What Happens During an ICE I-9 Audit: From NOI to Final Order

Software & Technology
Risk Management
1
minutes to read
An HR director seated at her desk reading an official-looking letter held in both hands, manila folders and reading glasses on the desk, late-afternoon office light from a window — representing the moment of receiving an ICE Notice of Inspection

An ICE I-9 audit usually starts the same way: an HR director walks into the office Monday morning, sees a Notice of Inspection on the front desk, and has roughly three business days to produce every Form I-9 the company is required to keep on file. What happens between that envelope and the final outcome — compliance letter, settlement, or final order — is set by a sequence of regulations, notices, and deadlines that most HR teams will only encounter once.

This article is the timeline. It covers what the NOI looks like, what ICE expects in the production, what the four possible findings letters mean, how the narrower 10-day cure window works after March 2026, and how penalty amounts are actually calculated when a Notice of Intent to Fine arrives. If you received an NOI this week, start with Section 1. If you are preparing before you ever need it, read straight through — the companion self-audit playbook covers what to do before ICE shows up.

Notice of Inspection: Day 0

The audit clock starts when ICE serves a written Notice of Inspection (NOI). There are three delivery methods, and each has the same legal effect.

  • In-person service. An ICE Homeland Security Investigations (HSI) agent hands the NOI to an owner, senior officer, designee, or registered agent. This is the most common method for larger employers and any inspection tied to a worksite visit.
  • Certified U.S. mail, return receipt requested. The NOI arrives in an envelope addressed to the business. The clock starts on the date the company receives it, not the date it was mailed.
  • Administrative subpoena. If ICE wants the records faster, or believes the employer will resist, the agency can issue an administrative subpoena under 8 U.S.C. § 1324a(e)(2). A subpoena can compel production without the standard 3-day notice.

The NOI itself is short — usually one to two pages. It identifies the employer, names the inspecting agent, sets the date and location for production, and lists the records ICE expects to review. Per long-standing USCIS guidance on I-9 inspections, employers generally receive at least 3 business days between the NOI and the production deadline.

What ICE asks for in the NOI

The exact request varies, but the standard package includes:

  • All Forms I-9 (current employees and any terminated employees still inside the retention window — the longer of 3 years from hire or 1 year from termination)
  • A current payroll list with hire dates
  • A list of new hires and terminations for the retention period
  • The employer's business license, articles of incorporation, or equivalent
  • Owner and officer information
  • E-Verify enrollment records if applicable
  • If using an electronic I-9 system: the system name, vendor, and audit-trail documentation

What to do first — before you touch a single I-9

The single biggest mistake employers make in the first 24 hours is trying to clean up the I-9s before ICE sees them. Do not. Backdating a correction, using white-out, refiling a never-signed I-9 as if it had been completed on time, or destroying any record — even a draft — can convert a civil paperwork case into a criminal one. The corruption-of-evidence trap is the most expensive mistake an HR team can make in an audit.

What you should do, in order:

  1. Lock down the records. No edits, no corrections, no refiles. Freeze the file room and the electronic system.
  2. Notify legal counsel. An immigration or employment attorney should be on the call within hours, not days. They will review the NOI for scope and decide whether to request an extension.
  3. Identify the audit team. One HR records lead, one payroll lead, and one IT contact if the I-9s live in an electronic system. Keep the circle small.
  4. Consider an extension. Most ICE field offices grant a written extension of 7 to 14 additional days if requested promptly. Counsel makes the request, in writing, citing the volume of records or the need to retrieve archived files.

"Every time I have seen an audit go badly in the first week, it is because someone went into the file room with a pen," says Patricia Duarte, Director of Compliance at i9 Intelligence. "The worst civil paperwork case is still better than a backdated correction that ICE finds in the audit trail. Lock the records, call counsel, then call us."

Preparing Your Production: 3 Business Days

Once the records are frozen and counsel is engaged, the production work begins. The output is a clean, indexed, complete set of records that exactly matches what the NOI requested — nothing more, nothing less.

What you legally must provide

  • Every Form I-9 in scope, including originals and any attached document copies your company chose to retain
  • Supporting payroll and hire/termination lists sufficient to confirm the I-9 universe is complete
  • Electronic system records in legible form, including the audit trail. Under 8 C.F.R. § 274a.2, if records are stored electronically, you must also provide the hardware, software, and personnel needed for ICE to inspect them on site

What you can and should not include

  • Do not include I-9s outside the retention window. A Form I-9 for an employee terminated 5 years ago is no longer a required record. Producing it expands the audit unnecessarily.
  • Do not include personnel files, performance reviews, or unrelated HR records. The NOI is narrow; the production should be too.
  • Do not produce I-9s you cannot locate. If a form is genuinely missing, document the search and note the missing form in a cover memo. A missing I-9 is a substantive violation, but fabricating one is criminal.

Internal coordination

The HR records lead pulls and indexes the I-9s. Payroll generates the current employee list and the new-hire and termination list for the retention window. IT pulls the electronic system audit trail and confirms it covers the full period. Counsel reviews the package before it leaves the building. Every document that goes to ICE should be logged with a date stamp and a copy retained.

The Audit Itself: On-Site or Off-Site Review

ICE chooses where the inspection happens. Most audits are conducted at an ICE field office — the employer ships or hand-delivers the records and ICE reviews them off-site. For larger employers, especially those with electronic I-9 systems, the agent may conduct the inspection at the employer's office with the audit team available to answer questions and retrieve additional records.

What ICE is looking for

The inspecting agent walks each Form I-9 against the substantive-vs-technical checklist in the March 2026 ICE Inspection Fact Sheet. Several errors that used to be technical — and therefore correctable in 10 days — are now substantive, with no cure window. The full list is in our regulatory companion article, and the practical implications for self-audits are in the self-audit playbook.

Electronic system review

If the company uses an electronic I-9 system, the agent will also evaluate the system itself against 8 C.F.R. § 274a.2 subsections (e), (f), (g), (h), and (i): electronic completion, retention, documentation, security, and electronic signatures. An electronic system that fails these standards is itself a substantive violation, with no correction window. This is one of the most overlooked areas in audits of HCM-bundled I-9 modules, where audit-trail and migrated-record metadata frequently fall short of the regulatory requirements.

Your right to representation

You have the right to have legal counsel present during any on-site review and during any communication with the inspecting agent. You can also bring an I-9 specialist — an outside compliance consultant or audit firm — to help interpret findings as they emerge. Bring both. Counsel handles the legal posture; the specialist handles the form-by-form technical questions.

Get Help Through an ICE I-9 Audit

If your team is in the middle of an audit and needs an experienced compliance partner alongside counsel, our team can step in. i9 Intelligence's I-9 audit services include audit-defense support: we work alongside your attorney, review every form against the current substantive-technical line, prepare correction packages, and respond to follow-up document requests from ICE. Schedule a free compliance call or call our compliance team directly at (713) 668-6200.

The Four Possible Findings Letters

After ICE finishes the inspection, the employer receives one of four findings letters — and many audits produce more than one. Each has a different meaning and a different response window.

Findings Letter What It Means Response Window
Notice of Inspection Results (compliance letter) No violations found. Audit closed. None
Notice of Suspect Documents ICE has determined that documents presented by specific employees do not relate to the employee or are not valid. The employer must take action with the named employees. Typically 10 business days to respond
Notice of Technical or Procedural Failures Errors that remain technical under the March 2026 fact sheet were found and can be corrected. Uncorrected technical failures become substantive after the window closes. At least 10 business days to correct
Notice of Discrepancies ICE cannot determine an employee's work eligibility based on the records. The employer must give the employee a copy and an opportunity to address the discrepancy. Varies by notice
Warning Notice Substantive violations were found but ICE has elected not to fine. Available only on a first offense, with no fraud and a reasonable expectation of future compliance. None — but next inspection will not get a second warning
Notice of Intent to Fine (NIF) Substantive violations were found and ICE is assessing a civil penalty. The notice lists the specific violations and the proposed fine amount. 30 days from receipt to pay, settle, or request a hearing

A Warning Notice will not be issued if any of the following are true: the employer has a prior Warning Notice or NIF on file, the employer failed to correct technical failures from a prior inspection, the employer failed to prepare or present I-9s, or there is evidence of fraud or backdating. In any of those scenarios, ICE moves directly to the NIF.

The 10-Day Technical Cure Window — Smaller Than It Used to Be

If you receive a Notice of Technical or Procedural Failures, you have at least 10 business days to correct the listed errors. Submit the corrected forms to the same ICE agent named on the NOI, with a brief cover memo explaining what was corrected and when. Corrections that arrive after the window closes — without a written extension — convert the technical failures into substantive violations and are added to the penalty calculation.

The important caveat for 2026: the cure window is significantly smaller than it was a year ago. Several common errors that used to be technical — missing date of birth, missing date of hire, undated Section 1 or Section 2 Certification, missing employer title, missing rehire date, Spanish-language I-9 used outside Puerto Rico, preparer/translator errors — were reclassified as substantive in the March 2026 fact sheet. Those errors no longer get a 10-day window at all. They appear directly in the substantive count that drives the NIF. The full reclassification is in our regulatory companion article.

Two practical rules apply when you do get a cure notice:

  • 10 calendar business days, no automatic extensions. Need more time? Request it in writing from the named agent before the window closes. Most field offices grant short extensions if asked early; none will accept late corrections without one.
  • Use the I-9 correction protocol. Single line through the error, correct value, current date, current initials, and a brief memo. Never use white-out, never backdate. The guide to fixing I-9 mistakes has the specific correction language by error type.

Notice of Intent to Fine: Settlement vs. Hearing

The Notice of Intent to Fine (NIF) is the penalty notice. It lists each substantive violation and uncorrected technical failure, applies the fine formula at 8 C.F.R. § 274a.10, and states the total proposed penalty. From the date of receipt, the employer has 30 days to do one of three things: pay the proposed fine, negotiate a settlement, or file a written request for a hearing before the Office of the Chief Administrative Hearing Officer (OCAHO).

Why most cases settle

Most NIFs are resolved by settlement before a hearing date is set. Settlement gives the employer faster resolution, lower legal cost, no published OCAHO decision on the public record, and a real opportunity to negotiate the dollar amount based on documented good faith and any errors in ICE's calculation. The employer's counsel typically opens settlement conversations with the assigned ICE attorney within the first two weeks after the NIF.

What drives the negotiation

The proposed fine in the NIF is not a final number. It is the output of a formula the parties can both inspect, dispute, and adjust within the statutory range. Two levers move it:

  1. The violation percentage. ICE calculates the percentage by dividing substantive violations (plus uncorrected technical failures) by the total number of I-9s that should have been presented. The percentage tier (0–9%, 10–19%, 20–29%, 30–39%, 40–49%, 50%+) determines the base fine per violation. Misclassified errors, double-counted forms, or I-9s outside the retention window can all reduce the percentage if challenged.
  2. The five statutory factors. Under 8 C.F.R. § 274a.10(b)(2), ICE adjusts the base fine by up to ±5% for each of: business size, employer good faith, seriousness of the violation, involvement of unauthorized aliens, and history of prior violations. Cumulative adjustment ranges up to ±25%. Documented self-audits, written I-9 procedures, training records, and an electronic I-9 system are the evidence that supports a downward good-faith adjustment.

For the full penalty math by tier, including the current paperwork, knowing-hire, and document-fraud ranges, see our 2026 I-9 penalty guide.

The OCAHO Hearing Path

If settlement is not on the table — or the employer disputes the underlying violations rather than the dollar amount — the next step is a hearing before an Administrative Law Judge (ALJ) at OCAHO. OCAHO is part of the Department of Justice's Executive Office for Immigration Review (EOIR), and proceedings are governed by 28 C.F.R. Part 68.

The hearing path makes sense in a few specific situations:

  • The facts are in dispute. ICE has misclassified errors, double-counted forms, or relied on records the employer believes are inaccurate.
  • The fine is large enough to justify the legal cost. OCAHO matters can run 12 to 24 months and require sustained legal investment.
  • A precedent matters. The employer is part of a broader enforcement pattern and wants a published decision rather than a confidential settlement.

What the OCAHO process looks like

  1. Request for hearing. Filed within 30 days of NIF receipt, per 28 C.F.R. Part 68.
  2. Complaint and answer. ICE files a formal complaint; the employer files an answer and any affirmative defenses.
  3. Pre-hearing motions and discovery. Document exchange, depositions where applicable, motions on classification of errors.
  4. Hearing. Held before an ALJ. Documentary evidence and witness testimony.
  5. Decision and order. The ALJ issues a written decision. OCAHO has historically been willing to reduce penalties when an employer documents good faith and contests specific factors. Decisions can be appealed to the Chief Administrative Hearing Officer; some can be further appealed to a federal circuit court.

What Drives Final Penalty Amounts — The Math

For first-offense paperwork violations, the current civil penalty range is $288 to $2,861 per Form I-9, set by the most recent Federal Register inflation adjustment under 8 C.F.R. § 274a.10. Knowing-hire violations are far higher: $716 to $5,724 per worker on first offense, with second and third offenses ranging higher. Document fraud under INA § 274C runs $590 to $4,730 per document on first offense and $4,730 to $11,823 per document on subsequent offenses. The full schedule and the underlying Federal Register citation are in our 2026 I-9 penalty guide.

A worked example

Consider a mid-size employer with 100 employees, no prior violations, and a 30% substantive error rate identified during the audit. The fine builds in three steps.

  1. Count the violations. 100 I-9s × 30% = 30 substantive violations.
  2. Apply the per-violation base fine. A 30–39% violation rate places the employer in the corresponding tier of the ICE fine matrix. Within the paperwork range of $288 to $2,861, ICE selects a base amount tied to the tier — for example, a mid-range base of around $1,800 per violation. 30 × $1,800 = $54,000 base fine before adjustments.
  3. Apply the five statutory factors. Each factor adjusts the base ±5%, cumulatively up to ±25%. A mid-size business with documented good faith (self-audit, training, written I-9 procedures), no involvement of unauthorized workers, and no prior violations might earn a -15% net adjustment. $54,000 × 0.85 = approximately $45,900 proposed fine.

Now consider the same scenario without the good-faith evidence — no documented self-audit, no training records, no written procedures. The same employer with a +10% net adjustment moves to roughly $59,400 — a $13,500 swing on the same underlying error count. The exposure is not abstract. The current I-9 Risk Calculator applies the same logic to your headcount and error rate in 60 seconds.

The broader enforcement context

ICE's audit volume in 2025–2026 ran at roughly 10× the 2024 rate, with new funding for 10,000 additional officers and active data-sharing agreements with the IRS. The full enforcement timeline, including industry-targeted actions, is in our ICE Worksite Enforcement Tracker. The practical implication: the audit math compounds across more inspections, and good-faith evidence built before the NOI arrives is what moves the dollar amount most.

Common Questions About ICE I-9 Audits

How long do I have to respond to an NOI?

Employers generally receive at least 3 business days between the NOI and the production deadline. Most ICE field offices will grant a written extension of an additional 7 to 14 days if requested promptly through counsel. The 3-day rule does not apply when ICE proceeds by administrative subpoena under 8 U.S.C. § 1324a(e)(2).

Can ICE show up without notice?

For a civil I-9 paperwork inspection, ICE almost always serves a written NOI first — either in person or by certified mail. What people sometimes call an "ICE raid" is a different event: a criminal worksite operation conducted by Homeland Security Investigations, usually under a judicial warrant or in cooperation with other agencies. Raids are about workers and criminal investigations; civil I-9 audits are about paperwork. The two can be related — a raid can trigger a follow-up I-9 audit, and vice versa — but they are governed by different rules.

Should we have an attorney present during the audit?

Yes. Immigration or employment counsel should be involved from the moment the NOI is received and present for any on-site review or substantive conversation with the inspecting agent. An I-9 compliance specialist alongside counsel adds form-by-form technical depth that most general-practice attorneys do not carry day to day.

What is the difference between an I-9 audit and an ICE raid?

An I-9 audit is a civil paperwork inspection initiated by an NOI under INA § 274A. The agency is looking at Forms I-9 and supporting records, and the outcome is a civil fine or compliance letter. An ICE raid is a criminal worksite enforcement operation, typically conducted by HSI agents with a warrant, focused on apprehending unauthorized workers and investigating the employer for criminal violations. An audit can escalate into a raid if patterns of knowing hire emerge; a raid can be followed by an audit. The two are distinct legal proceedings.

Can we negotiate the penalty in the NIF?

Yes, and most employers do. The 30 days after NIF receipt is the negotiation window. Counsel typically opens settlement discussions with the assigned ICE attorney within the first two weeks. Negotiation can address the violation percentage (by disputing how individual errors were classified), the base fine within the statutory range, and the five statutory factors. Documented good-faith evidence — self-audit reports, training records, written I-9 procedures, electronic system implementation — is the single biggest factor in moving the dollar amount down.

What if we find errors during the 3-business-day window?

Do not correct them during the production window. Any correction made after the NOI is served carries a high risk of being treated as evidence of bad faith, particularly if the correction is undated, lacks initials, or appears to predate the NOI. Document the errors you find, flag them in a memo to counsel, and address them after the inspection concludes through the normal correction protocol or the technical-failure cure window, if one is granted.

Do we have to keep records for terminated employees?

Yes, for a limited time. Federal law requires retention of a Form I-9 for the longer of 3 years from the date of hire or 1 year from the date of termination. Records inside that window must be produced in response to an NOI. Records that have aged out of the retention window do not need to be produced — and should not be, to avoid expanding the audit scope.

Get Help Through an ICE I-9 Audit

If you have just received a Notice of Inspection, the next 72 hours matter more than the next 72 days. i9 Intelligence's I-9 audit services work alongside your legal counsel to manage the production package, review every form against the March 2026 substantive-technical line, prepare correction packages where allowed, evaluate your electronic I-9 system against 8 C.F.R. § 274a.2, and respond to follow-up requests from the inspecting agent. Schedule a free compliance call to scope audit support, or use the Risk Calculator to size your current exposure.