Running an Internal Audit Before the Government Does

An employer that has never reviewed its verification records does not know its error rate, and the error rate is the number that positions any future penalty. A voluntary review answers that question while the answer can still be acted on. It also produces something the employer cannot manufacture later: contemporaneous evidence that it was paying attention.

Scoping the review from payroll

The review starts with a population, and the population comes from payroll rather than from the form files. That order matters. A review that begins with the forms can only find defects in forms that exist; it cannot find the worker for whom no form was ever prepared, which is the most expensive category of failure.

The population is bounded by the retention rules: current employees, and former employees still inside the measure described in retaining and destroying records. Forms outside that boundary should be identified separately, because they are candidates for destruction rather than correction, and correcting a form the employer is entitled to destroy is wasted effort that leaves the record in the file.

Scope also has an entity dimension that is easy to get wrong in a group. Verification obligations attach to the employing entity, and a group whose subsidiaries share a payroll provider may still have several employers within it. A review scoped to a trading name rather than to the legal employers can miss an entire population, and the omission only becomes visible when a notice arrives addressed to the entity that was left out.

Census or sample

A full census is cleanest and is the right answer for a small workforce. For a large one, a sample is defensible provided it is designed before it is drawn, documented, and drawn on a neutral basis such as location, hire period or a random selection across the roster. What makes a sample indefensible is selection by name, by apparent origin, or by which files somebody remembers being untidy.

A sample also needs an escalation rule fixed in advance: if the defect rate in the sample exceeds a stated threshold, the review expands to the full population or to the affected location. Without that rule, a sample showing a serious problem leaves the employer holding knowledge of a defect rate it has decided not to investigate, which is a worse position than not having sampled.

The review itself works from a checklist derived from what the regulation requires of each section, not from an impression of what looks wrong. Each finding is categorized as it is recorded, so that the schedule distinguishes an omitted entry from an absent form and an unsigned attestation from an unsigned certification. Categories assigned during the review are far more reliable than categories assigned afterward from a list of raw observations.

What the review must not do

Three boundaries constrain the exercise. It is a review of records, not of people. It does not involve re-examining identity documents, because the examination happened at hiring and repeating it invites a demand for documents the employee has already satisfied. It does not involve running current employees through the electronic verification system, which is prohibited outside the narrow exceptions described in verification of existing staff.

And it must be uniform. A review applied to some files and not others, where the selection tracks names or perceived origin, is a discriminatory practice in its own right, and the internal schedule documenting the selection becomes the evidence of it. Uniformity is also the reason a sample must be designed in advance: a rule written before the files are opened cannot be accused of following what was found in them.

A fourth constraint concerns who conducts the exercise. A review run by the same people who completed the forms tends to find fewer defects, for reasons that have nothing to do with dishonesty. Separating the reviewer from the preparer, even within the same team, materially improves the findings and is easy to describe in the memorandum.

The memorandum, and why it is the real output

The corrections improve the file. The memorandum is what improves the employer's position. It records the scope of the review, the population and how it was drawn, the method, the findings by category, what was corrected, what could not be corrected and why, and what changes to the process followed. It is signed and dated by whoever conducted the exercise.

That document does work in several directions at once. It evidences good faith as a penalty factor, described in the good faith defense and how far it reaches. It gives a debarring official something concrete when assessing present responsibility. And it gives the business a baseline against which the next cycle is measured, so that a rising defect rate at a particular site becomes visible before it becomes a finding.

What follows the review

A review that ends with a filed memorandum and no process change has diagnosed a problem and left it in place. The findings should feed the ordinary operating documents: who completes forms, how they are trained, when the completion deadline is checked, and where records are held. Those elements are set out in building a compliance program that survives an audit.

Some findings are not for the compliance function to resolve alone. A pattern suggesting that documents were demanded selectively, a file indicating that someone continued in employment after a status concern, or a system defect affecting an entire hiring cohort each raise questions that go beyond annotation. Where a review surfaces something of that kind, employers generally pause the correction work and take advice from an internal audit immigration counsel before proceeding, because the correction and the underlying problem call for different responses.