Form I-9 audit readiness: winning the 72-hour window
ICE is building capacity for high-volume Form I-9 inspections, and employers get roughly three days to produce complete records. The defense is operational, not legal.
Form I-9 audit readiness has quietly become one of the most operational risks on the HR leader's desk. A Notice of Inspection requires no warrant and no probable cause, and once it lands, employers typically have about 72 hours to produce every required record. Most People Ops teams have never actually timed that retrieval, which is the real exposure.
Why enforcement capacity is expanding in 2026
In a July 2026 alert titled "US Employers Should Prepare Now for Increased Form I-9 Enforcement," Morgan Lewis reported that White House border czar Tom Homan had described worksite enforcement as a major part of the administration's strategy, pointing to a plan under development to process large volumes of Form I-9 inspections. Apparent administrative and criminal violations would be referred to Homeland Security Investigations.
That builds on warnings law firms issued earlier in the year. Meltzer Hellrung wrote in April 2026 that expanded ICE agent staffing points toward more Notices of Inspection, more onsite visits and higher civil penalty exposure, including for employers with genuinely solid programs. Greenspoon Marder framed the shift bluntly as effectively zero tolerance, arguing that good faith effort is no longer the cushion it once was. The firm also noted that ICE's rate of Notices of Inspection in the first half of 2025 ran at least ten times higher than 2024, concentrated in hospitality, construction, staffing, transportation, health care, retail and landscaping.
The pressure is not coming from one agency alone. The Department of Labor's Wage and Hour Division named H-1B related initiatives among its 2026 enforcement priorities, reported from the PayrollOrg Capital Summit. Employers that sponsor foreign national talent can find themselves managing immigration recordkeeping scrutiny from two directions at once.
A 72-hour production window means the real variable is not legal interpretation. It is whether anyone can find the records.
What inspectors actually ask for
The common misconception is that an I-9 inspection is a review of I-9 forms. It is not. Inspectors routinely request employee lists, payroll records and tax filings alongside the forms themselves, because the reconciliation between those data sets is where discrepancies surface. A name on payroll with no corresponding I-9 is a finding. An I-9 for a worker who never appears in payroll is a different kind of finding.
Greenspoon Marder also flagged that I-9 audits increasingly serve as an entry point into broader reviews of H-1B and L-1 sponsorship records, and that discrepancies found during a USCIS Fraud Detection and National Security site visit can trigger a full I-9 audit in the other direction. Meltzer Hellrung added a further wrinkle: enforcement now scrutinizes staffing and contractor relationships, which pushes employers to revisit vendor indemnity language, audit rights and how onboarding verification is performed by third parties.
For an HR function that has absorbed acquisitions, migrated HRIS platforms twice and verified remote hires over video, none of this is a paperwork exercise. It is a question of whether the records exist in one retrievable place, and whether anyone can prove it under time pressure.
Treating the I-9 file as a standing deliverable
The practical reframe is to stop thinking of I-9 compliance as an annual hygiene task and start treating the I-9 file as a standing deliverable with the same discipline applied to payroll close or year-end reporting. That means a named owner with a named backup, not a distributed responsibility that evaporates when someone leaves.
Four components make the difference. First, a documented internal audit cadence, with a defined sample methodology and a written record of what was reviewed, what was corrected and how corrections were annotated. Second, a purge schedule that actually runs, because retaining forms past the required period creates avoidable exposure on records you were never obligated to keep. Third, a reconciliation routine that matches active I-9s against the payroll roster on a fixed interval, so gaps are found internally rather than by an inspector. Fourth, a pre-written NOI response runbook.
The runbook is the piece most teams skip. It should specify who is authorized to accept the Notice at the front desk, who is contacted within the first hour, which counsel is engaged, where the records live, who pulls payroll and tax documentation, and what front-line staff are instructed to say and not say to agents who arrive in person. Morgan Lewis's central point in its July alert was that preparation belongs before the Notice arrives, not after.
The manager training gap nobody budgets for
Most I-9 errors are not created by HR. They are created by well-meaning local managers handling a rehire, a work authorization expiration or a document reverification without knowing the rules. A manager who helpfully asks a specific employee for a particular document, or who re-does a Section 2 that should have carried over on a rehire within the permitted window, introduces a defect that sits in the file for years.
That makes manager training a compliance control, not a soft investment. Practical steps include a short, mandatory module for anyone who touches onboarding at a site level, a single escalation path for any reverification question, and a hard rule that no one outside the designated I-9 team completes or corrects a form. For distributed and remote hiring, document exactly which verification method was used for each hire and keep that decision auditable.
The same logic extends to staffing agencies and contractors. If a vendor performs verification on workers at your site, your contract should give you audit rights over that process and clear indemnity, and someone on your side should exercise those rights at least once a year rather than assuming compliance by default.
How to test readiness before ICE does
The most useful exercise costs a morning. Pick a random sample of current and recently separated employees across every entity, location and acquired business unit. Then time how long it takes to produce their complete I-9s plus matching payroll and tax records. If the answer is more than a few hours, the 72-hour window is tighter than it looks once counsel review, correction logging and executive sign-off are added.
Run the same drill for the messy edges: workers onboarded before an HRIS migration, employees who moved between legal entities, remote hires verified over video, and anyone sourced through a staffing partner. Those are the categories where records fragment. Documenting the drill itself matters too, because a consistent, dated internal audit history is part of what demonstrates a good faith program, even in an enforcement climate where good faith carries less weight than it used to.
