I-9 Self-Audit & E-Verify Playbook: Mid-Year 2026 Guide

What Is an I-9 Self-Audit, and Why Run One Mid-Year?

An I-9 self-audit is a voluntary internal review in which you check your own Form I-9 records against the rules, then correct what you find — before Immigration and Customs Enforcement (ICE) ever asks to see it. Think of it as a mid-year health check for the one form every U.S. employer must complete for every hire.

Here’s why the timing matters. When ICE serves a Notice of Inspection, you get at least three business days to hand over your forms. That is not enough time to fix years of small mistakes. A self-audit moves that work to a moment you control.

The mid-year point is a natural checkpoint. You are far enough into 2026 to catch this year’s onboarding errors while they are fresh. There is also still runway to close gaps before year-end hiring and the next enforcement cycle.

This guide is the hub for ImmiOne’s I-9 coverage. It walks the full lifecycle — the rules, the self-audit steps, and safe correction. When you want the detail on what happens when penalties land, it links out to a deeper read on the rising I-9 audit penalties employers now face.

The Legal Foundation: What Form I-9 Requires

Before you audit anything, it helps to know the standard you are auditing against. Form I-9 exists because federal law requires employers to verify both the identity and the work authorization of everyone they hire. The employer and the employee each attest, under penalty of perjury, on the form itself.

The clock is the part most teams get wrong. So it is worth stating plainly.

The completion deadlines

The rules set two hard deadlines, and they do not move.

• Section 1 — the employee’s part. The employee completes Section 1 at the time of hire. That means their first day of work for pay, not the offer date and not a week later.
• Section 2 — the employer’s part. You examine the employee’s documents and complete Section 2 within three business days of the hire.

One exception trips people up. If someone is hired for fewer than three business days, Section 2 has to be done at the time of hire. In that case you also cannot accept a receipt in place of a real document.

The retention rule

Keeping the form is a legal duty of its own. The regulations require each Form I-9 to be retained for three years after the date of hire, or one year after employment ends — whichever is later. That formula is a moving target. So a good chunk of any I-9 self-audit is simply confirming you still hold a form for everyone who belongs in the set.

In plain terms, most I-9 problems are timing and paperwork problems, not fraud. That is reassuring, because timing and paperwork are exactly what a steady internal review can catch and fix.

E-Verify and Remote Document Examination

E-Verify sits next to the I-9, and the two are easy to confuse, so let’s separate them. Form I-9 is the paperwork every employer must complete. E-Verify is an optional online step that checks that paperwork against government records.

More precisely, E-Verify is an internet-based system that compares Form I-9 information against records held by the Department of Homeland Security and the Social Security Administration. Its purpose is to confirm the employee’s work eligibility. For most private employers it is voluntary, though some federal contractors and certain state laws require it.

Who must use E-Verify, and who chooses to

Voluntary does not mean universal. Federal contractors and subcontractors whose contracts carry the FAR E-Verify clause are required to enroll. The deadlines are specific: enroll within 30 calendar days of contract award, then verify new hires within three business days of their start date. Several states also mandate E-Verify. So the first I-9 self-audit question is simple: does any contract or state rule already obligate your organization? If so, enrollment and consistent use are compliance items, not options.

Enrollment itself runs through a memorandum of understanding (MOU) with DHS. Staying “in good standing” means following that MOU — and, as the next section shows, good standing is the condition for remote verification.

What happens when E-Verify flags a mismatch

Most cases confirm work authorization within seconds. Sometimes, though, the system returns a result indicating that further action is needed to complete the case — commonly called a Tentative Nonconfirmation, or TNC. A TNC is not a finding that the employee is unauthorized. It means the Form I-9 data did not match the government records on the first pass, often for an innocent reason like a name change or a data-entry slip.

The employee then gets a chance to resolve the mismatch, and the process is time-sensitive on both sides. Mishandling a TNC — acting too soon, or logging it inconsistently — is where employers most often create discrimination exposure. So the detailed TNC workflow is a topic in its own right, and ImmiOne treats it as a dedicated companion piece rather than a footnote here. For the self-audit, the checkable item is narrower. Confirm that your team actively works any open E-Verify cases, never lets them expire, and applies the same TNC steps to everyone.

Why enrollment status matters for remote hires

E-Verify enrollment also carries a practical benefit. Since August 1, 2023, employers may use an optional alternative procedure to examine I-9 documents remotely, over a live video call. But there is a condition worth flagging. That remote option is available only to employers who are enrolled in E-Verify and participating in good standing.

So for teams that hire remote or distributed workers, E-Verify status is not a side detail. It decides whether your remote onboarding is even permitted under the alternative procedure. The procedure also comes with its own paperwork rule: an employer using it has to retain a clear and legible copy of the documents the employee presented, front and back. That single requirement is a frequent I-9 self-audit gap.

A self-audit is a good moment to confirm you are using the remote option correctly. Check that the retained document copies and the live-video examination are on file for every remote hire processed this way. If they are not, the fix is straightforward: move those hires back to in-person examination, or confirm your enrollment is active and the copies are stored before the next remote start date.

How to Run an I-9 Self-Audit, Step by Step

Here is where the playbook gets practical. An I-9 self-audit does not need to be complicated — it needs to be consistent and non-discriminatory. The steps below give you a repeatable sequence your team can run each cycle.

Step 1 — Build the roster and the form set

Start by pulling a current list of everyone on payroll, then match it against your Form I-9 records. The goal is simple: one valid, complete form for every active employee, plus every terminated employee still inside the retention window. Missing forms are the first thing to flag, because a missing I-9 is a substantive problem, not a technical one.

Step 2 — Review each form against the rules

Next, check each form for the errors that actually get cited. A short list covers most of them.

• Section 1 gaps — missing signature, missing date, no status box checked, or an “A-number” left blank when the status requires one.
• Section 2 gaps — documents not recorded, the wrong document combination, or a missing employer signature and title.
• Timing evidence — dates that suggest Section 2 was completed well past the three-business-day window.
• Reverification misses — expired work authorization that was never reverified by the deadline.

Step 3 — Confirm reverification is current

Reverification has its own deadline: it must happen no later than the date the employee’s work authorization expires. So build a simple tickler from your audit findings. When you spot an authorization expiring in the next few months, you have time to plan the reverification well ahead rather than scrambling on the expiry date.

Step 4 — Log, correct, and document

Finally, record what you found, correct it using the method in the next section, and keep a short memo describing the audit’s scope and date. That memo is your good-faith evidence — proof that you looked, and that you fixed what you saw.

How to Correct I-9 Errors Without Creating New Ones

Correcting an I-9 is where well-meaning teams often stumble, because the instinct is to make the form look clean. Resist that instinct. The rules reward transparency, not tidiness.

The DOJ and DHS guidance for internal I-9 audits describes a correction method built around visibility. Whoever made the original entry is the one who fixes it. The employee corrects Section 1, and you correct Section 2. To fix an error, draw a single line through the wrong information, enter the correct information, then initial and date the change. The old entry stays readable underneath.

What never to do

Three moves turn a small paperwork error into a serious problem.

• Never backdate. Enter the real date of the correction, even if it is long after the original.
• Never erase, white out, or conceal. A hidden change reads as an attempt to deceive.
• Never fill in an employee’s Section 1 for them. That part is theirs to complete and sign.

Sometimes a form has so many errors that corrections would make it unreadable. The common approach then is to complete a new Form I-9, attach it to the original, and write a brief note explaining why. In plain terms: fix mistakes in the open, date them honestly, and keep the paper trail. An honest correction protects you; a concealed one does the opposite.

What an ICE I-9 Inspection Actually Looks Like

Understanding the inspection process takes the fear out of it, because the timeline is more predictable than most people expect. Knowing the sequence tells you exactly what a self-audit buys you.

An inspection begins when ICE’s Homeland Security Investigations serves a Notice of Inspection (NOI). From there, you receive at least three business days to produce the requested Forms I-9. If the review finds technical or procedural failures, you get at least 10 business days to correct them. After that window, uncorrected technical failures become substantive violations — and substantive violations carry fines.

From findings to a fine

If ICE decides to penalize, it serves a Notice of Intent to Fine (NIF). At that point you may request a hearing before an Administrative Law Judge at the Office of the Chief Administrative Hearing Officer (OCAHO). That request has to be made within 30 calendar days of receiving the NIF. Miss it, and ICE issues a Final Order with no appeal — so the calendar entry matters as much as the legal argument.

Notice the pattern in all of these numbers: three days, 10 days, 30 days. Each one is short. That is the whole case for auditing yourself now. When you have already found and fixed your own gaps, an NOI becomes a document-production task instead of an emergency.

Where the Exposure Sits in Dollars

It helps to see the actual figures, because they turn an abstract risk into something you can plan around. ICE builds a penalty by dividing the number of violations by the number of I-9s that should have been presented. That violation percentage sets a base fine. The fine is then adjusted up or down by 5% for each of five factors, for a total swing of plus-or-minus 25%.

The dollar ranges below are the current civil penalties under federal regulation.

Five factors move the fine. They are the size of your business, your good faith, the seriousness of the violation, whether the worker was unauthorized, and your history of prior violations. Good faith is the one you can build on your own schedule.

In plain terms, a documented self-audit is direct evidence of good faith. And good faith can pull the fine toward the low end of every range above. For the full breakdown of how these penalties have shifted, see ImmiOne’s companion analysis of the rising I-9 audit penalties employers now face.

Common Pitfalls in an I-9 Self-Audit

Even a well-run I-9 self-audit can go sideways in a few predictable ways. Knowing them in advance keeps your review clean.

• Auditing selectively. Reviewing only certain employees — by national origin, citizenship status, or team — creates a discrimination problem of its own. Audit the whole set, or a neutral random sample, on consistent criteria.
• Over-documenting. Asking for more or specific documents than the rules require is its own violation. Accept any valid document the employee chooses to present.
• Fixing forms into unreadability. Layered corrections that bury the original entry defeat the purpose. When a form is too far gone, redo it and attach the original.
• Treating a receipt as permanent. A receipt for a lost or stolen document is temporary. The replacement generally has to be presented within 90 days of hire. So track those dates.

The contrarian point most teams miss

Here is the counterintuitive part: a self-audit that finds nothing is often the least reassuring result. A genuinely clean review of a large I-9 population is rare. So a “zero errors” outcome usually means the review was too shallow, not that the records were perfect. A thorough audit that surfaces a handful of fixable timing errors is doing its job. Finding problems is the point. Each one you correct now is one that cannot be cited later.

How ImmiOne Delivers Audit-Ready Employee Onboarding and I-9 Compliance

Once you have run a manual self-audit, the natural question is how to keep the records clean between reviews without the same manual effort each cycle. That is the operational gap ImmiOne is built to close.

ImmiOne’s HROne platform handles the employee lifecycle for organizations. That includes electronic Form I-9 completion for on-site and remote hires, self-auditing I-9 reports, and reminders that surface reverification dates before they pass. The outcome most teams feel first is a quieter inbox. Fewer last-minute expiry scrambles, and a record set that stays audit-ready by default rather than through a year-end push. more info about ImmiOne’s HROne.

Across the platform, ImmiOne’s reporting gives teams a running view of where records stand. So the mid-year self-audit becomes a confirmation step instead of a rescue mission. Human judgment still drives every call; the platform removes the manual tracking that causes most avoidable errors. If your team also manages worksite obligations like the Public Access File, the same audit-readiness discipline applies. ImmiOne covers that in its guide to H-1B Public Access File rules.

Frequently Asked Questions

More on E-Verify and retention

References

• 8 CFR 274a.2 — Verification of identity and employment authorization — Form I-9 completion deadlines, receipts, reverification, electronic I-9, and the three-year/one-year retention rule.
• 8 CFR 274a.10 — Penalties — Current civil and criminal penalty schedule for paperwork and knowing-hire violations.
• 8 U.S.C. 1324a — Unlawful employment of aliens (INA §274A) — Statutory basis, attestation under penalty of perjury, and the good-faith / 10-business-day correction provision.
• ICE — Form I-9 Inspection Overview — Notice of Inspection, technical vs. substantive violations, Notice of Intent to Fine, OCAHO hearings, and the enhancement matrix.
• Federal Register — Optional Alternatives to the Physical Document Examination (Form I-9) — Effective August 1, 2023; the E-Verify enrollment condition for remote document examination.
• USCIS — Handbook for Employers (M-274) — Official guidance on completing, correcting, and retaining Form I-9, including how to correct Section 1 and Section 2 errors.