The I-9 Self-Audit Playbook: 7 Steps for HR Teams Under the New ICE Standards

ICE Audits
1
minutes to read
Overhead view of an organized I-9 audit workspace with manila folders, a yellow legal pad with checkmarks, reading glasses, and a coffee mug on a warm wood desk.

In March 2026, ICE quietly rewrote its Form I-9 inspection fact sheet and reclassified several common paperwork errors from technical to substantive — meaning a missing date or blank title field can now be fined immediately, with no 10-day correction window. If your last self-audit was built around the old rules, your error inventory is understated.

USCIS publishes the regulations and ICE publishes the fact sheet, but neither agency publishes a step-by-step process for actually running an audit. The 7 steps below are how our compliance team runs them in practice — scope, error inventory, classification, correction, electronic system review, remote-verification check, and documentation. Work through them in order.

Step 1: Determine Your Audit Scope

Before you pull a single I-9, decide which records you are obligated to have on file. Federal law requires a Form I-9 for every current employee. For terminated employees, the retention rule is the longer of 3 years from the date of hire or 1 year from the date of termination — whichever is later. Records inside that window must be available for inspection within 3 business days of an ICE Notice of Inspection (NOI).

Full audit or sample?

For organizations with fewer than ~250 active I-9s, audit every form. For larger populations, a representative sample is acceptable as a first pass — but the sample needs to reflect risk:

  • Stratify by location, business unit, and hire year. A flat random sample under-weights the locations and time periods where errors are most likely (high-turnover sites, recent hires, records migrated from a prior system).
  • Minimum 10% of total I-9s, floor of 50. Below 50 forms you cannot reliably estimate the error rate.
  • Always 100%-audit certain populations: records completed under the alternative (remote) procedure, records migrated from a prior HRIS or paper file, and I-9s completed by an HR employee who has left.

If the sample turns up an error rate above ~5%, expand to a full audit. For each form in scope, capture employee ID, hire/termination dates, in-person vs. alternative procedure, who completed Section 2, and source system. This inventory becomes the spine of the audit.

Step 2: Build Your Error Inventory Against the New Substantive/Technical Line

The single most important change for 2026 is what counts as a substantive error. Several mistakes that were technical (and correctable in 10 days) under the 1997 Virtue Memorandum and 2008/2009 ICE guidance are now substantive — fineable on first inspection. Build your checklist around the new line, not the old one.

Substantive vs. technical at a glance

Error Section Classification (March 2026)
Missing date of birth Section 1 Substantive
Section 1 not signed or not dated by employee Section 1 Substantive
No citizenship/status box checked Section 1 Substantive
Missing date of hire Section 2 Substantive
Section 2 Certification not signed or not dated Section 2 Substantive
Missing employer/representative title Section 2 Substantive
Missing document title, issuing authority, number, or expiration Section 2 Substantive (photocopy carve-out eliminated)
Alternative procedure box not checked when remote exam was used Section 2 / Supplement B Substantive
Spanish-language Form I-9 used outside Puerto Rico Whole form Substantive
Preparer/translator name, address, signature, or date missing Supplement A Substantive
Missing rehire date Supplement B Substantive
Form I-9 version not current at time of completion Whole form Technical (10-day cure)
Missing "other last names used" or physical address Section 1 Technical (10-day cure)
Missing employee name at top of page 2 / Supplement A / Supplement B Various Technical (10-day cure)
Missing business name or physical address Section 2 Technical (10-day cure)
Missing email or phone number Section 1 Not a violation

For the full historical comparison of which errors moved and which prior memos established their original classification, see our regulatory companion article.

Run every form against the checklist

Walk each I-9 against every line above. Log each error with employee ID, field, classification, and a short description. Don't skip forms that "look fine" — the most common substantive error in our audits is a missing employer title, easy to miss because the rest of Section 2 looks complete.

"When teams run their first audit under the new ICE standards, the errors they're shocked by aren't the dramatic ones — they're the blank title field next to a perfectly signed Section 2, or the missing date of hire on a form completed by a manager who left two years ago," says Patricia Duarte, Director of Compliance at i9 Intelligence. "Those used to be 10-day fixes. They're not anymore. Build your checklist against the new line, not the muscle memory from prior audits."

Estimate Your Exposure Before You Start Correcting

Before you spend a week correcting forms, get a rough number on what the errors would cost if ICE found them first. Our I-9 Risk Calculator takes your headcount and an estimated error rate and returns a penalty range using the current Federal Register inflation-adjusted amounts. Two minutes, no signup. Use it to size the audit before you start, and again at the end to show leadership the dollars you eliminated.

Step 3: Categorize Each Error — Substantive, Technical, or Fixable in Place

After you have the full inventory, sort each error into one of three buckets so correction work in Step 4 is prioritized correctly.

  1. Substantive — no cure window. Penalty exposure on first inspection. Correct these first and document carefully (Step 4). Good faith correction does not erase the violation, but good faith is one of the five statutory factors ICE uses to adjust the base fine ±25% (along with business size, seriousness, involvement of unauthorized aliens, and prior violations).
  2. Technical — 10-day cure on inspection. Correct these now anyway. An uncorrected technical failure becomes substantive after the window closes.
  3. Not actually a violation. Some flags are cosmetic (a date in an unusual format that is unambiguous, a missing email/phone field that ICE explicitly does not treat as a violation). Note and move on.

For the substantive bucket, also note whether the error is fixable through correction (a missing date the employee can re-attest) or only fixable by completing a new Form I-9 (a never-signed Section 2 from years ago). Step 4 covers both.

Step 4: Apply the I-9 Correction Protocol

How you correct an I-9 matters as much as whether you correct it. Sloppy or undocumented corrections can themselves be treated as evidence of bad faith. Use the protocol below for every fix.

Standard correction rules

  • Draw a single line through the incorrect or missing entry. The original must remain legible.
  • Write the correct value next to or above the lined-out entry.
  • Initial and date the correction using today's date — never the date the original form was completed.
  • Never use white-out, correction tape, or eraser. Concealing the original entry can be treated as falsification.
  • Never backdate. The correction date must reflect when the correction was actually made. Backdating an I-9 correction is one of the few errors that can lift a case from civil paperwork penalty into criminal exposure.
  • Attach a brief signed memo explaining what was corrected, when, and by whom. This becomes part of the form's permanent record.

Who corrects what

  • Section 1 errors: only the employee can correct. If the employee has left, attach a memo documenting that the error was identified during a self-audit and the employee was unavailable.
  • Section 2 and Supplement B errors: the original completer corrects where possible. If that person has left, a current authorized representative corrects, signing and dating with today's date and noting the original completer.
  • Wholly missing or never-signed I-9: complete a new Form I-9 (current version), dated today. Do not destroy the original (if any) — attach the new form behind it with a memo.

For specific correction language by error type, see our guide to fixing I-9 mistakes.

Step 5: Audit Your Electronic I-9 System Against the 8 CFR § 274a.2 Standards

The March 2026 fact sheet explicitly classifies electronic I-9 system failures as substantive violations. If your I-9 software does not meet the standards in 8 CFR § 274a.2 subsections (e), (f), (g), (h), and (i), the system's failures may be treated as your violations — with no correction window. This step is often skipped because HR teams assume the vendor handles it. Many HCM-bundled I-9 modules do not fully meet the standards, particularly for audit trail documentation and migrated records.

Electronic system checklist

  • Audit trail: system records every create, view, edit, and delete action with timestamp and user ID. Pull a sample audit log and confirm.
  • Electronic signature: identity of signer is verified, signature is bound to the specific form, record cannot be altered after signing.
  • Indexing and retrieval: any specific I-9 can be produced in a reasonable time in legible format. Run a retrieval test on five random employees.
  • Storage integrity: records stored in a format that prevents alteration and provides for backup/recovery. Confirm with the vendor in writing.
  • Reproduction quality: legible paper copies on demand, including any attached document images.
  • Documentation: request a current SOC 2 report or equivalent compliance attestation from the vendor.

If migration was involved (records imported from a prior HRIS or paper), pay special attention to the audit trail. Imported records frequently lose the original creation timestamp and signing event metadata that the regulations require.

Step 6: Review Alternative Procedure (Remote Verification) Compliance

If your organization used the DHS-authorized alternative procedure to examine documents remotely on any of the I-9s in scope, two specific items are now substantive violations:

  1. The alternative procedure box in Section 2 (and Supplement B, if applicable) was not checked. The form looks complete, but without the box checked, ICE treats the remote examination as an unauthorized procedure.
  2. The employer was not an active E-Verify participant at the time the alternative procedure was used. Lapses in E-Verify enrollment — a missed renewal, a billing failure, an account suspension — invalidate every alternative-procedure I-9 completed during the lapse.

What to verify in this step

  • Pull every alternative-procedure I-9 in scope and confirm the box is checked on each.
  • Pull your E-Verify enrollment history and confirm continuous active participation across every date when the alternative procedure was used. Any gap is a substantive violation across every form completed during that gap.
  • Confirm document examination evidence — the regulations require a clear and legible copy of the documents examined during the live video call. Verify these copies are attached and readable.
  • If a third-party authorized representative (notary, remote verification service) was used, confirm their signature, title, and date are correctly recorded in Section 2.

For organizations with hires across multiple states or fully remote workforces, this is the highest-risk step. One E-Verify lapse can invalidate hundreds of forms at once.

Step 7: Document the Audit and Train Staff on the New Substantive Line

Two final actions turn a one-time clean-up into ongoing compliance.

Document the audit

Create a written audit summary covering scope, methodology, findings (errors by type), correction actions taken, system-level findings from Step 5, and remaining open items. Retain this with the working papers. If ICE later inspects, the documented self-audit is concrete evidence of good faith — one of the five statutory factors that adjusts the base fine.

Train staff on the new substantive line

The 2026 reclassification means anyone completing your I-9s needs updated training on:

  • The errors that are no longer correctable in 10 days (use the Step 2 table as the reference)
  • What "good completion" looks like for the fields most often missed: date of birth, citizenship status box, date of hire, employer/representative title, Section 2 Certification signature and date
  • When the alternative procedure applies and how to mark the box correctly
  • The correction protocol from Step 4

Run the training within 30 days of completing the audit, document attendance, and add a refresher to the annual compliance calendar.

Penalty Exposure: What These Errors Actually Cost

For first-offense paperwork violations, the current civil penalty range is $288 to $2,861 per Form I-9, set by the 2026 Federal Register inflation adjustment. The exact amount depends on the violation percentage and the five statutory factors. Second and third-offense ranges are higher — see our 2026 I-9 penalty guide.

The math compounds. An organization with 1,000 I-9s and a 10% substantive error rate is exposed to $29K–$286K on first offense before adjustments. A thorough self-audit costs a fraction of that.

Common Questions About I-9 Self-Audits in 2026

How often should we self-audit?

At minimum, once a year. Add an out-of-cycle audit after a regulatory change like the March 2026 reclassification, a migration to a new HRIS or I-9 system, the departure of the HR person running I-9s, or an acquisition that brought I-9s onto your records.

Do we have to disclose self-audit findings to ICE?

No. There is no obligation to proactively report findings. If ICE later inspects, the corrected forms and audit documentation become part of the record at that point.

Can our payroll provider or HCM run the audit for us?

Some can run a basic field-completeness scan, but few are tracking the March 2026 substantive line. Give any vendor this checklist explicitly and confirm in writing which classification framework they are using. Audits run against the pre-2026 framework will systematically understate substantive error rates.

What about errors on I-9s for terminated employees?

Section 1 errors cannot be corrected once the employee has left (only the employee can correct Section 1). Document the finding in the audit summary and attach a memo to the form. Section 2 and Supplement B errors can still be corrected by a current authorized representative — see Step 4.

Get Help Running Your I-9 Self-Audit

If your team does not have the capacity or regulatory depth to run this audit against the new ICE standards, our compliance team will run it for you. i9 Intelligence's I-9 audit service reviews every form in scope against the March 2026 substantive/technical line, delivers a corrective action report with specific remediation language for each error, and can run the Step 5 electronic system review against your current vendor. Schedule a free compliance call to scope the audit, or use the Risk Calculator to estimate your exposure first.

27+ years of dedicated I-9 and E-Verify expertise. Under the new standards, the audit is not optional — the choice is whether you find the errors first or ICE does.