The Compliance Risks of I-9 Software

The use of I-9 software is becoming more prevalent among companies large and small, since these systems present an attractive alternative to paper-based processes for HR departments looking to streamline compliance with complex government regulations. In addition to eliminating the need for voluminous files that can be difficult to manage, store and internally audit, automated systems can:

• Ensure greater consistency in completing forms. 
  
• Provide embedded controls that prevent forms from being entered into the system with missing or incorrect information.
  
• Feature prompts that remind I-9 administrators of reverification processes or completion deadlines.
  
• Enable easier spot-check audits by HR managers.
  

However, not all I-9 software meets federal regulations. And the problem is that U.S. Immigration and Customs Enforcement (ICE) rulings hold an employer liable for the faults of the software vendor if its technology fails to comply with the law. That’s why it is incumbent on HR professionals to choose an automated system that prevents errors and minimizes the risk of noncompliance.

Integrity Issues

The products offered for I-9 administration come in many forms, from stand-alone Form I-9 and E-Verify platforms to add-ons for existing HR information systems. Before selecting an I-9 system or add-on, carefully weigh the benefits gained from workflow efficiencies against any compliance issues to avoid potential pitfalls.

For example, some programs insert additional fields into the electronic I-9 requesting information that is not included on the paper form. This violates regulations because electronic I-9s must have the same data and elements as the paper form, with no additional content or language inserted. Other programs require an employee to input his or her Social Security number, even if the employer does not use E-Verify; this information is generally necessary only if a company uses E-Verify. And reviews of the audit trails produced by some systems show a broad disparity in the volume of information captured, despite the ICE regulations’ requirement for a complete record of the identity and actions of anyone who has accessed the system.

A compliant electronic I-9 program must include “reasonable controls” to ensure the system’s “integrity, accuracy and reliability” and to “prevent and detect the unauthorized or accidental creation of, addition to, alteration of, deletion of, or deterioration of an electronically completed or stored Form I-9, including the electronic signature,” according to ICE. It must also be regularly evaluated to ensure compliance and security.

One feature government officials frequently inspect in audits is the employee signature process, which has strict requirements. To protect system security, make certain that only authorized company representatives have access to electronic I-9 files and that those employees receive training so that records cannot be accessed by unauthorized personnel or accidentally altered or erased. As with other electronic data storage, the I-9 system must provide “for backup and recovery of records to protect against information loss, such as power interruptions,” ICE regulations state.

If an electronic I-9 platform fails to meet these standards, even if the I-9 is otherwise fully completed, ICE can determine that a company has committed a substantive violation, resulting in penalties of $935 per violation. Even for a small company with 200 employees, the total fine would add up to $187,000.

Evaluating Systems

If your organization decides to automate its I-9 process, be thorough in determining whether specific software is compliant. To protect your organization’s financial interests and reputation, we recommend that HR professionals adopting automated I-9 systems take the following actions:

• Involve experienced immigration counsel in evaluating and selecting a compliant electronic I-9 system.
  
• Beware of inexpensive software add-ons, and closely scrutinize these add-ons   for compliance.
  
• Ensure that your company’s contract with an electronic I-9 vendor has a favorable indemnification clause for any fines or litigation that result from the product’s failure to conform to the electronic I-9 regulations.
  
• Obtain information regarding the vendor’s financial health to ensure that the indemnification clause can be enforced and collected on if it becomes necessary.
  
• Review your electronic I-9 system periodically for compliance with the regulations and developing agency guidance.
  
• Conduct regular training (at least once a year) for I-9 administrators to keep their knowledge current.
  

When selecting electronic I-9 programs, experts recommend organizations look for several features, including:

• Retrieval systems with indexing functions that permit searches consistent with ICE requirements for accessibility and storage. 
  
• Clear audit trails that detail when I-9s are created, completed, updated, modified or corrected.
  
• Assurance that when electronic records are created, completed or updated, there is a secure and permanent record created that establishes the date of access, the identity of the individual who accessed electronic records and a history of the action taken. 
  
• Proof that the system can easily produce I-9 paper copies, including batch and individual copies, as well as any supporting documents.
  

Taking care to determine the compliance risks of any automated I-9 software program that your organization deploys can keep your company from making costly errors and inviting a government audit—a fate every HR professional wants to avoid.  

Matthew E. Orso and Susan C. Rodriguez are attorneys in the Charlotte, N.C., office of McGuireWoods. Republished with permission. © 2016 McGuireWoods.