Paper Trail, Meet Audit Trail: Building a Defensible I-9 Self-Review

Most employers do not discover the condition of their Form I-9 records until someone else asks for them. A Notice of Inspection from U.S. Immigration and Customs Enforcement, a lender's pre-closing checklist, or an acquisition's HR due diligence request can turn a quiet file drawer into a timed production exercise. The binder that seemed administrative on the day it was assembled becomes, in that moment, a compliance record that will be read line by line.

The practical response is not a frantic purge. It is a repeatable self-review that identifies errors, corrects them lawfully, and documents the correction without creating new exposure. The distinction matters: an I-9 audit is not a scrapbook project, and it is not a cleanup that ends when the binder looks tidy. It is a control process.

Begin With Scope, Authority, and Privilege

Before pulling a single form, define the review's boundaries. Which legal entities, locations, and payroll cycles are in scope? Who within HR has authority to touch the forms? Who outside HR will see the results?

Where counsel is engaged, structure the review to preserve privilege where available. That generally means counsel directs the review, communications are labeled appropriately, and findings are not circulated casually through operational email. Privilege is not a substitute for correcting violations, but it can protect the assessment that precedes correction. Employers should consult their own counsel on the scope and limits of privilege in their jurisdiction and circumstances.

The review team should be small and trained. A well-meaning supervisor who pulls a file to "help" can create more problems than the original paperwork did.

Reconcile the Binder Against the Payroll Roster

The first substantive test is completeness. Compare the I-9 inventory to the active payroll roster and to separation records for the retention window. Every employee hired after November 6, 1986, should have a corresponding Form I-9 unless an exception applies. Every separated employee's form should be retained for the required period.

This reconciliation exposes the two most common structural failures: missing forms for current employees and premature destruction of forms for former employees. It also reveals whether the organization can reliably identify who is responsible for each file.

Retention is mechanical but often misunderstood. Employers must retain each Form I-9 for three years after the date of hire or one year after the date employment ends, whichever is later. Destruction should be documented, not improvised.

Review Each Form in a Consistent Sequence

A consistent sequence reduces the risk of inconsistent treatment. For each form, reviewers should examine:

• Section 1 completeness. The employee's attestation, signature, and date must be present. Missing or incomplete Section 1 entries are common technical violations.
• Section 2 timing and content. The employer's review must occur within three business days of the employee's first day of work for pay. The reviewer should confirm that the form identifies the documents presented, their issuing authority, and the relevant numbers, and that the employer examined the documents.
• Supplement A and B usage. Reverification and rehires have their own rules. A expired work authorization document does not permit the employer to demand a specific new document; it requires a timely reverification process.
• Copies and retention. If the employer makes copies of documents, it should do so consistently for all employees or not at all. Selective copying invites questions about disparate treatment.

Remote examination deserves separate attention. Employers enrolled in E-Verify and in good standing may use the DHS alternative procedure for remote examination, but that option carries specific technology, training, and record-retention obligations. Employers that used remote inspection under the pandemic-era flexibilities should confirm that their current practice rests on a valid legal basis, not on an expired temporary rule.

Correct Errors Without Overcorrecting

Correction is where good intentions can become a separate violation. The goal is to fix the record accurately, not to build a more impressive-looking file.

A correction should be made by the person authorized to complete the form, dated, and initialed where appropriate. Do not use correction fluid to obscure the original entry, and do not backdate a correction to make the record appear timely. If a form is missing Section 2 entirely, the employer may complete it based on a review of the documents the employee actually presented, with a clear notation of the later review date where appropriate.

What employers must not do is demand additional or different documents from employees who have already presented valid documentation. Document abuse and unfair immigration-related employment practices remain live risks under federal law. A reviewer who tells an employee, "Just bring your passport and we'll fix this," has moved from correcting a form to dictating a document choice.

Consistency is the safeguard. Apply the same correction standard to every file in the review population.

What Supervisors Should Never Do

Front-line supervisors are not I-9 reviewers. They should never:

• Ask an employee to produce specific immigration documents;
• Accept or inspect documents outside the formal verification process;
• Make hiring or scheduling decisions based on perceived immigration status;
• Remove or alter pages from an I-9 file;
• Discuss a worker's verification status with colleagues who do not need to know.

Supervisors should know whom to call when a verification question arises and should route the question there without improvisation.

Make Hygiene a Quarterly Habit

A single cleanup creates a snapshot. A quarterly process creates a control. A practical cadence includes:

1. A monthly reconciliation of new hires against Form I-9 completion.
2. A quarterly review of reverification deadlines for employees with temporary work authorization.
3. A quarterly sample audit of completed forms for Section 1 and Section 2 defects.
4. An annual full-file review before acquisition, financing, or major hiring surges.
5. A documented retention and destruction schedule tied to the three-year/one-year rule.

The output should be a short written summary: what was reviewed, what was corrected, what remains outstanding, and who owns the next step. That summary is not the same as the I-9 itself, and it should be maintained with the same care.

The Binder Is a Record of Decisions

An I-9 file is not a test of an employee's worth or a place for supervisors to exercise judgment. It is a record of a specific verification decision made at a specific time. Treated that way, it can survive an inspection. Treated as a scrapbook, it will tell a story the employer never intended to write.