I-9 audits are typically set in motion by one of five triggers: DHS enforcement patterns tied to industry, geography, or prior audit history; mergers and acquisitions that create new-hire classifications; complaints or tips from employees, candidates, or competitors; negative media attention; or information that surfaces during an unrelated government investigation.
Once a trigger prompts a review, ICE issues a Notice of Inspection (NOI), giving employers at least three business days to produce their I-9 forms and supporting records.
An I-9 audit can turn a single paperwork mistake into a $2,861 fine per form, and penalties can add up fast. The good news is that most audits are driven by a handful of predictable red flags. When you know what those signals look like and tighten a few parts of your process, you can reduce the odds of being caught off guard.
For HR teams, the pressure is real: hiring is more distributed, verification is harder to standardize, and enforcement expectations have not gotten simpler. Let’s dive into the five most common audit triggers, what happens once ICE initiates an inspection, and the practical process moves that make audits less disruptive.
In this post, we'll cover:
What is an I-9 Audit?
In November 1986, the Immigration Reform and Control Act (IRCA) was enacted, requiring employers to verify the identity and employment eligibility of their employees using Form I-9.
U.S. Immigration and Customs Enforcement (ICE), within the Department of Homeland Security (DHS), conducts I-9 audits to confirm employers are meeting these requirements and maintaining accurate records. If an organization is found noncompliant, it may face fines of up to $2,861 per form, among other penalties.
Penalty amounts depend on the type of violation. Current ranges include:
- Paperwork errors: $288 to $2,861 per form
- Document fraud, first offense: $590 to $4,730 per form, rising to $11,823 for subsequent offenses
- Knowingly hiring or continuing to employ an unauthorized worker: $716 to $28,619 per individual
DHS adjusts these amounts annually for inflation, so check the Federal Register for the most current figures.
When ICE determines where you land within a penalty range, it typically weighs five factors: business size, seriousness of the violation, good-faith compliance efforts, whether unauthorized workers are involved, and prior history. In high-volume hiring environments, totals can climb quickly.
5 Most Common Triggers for an I-9 Audit
Plenty of conditions can lead to scrutiny, but these are the triggers HR teams run into most often.
-
DHS Red Flags
DHS red flags are enforcement patterns baked into government data, including industry, geography, and audit history, that can draw scrutiny before anyone ever files a complaint.
- Industry: certain sectors have historically seen higher levels of enforcement.
- Geography: certain regions tend to see higher audit activity.
- History: a prior audit gives ICE reason to look again, especially if it previously uncovered recurring errors.
Takeaway: If you operate in a higher-risk industry, in an active region, or have a prior audit, consistency has to be designed into the process, not left to individual habits.
-
Mergers, Acquisitions, and Ownership Changes
Ownership transitions are one of the most overlooked triggers, because I-9 consistency is easy to lose in the middle of system migrations, new leadership, and process consolidation.
- System and process changes during a transition can create gaps or inconsistencies in I-9 records.
- New leadership may inherit compliance habits they don’t fully understand yet.
- If the acquiring company treats the seller’s employees as “new hires,” a fresh batch of I-9 forms must be completed accurately and on time.
Takeaway: During M&A, decide early whether you will complete new I-9s, then resource the workflow like a real project, with clear owners and timelines.
-
Complaints and Tips
Many audits start the old-fashioned way: someone tells the government there’s a problem. The source varies, but the operational impact is the same.
- Current employees tend to be the most credible when they can point to specific practices, like inconsistent document handling.
- Former employees sometimes file complaints after separations, especially if the exit was tense.
- Candidates may raise concerns after being rejected, even when the claim is weak.
- Competitors occasionally try to disrupt operations, though those tips often lack evidence.
Takeaway: Your best defense is a process you can explain and document, because you cannot control who decides to file a complaint.
-
Media Attention
Negative media coverage related to immigration, labor disputes, or workforce practices can put an employer on ICE’s radar.
Sometimes just one story is enough to prompt follow-up questions, even without a long investigative series. Coverage can draw compliance scrutiny toward a company even when it never alleges an I-9 violation directly.
Takeaway: If your organization is dealing with a public-facing labor issue, it’s a good time to sanity-check your I-9 file and workflow, even if you believe you are compliant.
-
Investigations by Other Government Agencies
Agencies share information, so a review that starts elsewhere can surface I-9 weaknesses and widen into immigration compliance scrutiny.
This often happens when workforce or payroll issues are already being examined. It can also happen when investigators receive information from confidential informants or other involved parties trying to reduce their own exposure.
Takeaway: If another agency is asking questions about your workforce practices, assume I-9 documentation may come into view and prepare accordingly.
The trigger behind an audit often shapes what happens once the review starts. DHS pattern-driven audits, especially repeat reviews of employers with a prior audit history, tend to look at systemic, company-wide practices and can escalate faster toward a Notice of Intent to Fine. Tip- and complaint-driven audits are often narrower, focusing on the specific hires or practices named in the complaint, which commonly show up as Notice of Discrepancies or Technical/Procedural Failures tied to Section 2. M&A-driven reviews tend to concentrate on whether new-hire I-9s were completed correctly during the transition. Media-attention and cross-agency cases can broaden in scope quickly, since they often arrive with documentation already gathered by another source.
What Happens During an I-9 Audit
If your company is flagged for an audit, the process begins with a Notice of Inspection (NOI), giving you at least three business days to produce the requested Form(s) I-9 and supporting documentation. What you’ll need to provide depends on how you’ve been managing I-9s.
What to Submit Depends on Your Method:
Paper-based programs often require copies or scans of I-9s and related records. Employers using E-Verify must retain copies of documentation presented for List A of Form I-9. If you use alternative document examination procedures, you’ll need clear, legible copies of every document presented to establish identity and work authorization.
Homeland Security Investigations (HSI) may also request payroll records, employee lists, articles of incorporation, and business licenses.
Possible Outcomes After the Review
Once the review is complete, ICE issues one of several findings.
The best outcome is a Notice of Inspection Results, also called a Compliance Letter, confirming you’re fully compliant.
Negative outcomes range from minor to severe.
- A Notice of Discrepancies or Notice of Technical or Procedural Failures typically gives you 10 business days to correct errors.
- A Warning Notice flags serious violations but offers a chance to fix them.
- A Notice of Suspect Documents suggests possible unauthorized workers and triggers further investigation.
- A Notice of Intent to Fine (NOIF) proposes specific financial penalties, which you can appeal within 30 days; if you don’t appeal or you lose the appeal, a Final Order imposes the fines.
Practical takeaway: treat “minor” findings as a leading indicator. A small pattern today can become a larger penalty later if it repeats.
What Auditors Actually Look For
A common misconception is that completing Form I-9 equals compliance. In practice, auditors look for whether the verification process is consistent and defensible.
They may examine who completed Section 2, whether that person was authorized to do so, how identity was verified (including which documents were accepted and how they were reviewed), whether the process is consistent across hires, locations, and authorized representatives, and whether your decisions can be explained, especially around document acceptance and remote verification.
In other words, completion is the baseline. Consistency is what holds up under scrutiny.
A Quick Self-Assessment for HR Teams
Use these questions to pressure-test your process:
- Could you explain your Section 2 process to an auditor tomorrow?
- Are remote hires verified the same way every time, regardless of who handles the verification?
- How dependent is your compliance on specific individuals? If your most experienced HR team member left tomorrow, would your I-9 process still hold up?
- When was your I-9 process last intentionally redesigned?
If any of these raise concerns, your exposure is probably more about process design than effort. For a deeper look at how leading HR teams are rebuilding their compliance workflows, watch our on-demand webinar, How HR Teams Stay I-9 Audit-Ready.
Build a Stronger Compliance Foundation
The fixes that matter most are usually structural, not heroic.
Start with internal reviews. Regular self-audits help you catch patterns early and correct them in a controlled way. If you find missing or incorrect forms, address them methodically: locate the form, correct minor errors directly, create a new form with a written explanation for significant errors, and have employees complete any missing sections as soon as possible.
Pair that with training that stays current, because rules and procedures evolve and institutional memory fades. Monitor updates from USCIS and the Federal Register so you’re never caught off guard by new requirements.
Finally, consider whether your tools support consistency. Many teams move to electronic I-9 workflows to reduce common errors, standardize completion across locations, and maintain a clearer audit trail. Curious what your paper I-9s could be costing you? Take 60 seconds to estimate your potential audit exposure with our Paper Form I-9 Risk Calculator.
Frequently Asked Questions
What triggers an I-9 audit?
What are the most common I-9 audit red flags?
What industries are at highest risk for an I-9 audit?
What is a Notice of Inspection and how do I respond?
How long does an I-9 audit last?
How have I-9 audits changed in recent years?
How long must I retain I-9 forms?
Can electronic I-9 tools eliminate audit risk?
Want more answers like these? During a recent Ask Me Anything session, Mitratech’s I-9 experts fielded the practical compliance scenarios HR teams face every day, from retention rules and remote verification to rehires, late Section 2 completion, and I-797 documentation. Get the full quick-reference infographic here: Top 10 I-9 Compliance FAQs.
I-9 Audits Don’t Have to Be a Crisis
Even with the best efforts, audits can still happen, but they don’t have to be devastating. When your process is consistent, documented, and repeatable, an audit becomes a structured compliance event rather than a scramble.
