I-9 violations is inconsistency. Different hiring managers, locations or departments may apply different onboarding procedures, document review standards or recordkeeping practices.

A consistent compliance framework helps reduce these risks. Written policies, standardized onboarding procedures, regular training and periodic quality assurance reviews can all support stronger compliance outcomes.

Organizations operating across multiple locations often face particular challenges because responsibility for hiring may be distributed across several teams. Without effective oversight, errors can accumulate over time and remain undetected until an audit occurs.

For many employers, the objective is not simply completing Form I-9 for each employee. The wider goal is creating a repeatable process capable of withstanding government scrutiny if records are reviewed months or years later.

Section C: Common I-9 Compliance Violations

Many Form I-9 violations arise from routine administrative errors rather than deliberate misconduct. Employers may have a lawful workforce and still face significant penalties if required verification procedures were not followed correctly. During an audit, government officers assess not only whether employees were authorized to work, but also whether the employer complied with the technical requirements governing Form I-9 completion, retention and reverification.

For that reason, even well-intentioned employers can find themselves exposed to enforcement action if compliance procedures have not been monitored consistently.

1. Missing, Incomplete or Late Forms

One of the most common violations involves failing to complete Form I-9 within the required timeframe. Employers sometimes overlook forms during periods of rapid hiring, fail to complete Section 2 on time or discover during an internal review that forms were never completed at all.

Government auditors routinely identify missing forms, incomplete fields, missing signatures and incorrect dates. In many cases, employers are surprised to learn that paperwork violations can result in penalties even where every affected employee was legally authorized to work.

The risk often increases as organizations grow. Multiple hiring locations, decentralized onboarding processes and staff turnover can all contribute to inconsistencies that remain undetected until records are reviewed.

2. Document Review Errors

Mistakes frequently occur during the document examination process. Employers may record incorrect document information, fail to enter required details, accept documentation that does not satisfy Form I-9 requirements or fail to review documents within the required timeframe.

Other employers create problems by requesting specific documents rather than allowing employees to choose from the Lists of Acceptable Documents. Some ask for more documents than required, while others reject valid documentation because they are unfamiliar with the document presented.

Document review errors can create multiple forms of liability. In addition to Form I-9 penalties, certain practices may result in allegations of unlawful discrimination based on citizenship status or national origin.

3. Reverification Failures

Reverification presents a recurring challenge for many employers. Some organizations fail to reverify employment authorization when required, while others conduct reverification unnecessarily or incorrectly.

A common mistake involves tracking document expiration dates rather than focusing on employment authorization requirements. Employers may mistakenly assume that every expiring document requires action when federal rules treat different documents differently.

Errors can also arise where organizations fail to account for automatic extensions of work authorization or overlook receipt notice provisions that temporarily extend eligibility. Without a reliable monitoring system, required follow-up actions may be missed altogether.

4. Recordkeeping and Retention Violations

Even correctly completed forms can create problems if records are not retained properly. Employers are expected to maintain Form I-9 records for the required retention period and produce them when requested by government authorities.

Violations frequently occur where records have been misplaced, destroyed prematurely or stored in systems that make retrieval difficult. Employers that have experienced mergers, acquisitions, reorganizations or changes in HR systems may discover significant gaps in historical records.

Electronic recordkeeping introduces additional considerations. While electronic systems can improve efficiency, employers remain responsible for ensuring records are maintained in compliance with applicable requirements and can be produced promptly during an inspection.

5. Remote Hiring and Process Consistency Issues

The growth of remote and hybrid workforces has created new compliance challenges. Employers often struggle to apply consistent verification procedures across different locations, departments and hiring teams.

Problems frequently arise where managers are unfamiliar with Form I-9 requirements, alternative procedures are used incorrectly or onboarding responsibilities are delegated without adequate training and oversight.

Government auditors often identify patterns rather than isolated mistakes. A small number of errors may indicate a broader weakness in compliance procedures, increasing the likelihood of deeper scrutiny during an inspection.

Many employers discover that their greatest exposure does not stem from a single defective form. Instead, it arises from systemic weaknesses that affect large portions of the workforce and create recurring compliance failures over time.

Section D: I-9 Audits, Investigations & Penalties

Form I-9 compliance obligations are ultimately enforced through government audits and investigations. While many employers focus on completing forms during onboarding, enforcement activity often occurs months or years later when records are examined by federal authorities. At that stage, the quality of an organization’s compliance procedures, recordkeeping systems and internal controls may come under close scrutiny.

A well-maintained workforce file can help demonstrate compliance. Poor recordkeeping, inconsistent procedures and unresolved errors can quickly become significant liabilities during an inspection.

1. ICE Audits and Notices of Inspection

The primary enforcement mechanism for Form I-9 compliance is the audit process conducted by US Immigration and Customs Enforcement (ICE). Employers are typically notified through a Notice of Inspection requiring the production of Form I-9 records and supporting documentation.

In most cases, employers are given three business days to produce the requested records. Auditors may request current and former employee Forms I-9, payroll records, employee lists and other documentation used to assess compliance.

The inspection process often extends beyond reviewing individual forms. Government officers may evaluate onboarding procedures, document retention practices, reverification systems and overall compliance controls. A small number of deficiencies can lead to broader questions about an organization’s compliance framework.

2. Civil Penalties for Non-Compliance

Employers that fail to comply with Form I-9 requirements may face substantial civil penalties. The amount can vary depending on the nature of the violation, the number of affected employees, the employer’s compliance history and other statutory factors considered during enforcement proceedings.

Penalties may be imposed for paperwork violations, including missing forms, incomplete forms, late completion and recordkeeping failures. Separate penalties may apply where an employer is found to have knowingly hired or continued to employ an individual who lacked authorization to work in the United States.

For many organizations, the cumulative financial impact presents the greatest risk. A relatively small error rate applied across a large workforce can produce significant liability when penalties are assessed on a per-violation basis.

3. Investigations Beyond Form I-9 Paperwork

Not every investigation remains limited to document compliance. In some circumstances, government agencies may examine broader employment practices, workforce authorization issues or allegations relating to unauthorized employment.

Investigations can arise from a variety of sources, including employee complaints, government data analysis, prior compliance concerns, whistleblower reports or information obtained during unrelated enforcement activity.

Where government authorities identify potential patterns of non-compliance, the review may expand beyond the initial records request. As a result, employers often benefit from approaching Form I-9 compliance as part of a wider workforce compliance strategy rather than treating it solely as an onboarding requirement.

4. Mergers, Acquisitions and Corporate Transactions

Corporate transactions frequently expose hidden Form I-9 liabilities. During mergers, acquisitions, restructurings and business transfers, employers often inherit historical records created by previous management teams or acquired entities.

Deficiencies may not become apparent until a government inspection occurs or a due diligence review is conducted. Missing records, inconsistent completion practices and unresolved reverification issues can all transfer into the acquiring organization.

For that reason, Form I-9 reviews often form part of immigration due diligence exercises before a transaction is completed. Identifying issues early may allow corrective action to be taken before potential liabilities increase.

5. Responding to an Audit or Investigation

The manner in which an employer responds to an audit can significantly affect the outcome. Organizations that understand their obligations, maintain accessible records and follow a clear response process are generally better positioned to manage enforcement activity effectively.

Upon receiving a Notice of Inspection or other government request, employers should promptly assess the scope of the request, secure relevant records and identify any potential compliance concerns. Internal reviews may help determine whether corrective action is appropriate before records are produced.

Many employers seek legal advice at this stage because audits often involve technical issues relating to form corrections, document retention, employee authorization records and communication with government authorities. Early assessment can help identify risks, preserve relevant evidence and support a more informed response strategy.

6. Challenging Enforcement Findings

Employers are not necessarily required to accept an enforcement finding or proposed penalty without review. Depending on the circumstances, it may be possible to challenge alleged violations, dispute factual findings, seek mitigation of proposed penalties or negotiate a resolution with government authorities.

In more serious cases, enforcement actions can progress to a Notice of Intent to Fine and formal proceedings before the Office of the Chief Administrative Hearing Officer (OCAHO). Because these matters often involve technical legal, procedural and evidential issues, employers frequently seek legal advice before responding to notices, negotiating settlements or pursuing available remedies.

Section E: Building an Effective I-9 Compliance Program

Many employers only discover weaknesses in their Form I-9 processes after receiving an audit notice or conducting an internal review. At that stage, deficiencies may already be widespread across the workforce. A proactive compliance program helps reduce that risk by identifying problems early, promoting consistency and creating a framework capable of withstanding government scrutiny.

An effective approach combines documented procedures, training, oversight and regular review. The objective is not merely to complete forms, but to maintain a compliance process that remains effective as the organization grows and hiring practices evolve.

1. Establish Written Policies and Procedures

A consistent compliance program starts with clear written procedures governing Form I-9 completion, document review, reverification and record retention. Employees responsible for onboarding should understand precisely what is required and how responsibilities are allocated within the organization.

Written guidance can help reduce variations between locations, departments and hiring managers. It also provides a reference point when questions arise regarding document examination, remote hiring practices or employee work authorization issues.

Organizations with decentralized hiring functions often benefit from establishing standardized procedures across all business units to promote greater consistency and reduce the risk of local practices diverging from federal requirements.

2. Train Personnel Responsible for Hiring

Even well-written procedures can fail if those responsible for implementing them are not properly trained. Human resources personnel, recruiters, onboarding teams and managers involved in hiring decisions should understand their Form I-9 responsibilities and the risks associated with non-compliance.

Training should cover completion deadlines, document review standards, reverification requirements, anti-discrimination obligations and record retention rules. Refresher training can also help ensure teams remain current with regulatory developments and evolving government guidance.

Organizations that rely on multiple hiring teams often find that regular training significantly reduces inconsistency and improves overall compliance performance.

3. Conduct Internal I-9 Audits

Periodic internal audits can help identify errors before government authorities do. Reviewing records on a routine basis allows employers to detect missing forms, incomplete fields, reverification issues and recordkeeping deficiencies while corrective action remains available.

Internal reviews can be conducted across the entire workforce or through targeted sampling exercises, depending on the size of the organization and the level of risk involved. Findings should be documented and followed by appropriate remediation measures where necessary.

Many employers conduct audits following periods of rapid growth, acquisitions, leadership changes or significant hiring activity, as these events often increase the likelihood of compliance gaps developing.

4. Implement Effective Record Management Systems

Record management plays a central role in Form I-9 compliance. Employers should be able to locate, review and produce required records quickly if requested by government authorities.

Many organizations maintain dedicated I-9 files separate from personnel records to simplify retrieval and reduce disruption during an inspection. Electronic systems can also support compliance by improving accessibility, tracking retention periods and helping manage reverification deadlines.

Technology can improve efficiency, but it does not eliminate employer responsibility. Regular oversight remains important to ensure records are maintained accurately and compliance requirements continue to be met.

5. Seek Professional Support Before Problems Arise

Many of the most significant Form I-9 liabilities develop gradually over time. A process that appears to function effectively may contain recurring errors that affect hundreds or even thousands of employee records.

Independent compliance reviews can help identify systemic weaknesses, assess risk exposure and recommend corrective measures before an audit occurs. Legal advisers can also assist with remediation projects, policy development, training initiatives and responses to government inspections.

For employers operating in heavily regulated industries, maintaining a workforce across multiple locations or managing high-volume recruitment, periodic external review is often an important part of a wider compliance and risk management strategy.

Summary

Form I-9 compliance requires employers to verify employment authorization, maintain accurate records and follow detailed federal procedures throughout the employment lifecycle. Compliance obligations extend beyond onboarding and include document review, reverification, record retention and ongoing process management.

Many enforcement actions arise from routine administrative errors rather than the employment of unauthorized workers. Missing forms, incomplete records, inconsistent procedures and inadequate oversight can all create significant liability during an audit or investigation.

A proactive compliance program supported by training, internal reviews and effective record management can help employers reduce risk and respond more effectively if government authorities request records or initiate an inspection.

Need Advice?

Form I-9 errors often remain hidden until an ICE inspection, corporate transaction or internal audit exposes the problem but proactive compliance management can mitigate these risks.

NNU Immigration advises employers on Form I-9 compliance reviews, mock audits, remediation projects, workforce verification procedures and responses to government investigations. For advice on reducing compliance risk or preparing for an audit, contact our US immigration attorneys for a fixed-fee consultation.

Frequently Asked Questions

What is Form I-9 compliance?

Form I-9 compliance refers to an employer’s obligation to verify the identity and employment authorization of every individual hired to work in the United States and to maintain the required records in accordance with federal law.

Who is required to complete Form I-9?

Almost all US employers are required to complete Form I-9 for employees hired after November 6, 1986. The requirement applies regardless of the employee’s citizenship or immigration status.

When should Form I-9 be completed?

Employees should complete Section 1 no later than their first day of employment. Employers are required to complete Section 2 within three business days of the employee’s first day of work for pay.

Can an employer choose which documents an employee presents?

No. Employees choose which acceptable documents to present from the Lists of Acceptable Documents. Employers generally cannot request specific documents or demand additional documentation beyond what Form I-9 requires.

How long should Form I-9 records be retained?

Employers should retain Form I-9 for the later of three years after the employee’s date of hire or one year after employment ends.

What happens if Form I-9 contains errors?

Errors may result in civil penalties, even where the employee was authorized to work in the United States. The level of risk depends on the nature of the violation, the number of affected records and the overall compliance history of the employer.

Can employers use electronic Form I-9 systems?

Yes. Employers may use compliant electronic systems to complete, store and manage Form I-9 records. Responsibility for compliance remains with the employer, even where a third-party provider is used.

What is an ICE I-9 audit?

An ICE audit is a government inspection of an employer’s Form I-9 records and related documentation. Employers are typically notified through a Notice of Inspection and are generally given three business days to produce requested records.

Do all employees require reverification?

No. Reverification only applies in certain circumstances involving expiring employment authorization. US citizens, noncitizen nationals and lawful permanent residents generally do not require reverification solely because a Permanent Resident Card has expired.

How can employers reduce Form I-9 compliance risk?

Regular internal audits, consistent onboarding procedures, staff training, effective record management and periodic legal reviews can help identify and address compliance issues before they become enforcement problems.

Glossary

Additional Resources