Hiring complianceRead at source, 24 September 2026

I-9 Audit Guide: How to Self-Audit, What Happens in an ICE Inspection, and 2026 Penalties

An I-9 audit is either an internal review you choose to run or an ICE inspection that starts with a Notice of Inspection and gives you at least three business days to produce your forms. For an internal audit, review all forms or a neutral sample, have employees correct Section 1, correct Sections 2 and 3 yourself by striking through, initialing and dating, attach a signed explanation, and never backdate. Paperwork penalties are $288 to $2,861 per form, and knowingly hiring or keeping an unauthorized worker costs $716 to $28,619 per worker depending on the offense. Those are the 2025 inflation-adjusted amounts, and there is no 2026 increase.

What an I-9 audit is, and the two kinds you can face

“I-9 audit” means two different things. An internal audit is one you choose to run on your own Forms I-9, on your own schedule. A Form I-9 inspection is the government version: Homeland Security Investigations (HSI), part of ICE, serves a Notice of Inspection and you have at least three business days to hand the forms over. The first is how you find and fix problems. The second is where problems turn into fines.

No law requires the internal kind. The joint guidance ICE and the Justice Department published on internal Form I-9 audits opens with exactly that: “While not required by law, an employer may conduct an internal audit of Forms I-9 to ensure ongoing compliance.” It also warns that penalties can still be imposed after you have audited. An audit does not wipe the slate. What it does is shrink the number of bad forms an inspector would find, and show good faith, which is one of the five factors in setting a fine.

This page covers the audit and the inspection. The form itself, section by section, the deadlines for Sections 1 and 2, and which edition to use are on our Form I-9 requirements page. Which documents a new hire may present is on work authorization.

How to run an internal I-9 audit, step by step

1. Decide the scope before you open a file

   You can review every Form I-9 or a sample. The guidance allows either: “An employer may choose to review all Forms I-9 or a sample of Forms I-9 selected based on neutral and non-discriminatory criteria.” A neutral sample means one location, one hire-date range, every tenth form, or everyone hired by one onboarding team. It never means the employees whose names, accents or documents made someone suspicious. The guidance adds that you should consider whether the audit could be seen as discriminatory or retaliatory “based on its timing, scope or selective nature.” An audit launched the week after a union drive or a wage complaint invites that question.

2. Build the list of forms that should exist

   Pull payroll for everyone hired since your retention window began, active and terminated. Every person on it should have a form, unless they left long enough ago that the form could lawfully be purged. The retention rule in 8 CFR 274a.2(b)(2) is three years after the hire date or one year after employment ends, whichever is later. Matching payroll to forms is what surfaces the worst problem an audit can find: a person with no form at all.

3. Tell employees what is happening

   The guidance recommends telling employees in writing that you are auditing, why, what the scope is, and whether it is your own review or a response to a government request. When you find a problem with someone’s form, tell that person privately, show them the form and the problem, and use a language they understand. Give them a named contact for questions.

4. Review each form against the rules in force when it was completed

   A form is judged by the rules that applied on the day it was filled in, not today’s. The guidance says employers “should not assume documentation in Section 2 of the Form I-9 is insufficient simply because it does not satisfy current Form I-9 rules.” Check that each section is complete and signed and dated, that Section 2 was done on time, that the documents recorded were acceptable then, and that reverification happened where a work authorization expired.

5. Correct what can be corrected, the right way

   The correction rules are in the next section. The short version: the employee fixes Section 1, you fix Section 2 and 3 (now Supplement B), you strike through and initial rather than erase, you attach a signed and dated memo, and you never backdate.

6. Handle document problems without discriminating

   If an employee has to present documents again, you may say a particular document cannot be reused, but “the employer should not request specific documents.” Give a reasonable amount of time, judged case by case. The guidance says the 90-day figure from the old no-match safe harbor “was rescinded” and that ICE’s 10-day window applies only after an ICE Notice of Suspect Documents, not to internal audits.

7. Write it up and keep the records apart

   Record what you reviewed, how you chose it, what you found and what you did. Keep the audit memo and working papers separate from the forms themselves, so an inspector receiving the forms gets the forms. If counsel ran the audit, ask them how to handle privilege.

How to correct Form I-9 errors (and what never to do)

USCIS and the joint guidance give the same method. The table sets out who corrects what.

Blanket re-dos are risky. Asking every current employee to fill in a new Form I-9 “without regard to whether a particular Form I-9 is deficient” may raise discrimination concerns, the guidance says, unless there is reason to believe systematic problems undermine all your forms, or you are dealing with an acquisition or merger.

E-Verify users. If the audit shows you missed creating an E-Verify case by accident, create it now. If you enrolled but deliberately did not use the system for a period, do not go back and create cases for those hires. If you find someone was fired after a tentative nonconfirmation they were contesting, consider offering re-employment. Which states require E-Verify, and for whom, is on our E-Verify requirements by state page.

When the audit turns up someone who is not work-authorized

This is the part of an audit that carries the largest fines, because it moves from paperwork to knowledge. Once you know, or should have known, that an employee is not authorized to work, continuing to employ them is a violation charged per worker. The regulations define “knowing” to include knowledge that can be “fairly inferred” from facts that would lead a person exercising reasonable care to know.

The guidance also sets limits in the other direction. Employees who say they are authorized should get “a reasonable amount of time” to resolve a discrepancy, and employers “should not summarily discharge employees without providing a process for resolving the discrepancy.” An employee who once worked without authorization but is authorized now does not have to be fired: complete a new Form I-9, attach it to the old one with an explanation, and continue. Decisions about extra time should rest on objective criteria, documented, and not on anyone’s citizenship or national origin. This is the point in an audit to bring in employment counsel.

What happens in an ICE Form I-9 inspection

The inspection process is set out in ICE’s Form I-9 inspection fact sheet and in 8 CFR 274a.2(b)(2)(ii).

1. Notice of Inspection

   HSI serves a Notice of Inspection (NOI). Employers get “at least three business days to produce the Form(s) I-9 requested.” HSI may also ask for supporting records such as payroll, a list of active and terminated employees, articles of incorporation and business licenses. No subpoena or warrant is required for the inspection, the regulation says, and “any refusal or delay in presentation of the Forms I-9 for inspection is a violation of the retention requirements.” If you do not comply, an officer may issue a subpoena.

2. The inspection

   Forms must be produced in their original paper or electronic form, a paper copy of the electronic form, or on microfilm or microfiche, at the location where the request was made, or you tell the officer where they are kept. Agents compare the forms against payroll and look for missing forms, missing or late entries, and documents that do not appear valid.

3. The notices that follow

   Depending on what HSI finds, it may send: a Notice of Inspection Results (a compliance letter); a Notice of Suspect Documents, saying documents do not relate to the employee or are not valid, with a warning about penalties for continuing to employ unauthorized workers; a Notice of Discrepancies, where HSI cannot determine eligibility; a Notice of Technical or Procedural Failures, which gives the employer at least ten business days to correct them; a Warning Notice; or a Notice of Intent to Fine (NIF).

4. Warning or fine

   A Warning Notice is for substantive violations where HSI expects future compliance. ICE will not issue one where there was a prior Warning Notice or NIF, technical failures were not corrected in the ten days, the employer failed to prepare Forms I-9 at all, unauthorized workers were hired, or there is evidence of fraud such as backdating.

5. After a Notice of Intent to Fine

   You can negotiate a settlement with HSI or request a hearing before an administrative law judge in the Office of the Chief Administrative Hearing Officer (OCAHO). The request must be made within 30 calendar days of receiving the NIF. If you miss it, HSI issues a Final Order, and ICE says “there is no appeal from a Final Order.”

How ICE sizes a fine (violation percentage, then five statutory factors moving it up or down by up to 25 percent in total) and which errors count as technical versus substantive are covered in detail on our Form I-9 requirements page.

I-9 penalties in 2026: the current amounts

Civil money penalties for Form I-9 violations are set by statute and adjusted for inflation each year. The amounts in force are the 2025 adjustment: DHS published it on January 2, 2025, effective for penalties assessed after that date for violations after November 2, 2015, and codified it in 8 CFR 274a.10. The Justice Department’s matching table, used by OCAHO judges, is 28 CFR 85.5. There is no 2026 increase: on July 15, 2026 DOJ announced it “will continue to use the 2025 civil monetary penalty levels because there will be no cost-of-living adjustment for 2026,” following OMB guidance. We found no DHS 2026 adjustment in the Federal Register as of 24 September 2026, and 8 CFR 274a.10 still cites the January 2025 rule as its latest amendment.

Three details matter when reading the table. The paperwork fine is per form, so it scales with how many people you hire. Several violations found in one proceeding count as a single offense for deciding whether it is a first, second or third offense. And the unfair documentary practices line is a reminder that an audit can create liability of its own: over-asking for documents during a re-verification is itself penalized.

How often to audit, and what to fix upstream

The law sets no audit schedule. A workable pattern for high-volume hourly employers is a full audit once, then a smaller neutral sample on a regular cycle, plus a check of every form completed by a new onboarding coordinator in their first weeks. Timing the review to your hiring calendar helps: after a seasonal ramp is when late Section 2 entries pile up.

The more useful output of an audit is the list of upstream fixes. Most errors trace to a few causes: Section 2 completed after the third business day because the first shift was not the orientation day; a receipt accepted for a job lasting under three business days; an electronic system on an outdated form version; reverification dates nobody tracks. Put the Section 2 step into the first-day checklist alongside the other new hire forms and new hire reporting, and make it part of orientation rather than an afterthought.

Where Boostpoint fits is at the front of this process. Our 2026 benchmark of 891 managed Meta campaigns put the median cost at $13.88 per applicant, and every hire that follows creates one more Form I-9. The more you hire, the more a small, repeated onboarding error costs, which is why the hiring compliance steps are worth building before a hiring push, not after.

Frequently asked questions

Sources: ICE/DOJ internal audit guidance (December 2015); USCIS I-9 Central; ICE Form I-9 inspection fact sheet; 8 CFR 274a.2 and 274a.10; 28 CFR 85.5; 90 FR 1 (January 2, 2025); 91 FR 43405 (July 15, 2026). Read at source 24 September 2026.