From Onboarding to Audit Ready: Tailoring Your Form I-9 Process for Real World Compliance

Hiring in the United States is not only about finding the right person. It is also about documenting, on a strict timeline, that the person you hired is authorized to work. That is the job of Form I-9, and it is one of the most frequently misunderstood compliance obligations because it feels deceptively simple: one form, a few documents, and done. In practice, small timing errors and inconsistent handling can become costly when an agency asks to see your records.[1]

Plain English Version: Form I-9 is the government’s way of requiring employers to verify identity and work authorization for every hire, and to be able to prove it later if inspected.[2]

Understanding the structure of Form I-9

Form I-9 is the employment eligibility verification form. Employers generally do not submit it to the government as part of routine hiring. Instead, they complete it, retain it, and produce it if an authorized agency requests it.[3] The form’s operational core is the employee’s completion of Section 1 and the employer’s completion of Section 2. If reverification or a qualifying rehire is needed, the employer completes the reverification and rehire portion, which on the current form is handled through Supplement B.[4]

Plain English Version: Think of Form I-9 as your hiring receipt. You are not mailing the receipt to the store, but you must keep it in case the store later asks you to prove the purchase.[5]

The timeline: when each part must be completed

The timing rule is strict and is defined in the regulations. The employer must ensure the employee completes Section 1 at the time of hire.[6] The employer then has three business days from the hire to examine documents and complete Section 2.[7] If the employee is hired for fewer than three business days, the employer must complete document examination and Section 2 at the time of hire.[8]

A practical example clarifies the rhythm. Suppose an employee starts work for pay on Monday. Section 1 should be completed at hire, and Section 2 must be completed by Thursday (assuming no federal holiday changes the business day count). If the job is only Monday and Tuesday, the employer cannot wait until day three and must complete Section 2 on Monday.[9]

Plain English Version: The I-9 clock starts when the person actually starts work for pay, and you have a very small window to get the paperwork right.[10]

The retention rule: how long to keep the form and how fast you must produce it

Retention is not “keep it forever,” and it is not “delete it when the person leaves.” The rule is: retain Form I-9 for three years after the date of hire, or one year after employment ends, whichever is later.[9] In addition, the regulations provide that the employer must be given at least three business days’ notice before an inspection, and the I-9s must be made available at the time of inspection in an acceptable format.[10]Plain English Version: Keep Form I-9 while the person works for you, and after they leave, keep it until the later of these two dates: three years from hire, or one year from termination.[11]

The contractor caveat: when Form I-9 is not required, and what the caveats really mean

Form I-9 is required for employees hired for employment in the United States.[12] It is not required for true independent contractors because they are not employees for Form I-9 purposes, and it is not required for individuals who are physically located outside the United States and hired for work outside the United States.[13] It is also not the hiring entity’s obligation to complete I-9s for workers who are employed by a separate contractor providing contract services, because that contractor is the employer for I-9 purposes.[14]

The caveat is important: “no I-9 required” does not mean “no exposure.” U.S. immigration law treats a person or entity that uses a contract or subcontract to obtain the labor of an unauthorized worker, with knowledge of unauthorized status, as having hired that worker for employment in violation of the statute.[15] This is why a contractor model should still include thoughtful compliance screening and contract language, even though you are not collecting an I-9 from the contractor as if the contractor were your employee.[16]

Plain English Version: You do not complete I-9s for independent contractors, but you also cannot treat contractors as a loophole if you know you are getting unauthorized labor through the contract.[17]

Special issues: sole proprietors and “I own the company” hires

A self-employed person does not complete Form I-9 on their own behalf unless they are an employee of a separate business entity.[18] Put differently, if there is no separate employer entity employing you, there is no I-9 for you. But if you have formed a separate entity and you are on payroll as an employee of that entity, the entity completes your I-9 as it would for any other employee, and the employer verification steps must still be performed by an authorized representative rather than by the employee verifying themselves.[19]

Plain English Version: If you are the business, you do not I-9 yourself. If the business is a separate entity that employs you, then you are an employee and the entity must treat you like one for I-9 purposes.[20]

The digital variation: E-Verify is not Form I-9, and remote review has its own rules

E-Verify[21] is an electronic confirmation program that compares information from an employee’s Form I-9 to records available to the government, including identity and employment authorization data.[22] It does not replace Form I-9, and enrolling in E-Verify does not eliminate the requirement to complete and retain I-9s on the regulatory timeline.[23]

Remote document examination is also not simply “doing the I-9 online.” DHS has authorized an alternative procedure to physical document examination that is available only to qualified employers in good standing in E-Verify, and it comes with defined steps and additional retention obligations.[24] Under that alternative procedure, within three business days of the employee’s first day of employment, the employer (or an authorized representative) must: (1) examine copies of the documents (front and back if two sided); (2) conduct a live video interaction after the employee transmits the copies and then presents the same documents during the video interaction; and (3) indicate on the form that the alternative procedure was used for Section 2 completion or reverification, as applicable.[25] The employer must also retain clear and legible copies of the documents in accordance with the alternative procedure’s requirements.[26]

Plain English Version: E-Verify is a separate check. Remote I-9 review is allowed only if you qualify, and it is a specific process: copy review, live video, the right annotation, and careful document retention.[27]

When the inspector knocks: what an I-9 inspection looks like

Inspections are not typically a surprise “walk-in and hand me your files” moment. The regulations contemplate notice, and the employer must be given at least three business days’ notice prior to an inspection of Forms I-9 by authorized officers.[28] In practice, inspections are commonly associated with worksite enforcement activity conducted by the U.S. Immigration and Customs Enforcement[29], often through its Homeland Security Investigations[30] directorate.[31]

After an inspection, employers may receive various written outcomes. The most commonly described notices include an inspection result or compliance letter, suspect documents or discrepancies notices (focused on employee work authorization questions), a technical or procedural failures notice, a warning notice, and a notice of intent to fine if the agency seeks monetary penalties.[32] For technical or procedural failures, the statute provides that the employer must be given not less than ten business days to correct after the failure is explained, and a failure to correct within that window can remove the benefit of the “technical or procedural” safe harbor.[33]

Plain English Version: An audit is paperwork driven. You usually get notice, you must produce your I-9s quickly, and you may get a chance to fix certain technical errors, but not if you miss the correction window.[34]

Tailored advice: practical do’s and don’ts that match how audits work

Do build an internal process that produces consistent, audit ready records: ensure Section 1 and Section 2 timelines are tracked, ensure your document review is performed the same way for every employee, and ensure you can retrieve forms quickly in the event of an inspection.[35] If you use remote examination, follow the alternative procedure steps precisely and retain clear copies of documents as required.[36]

Do not “fix” the past by concealing it. The official guidance is explicit: do not backdate Form I-9.[37] If you correct an error, do it transparently and consistently, and keep an audit trail. Also, avoid selective document copying or inconsistent demands for particular documents, because both the regulations and DHS guidance repeatedly warn that discriminatory variations in the I-9 process create separate exposure.[38]

If you want one risk oriented way to think about penalties, there are three buckets: paperwork violations (for failures to properly complete, retain, or present I-9s), knowingly hiring or continuing to employ unauthorized workers, and document fraud violations. For 2025, DHS’s published penalty ranges include $288 to $2,861 per paperwork violation, and up to $28,619 per unauthorized worker for third or subsequent offenses, with separate document fraud ranges that can reach $11,823 for subsequent offenses depending on the conduct.[39] These numbers change over time, but their message is stable: Form I-9 is an operational compliance system, not a formality.[40]

N.B. For current form versions, instructions, and updates, consult the U.S. Citizenship and Immigration Services[41] Form I-9 hub, which also reminds employers not to file the form with the government.[42] If you receive an inspection notice or anticipate a worksite enforcement issue, consulting experienced counsel early can materially improve how you organize a response and avoid secondary violations.[43]