The month an I-9 audit fined me for paperwork about people who were always legal to hire, at 66K MRR

That sentence sits on a public government factsheet. I read it for the first time on day four of a ten business day window I had not registered had started, at $66,000 MRR, with twenty one Forms I-9 spread across a folder, a filing cabinet, and in two cases a photograph on somebody's phone.

Quick answer (2026). This diary is a composite, assembled from several companies I have worked in and advised, and the figures are representative rather than any one firm's ledger. The thing I had wrong is simple and, judging by what ranks for this question, widely shared. I believed that because every person we had ever hired was legally allowed to work, our Form I-9 paperwork was administrative. It is not. Under 8 U.S.C. 1324a(a)(3), doing the paperwork in good faith is an affirmative defence to the charge of employing someone unauthorised. Nothing runs the other way. Employing only authorised people is not a defence to a paperwork violation. It is one of five things the government weighs when setting the size of the fine.

Three business days, and I did not know the number

The process starts with a Notice of Inspection. I had assumed, vaguely, that this was the opening of a negotiation. It is the opening of a clock. Immigration and Customs Enforcement's own factsheet on Form I-9 inspection says that "employers receive at least three business days to produce the Form(s) I-9 requested in the NOI", citing 8 C.F.R. 274a.2(b)(2)(ii), and adds that the agency generally also asks for payroll, a list of active and terminated employees, articles of incorporation and business licences.

Three business days is not enough time to find a form you cannot find. It is exactly enough time to discover which ones you cannot find.

We produced twenty one. Sixteen came back flagged. Nine were marked technical or procedural. Seven were substantive from the start. That split turned out to matter more than the total.

The defence runs one way only

Here is the asymmetry I had never seen stated plainly anywhere.

8 U.S.C. 1324a(a)(3) is titled Defense, and it says that a person or entity that has complied in good faith with the paperwork requirements of subsection (b) "has established an affirmative defense" that it has not violated the prohibition on knowingly hiring an unauthorised worker. Good paperwork excuses a bad hire.

Now look for the mirror image, the provision that says a lawful workforce excuses bad paperwork. It is not there. What is there instead is 8 C.F.R. 274a.10, which sets the paperwork penalty at "not less than $288 and not more than $2,861" for each individual, and then lists five things to weigh in fixing the amount inside that band. The fourth is "Whether or not the individual was an unauthorized alien".

Read that again in the position it actually occupies. The single fact I thought was my whole defence is item four of five in a discretionary sentencing list. It does not stop the penalty. It moves the number.

The band is the story. $2,861 divided by $288 is 9.93. The same form, the same person, the same error can cost nearly ten times as much depending on factors that include the size of my business and my history, neither of which I can retroactively change.

For our seven substantive violations that is a range of $2,016 at the floor to $20,027 at the ceiling. Against $792,000 of annual revenue the ceiling is 2.53 percent. I want to be precise about what this band is and is not: it is the paperwork band under 1324a(e)(5). The much larger bands in the same regulation, running to $5,724 and beyond per person, are for knowingly employing unauthorised workers under 1324a(e)(4), and they were never in play for us, because nobody was unauthorised. That is the entire point. We were exposed to five figures for filing, having done the hiring correctly.

The expensive clock is the one I do not control

This is the part no advisory page I read had mentioned, and it is the part I would most want a founder to see.

The penalty amounts are inflation adjusted, and the adjustment is not keyed to when you made the mistake. 28 C.F.R. 85.5 sets out the table, and its two operative paragraphs are worth reading side by side. Paragraph (a) applies "For civil penalties assessed after July 3, 2025", and sends you to the fifth column. Paragraph (b) applies "For civil penalties assessed after February 12, 2024, and on or before July 3, 2025", and sends you to the fourth.

The violation date is a single open bucket. The section is titled Adjustments to penalties for violations occurring after November 2, 2015, and that is the whole test on the violation side. More than a decade of conduct falls into one category.

What actually selects the column is the date the penalty is assessed. In the fourth column the paperwork maximum is $2,789. In the fifth it is $2,861. Same violation, same form, same person, same year of hiring. The difference is $72 per individual, decided by which side of a date in July the government happened to get around to assessing.

Across our seven that is $504 of pure calendar. It is not a large number on its own. It is a large idea, because the clock I cannot influence at all is the one that sets the price, and every day the agency takes is a day the figure can only move up.

Paragraph (c) of the same section adds, and I am quoting because the word matters, that "All figures set forth in table 1 to this section are maximum penalties". These are ceilings, not forecasts. I have seen enough compliance writing quote the top of a band as though it were a bill. It is not one.

The published numbers disagree with each other

Out of curiosity I read the whole first page of results for the query I had typed. Nine results, all of them reference material: two government pages, a law firm, a professional body, four vendors, one legal aid organisation. Not one first person account of being inside it.

Two of them contradict each other on the number. One, dated June 2026, gives the maximum as $2,861, which matches both the regulation and the fifth column of the DOJ table. Another gives the range as $234 to $2,322, which matches neither current column. That is a stale adjustment year left standing on a live page.

A founder budgeting from the second page computes seven times $2,322, or $16,254, against a true ceiling of $20,027. The shortfall is $3,773, which is 18.8 percent of the real exposure. There is no malice in this. Inflation adjusted penalties change annually and content does not. It is simply a reason to read the table rather than the summary.

The retention rule is inverted, and it is exactly solvable

8 U.S.C. 1324a(b)(3)(B) says the form must be kept until "three years after the date of such hiring", or "one year after the date the individual's employment is terminated", "whichever is later".

Two legs, so there is a crossover, and it is worth ten seconds of arithmetic. Set them equal. Three years from hire equals one year from termination exactly when tenure is two years. Below two years of tenure the hiring leg governs. Above two years the termination leg governs.

The consequence runs against intuition. The shorter someone's time with you, the longer you must keep their form after they leave. Somebody who lasted a month has to be retained for two years and eleven months past their last day. Somebody who gave you five years has to be retained for one.

Every gap in our folder was a short tenure. Of course it was. Those are the people whose paperwork nobody chased, who left before anybody noticed, and whose forms the statute makes you hold onto nearly three times longer than the people who built the company.

What a correction leaves behind

We corrected all nine technical failures inside the window. 8 U.S.C. 1324a(b)(6)(A) says a person is treated as having complied despite "a technical or procedural failure to meet such requirement if there was a good faith attempt to comply with the requirement", and (b)(6)(B) is the exception, which applies only once the agency has explained the basis and given "a period of not less than 10 business days" to fix it.

Read carefully, that cure right is not self starting. The ten days do not begin when you notice. They begin when the government explains. You cannot pre empt it.

And the correction is permanent in a specific way. The United States Citizenship and Immigration Services page on self audits and correcting mistakes tells you to "Draw a line through the incorrect information", enter the correct information, and initial and date it. Then it says: "Be sure not to conceal any changes made on the form". So a corrected form is not a clean form. It is a form that visibly records that you got it wrong and then fixed it, in your handwriting, with a date on it.

That is the right rule. It also means there is no version of this where the folder looks untouched afterwards.

What I got wrong

I assumed a company our size got a break. I went looking for one in the text. Across the statute and the penalty regulation, "de minimis" appears zero times, "small business" zero, "small employer" zero, and "safe harbor" zero, while control terms like good faith and civil penalty appear throughout. There is no threshold. Twenty one employees and twenty one thousand are governed by the same sentence.

I assumed good faith was a status I had. It is a finding somebody else makes, on a schedule they set.

I assumed I could quietly redo the bad forms. USCIS says not to conceal changes, and warns that doing so "may lead to increased liability under federal immigration law".

And one thing I could not resolve, which I am recording rather than dressing up. 1324a(b)(6) protects technical or procedural failures, and the agency operationally distinguishes those from substantive ones. I could not find the line between the two drawn in the statutory text itself. I stopped there rather than inventing a boundary I had not read.

What actually happened

The one thing I would tell you

Do the arithmetic on your shortest tenures first, not your longest. Everything I could not produce belonged to somebody who was here briefly, and the statute holds those forms longest. An afternoon with a list of every person you have ever paid, sorted ascending by days employed, will find your entire exposure before anybody serves you anything.

And when you read a penalty figure anywhere, including here, go and find the adjustment table. The number on the advisory page has a year attached to it whether or not the page says so.