I-9 and E-Verify Compliance Across Multiple Locations Without an HR Hire

I-9 audits are the single largest compliance event a restaurant group can face. ICE Form I-9 inspections — formally Notices of Inspection — produce penalties on a per-violation basis, where each individual I-9 with a technical defect is its own finding. A multi-location restaurant group with 80 employees and an average of 2.4 technical defects per I-9 can face penalties in the $200K–$600K range before any substantive findings (knowingly hiring unauthorized workers, paperwork falsification) come into the picture.

The good news for multi-location operators is that the discipline that prevents I-9 exposure is documentable, repeatable, and scales without hiring a full-time HR person. The bad news is that almost no independent multi-unit group we have audited is following the discipline.

This post is the system. It is not legal advice. It is the operating rhythm we install when starting a multi-location compliance engagement.

What an I-9 audit actually looks like

ICE issues a Notice of Inspection (NOI). The operator has three business days to produce every Form I-9 for current employees, plus all Form I-9s for terminated employees within the retention period (three years from hire date, or one year from termination date, whichever is later).

The auditor reviews each I-9. Findings break into two categories.

Technical violations. Missing fields, wrong dates, expired identification documents, incorrect document descriptions, missing signatures. Each defect is a separate finding. Penalties currently run from $281 to $2,789 per violation depending on severity and the operator's prior history.

Substantive violations. Knowingly hiring or continuing to employ an unauthorized worker. Penalties currently run from $698 to $27,894 per violation, with criminal exposure in pattern-or-practice cases.

The substantive category is the catastrophic one but the technical category is what gets most operators. A medium-sized DMV group with 70 employees and an average of 2 technical defects per I-9 is sitting on 140 findings at $281 minimum each — $39K in exposure on routine paperwork errors that nobody noticed at hire.

An I-9 with two technical defects is an audit finding. An I-9 with zero technical defects is an asset. The difference between the two is fifteen minutes of attention at hire — and a quarterly review discipline that catches drift.

The day-one process

Every new hire, every location, every time. No exceptions for "we'll get to it later." The process has four steps and takes about ten minutes per hire.

Step 1: Section 1, completed by the employee

The employee fills out Section 1 of Form I-9 (current edition — verify you have the most recent version; USCIS updates the form periodically). Section 1 is the employee's declaration of identity and work authorization. It must be completed no later than the first day of work.

The most common Section 1 defects:

Missing date of signature
Missing or wrong "first day of work" date
Blank citizenship/work authorization status box
USCIS number or I-94 number missing for non-citizen authorized workers

A trained intake person catches these in real time. An untrained intake person catches them never.

Step 2: Section 2, completed by the employer

The employer reviews the employee's identification documents and completes Section 2. Section 2 must be completed within three business days of the first day of work. Late completion is a per-violation finding.

The employer can accept either:

One document from List A (establishes both identity and work authorization — most commonly a U.S. passport)
One document from List B (identity — most commonly a driver's license) AND one document from List C (work authorization — most commonly a Social Security card or birth certificate)

The most common Section 2 defects:

Listing a List A document AND a List B document (which is not a valid combination)
Recording the wrong document number
Not entering the document expiration date for documents that expire
Missing the employer signature
Missing or wrong "date of hire"

The fix here is a checklist for the manager doing the intake. The checklist makes the right combination obvious and the wrong combination impossible.

Step 3: E-Verify, where applicable

E-Verify is voluntary in DC and Maryland for most private employers. It is mandatory in Virginia for certain categories of state contractors and for any employer with 25+ employees if they are bidding on or performing state work. Many federal contractors must use E-Verify regardless of jurisdiction.

For multi-location operators with any federal contract relationship — including catering for federal facilities or any work tied to a federal grant — E-Verify is effectively mandatory. The compliance posture is dramatically stronger when E-Verify is used systematically across the group, even where it is not strictly required.

E-Verify queries must be initiated no later than the third business day after the start date. Late queries are a separate violation.

Step 4: Retention and access

The signed Form I-9 is retained in a centralized, accessible file structure — not in the employee's general personnel file. The reasoning is operational: when an NOI lands, the operator has three business days to produce every I-9. If I-9s are scattered across location-level personnel files, the producing those files inside the deadline is a meaningful operational risk.

The right structure is one master I-9 binder (digital or physical) for the entire group, with an index by employee and by location. The binder is the only thing produced on an NOI — not the full personnel files.

The multi-location problem

Single-location operators can run I-9 discipline through one trained manager. Multi-location operators cannot — they have to install the discipline as a system because no single person is present at every hire.

Three structural choices for multi-location I-9 compliance:

Choice 1: Centralized intake

Every new hire across the group does their I-9 paperwork with one designated person — typically the group's bookkeeper or operations manager — at a central location. The hire physically (or via secure video) presents documents to the designated person, who completes Section 2.

This is the most defensible structure. It is also operationally inconvenient — a new hire at a Bethesda location may not be willing or able to make a trip to a DC central office to complete paperwork.

Choice 2: Trained location managers with central audit

Each location's general manager is trained to complete Section 2, with monthly central audit of every I-9 completed at that location. Errors caught in audit are corrected within 90 days, which is permitted as long as the original I-9 is preserved and the correction is documented.

This is the most common structure for medium-sized groups (2–6 locations). The audit cadence is non-negotiable — monthly, with a documented checklist.

Choice 3: Third-party I-9 platform

Several SaaS platforms (HireRight, Tracker, WorkBright, others) provide I-9 completion workflows that walk both employee and employer through the form, flag errors in real time, integrate with E-Verify, and maintain the retention file structure.

For operators with 5+ locations, the platform cost (typically $4–$8 per hire) is materially less than the audit time required to keep a manual system clean. We typically recommend a platform for any operator over 4 locations.

Quarterly internal audit

Whatever intake structure you use, a quarterly internal audit is the discipline that keeps the file from drifting. Each quarter, pull 20% of the I-9 file (rotating so that every I-9 is audited annually) and check:

Section 1 complete, signed, dated correctly
Section 2 complete, signed, dated correctly, valid document combination
E-Verify query completed (if applicable) and result recorded
Document expiration dates flagged for re-verification if applicable
Termination documentation present for separated employees
Retention schedule current (no expired files in the active binder, no current files purged early)

Findings from each quarter are corrected within 90 days. The audit itself is documented in a one-page summary memo — date, scope, findings, corrective actions, signature.

The audit summary memo is the single most valuable document in an actual I-9 investigation. It establishes good faith. Good faith is not a defense to technical violations, but it materially reduces per-violation penalties in negotiated outcomes.

Re-verification — the trap that catches established operators

For employees who presented work authorization documents with expiration dates (List A or List C), the employer must re-verify work authorization before the document expires. Late re-verification is a finding.

The trap is that most independent operators do not track document expiration dates after hire. The original I-9 sits in the binder; nobody flags the expiration; the document expires; the employee continues working without re-verification; the operator has an ongoing substantive violation.

Two fixes:

At intake, record document expiration dates in a tickler system (calendar, spreadsheet, or platform) with a 60-day pre-expiration alert.
Quarterly, run a report of all employees whose work authorization documents expire in the next 90 days. Re-verify in advance.

Re-verification uses Section 3 of Form I-9 (or a new Form I-9 in the current edition's structure). The same rules apply for document combinations and timing.

Common myths that cost operators money

Myth: "We use a payroll service, they handle I-9."

Most payroll services (ADP, Paychex, Gusto, OnPay) do not complete I-9s. They process payroll based on the employee data you give them. They may store an I-9 in their system, but the legal responsibility for completion sits with the employer.

Myth: "If we hire someone the second time, we don't need a new I-9."

Re-hires within three years of the original I-9 can be re-verified using Section 3 of the original I-9 if the original is still valid. Re-hires after three years require a new I-9. Misjudging this is a finding.

Myth: "Independent contractors don't need I-9s."

True for actual independent contractors. The trap is that many "1099" workers in DMV restaurant operations would be classified as employees on a real misclassification analysis (see Maryland and DC's worker classification rules). If they are misclassified, the I-9 obligation existed and was not met.

Myth: "If we discover an old I-9 error, we can't fix it."

False. Old technical errors can be corrected, but the correction must be: dated, initialed, with the original entry preserved (struck through, not erased), and with a memo explaining the correction. Corrections done correctly are not findings. Corrections done by erasing and rewriting are findings of falsification.

What it costs to install this discipline

For a typical 3-location DMV group:

Initial I-9 audit and remediation: 40–60 hours of qualified compliance time, typically $4K–$8K in fees
E-Verify setup and training (if not already in place): 8–12 hours, $1K–$1.5K
Quarterly audit going forward: 4–6 hours per quarter, internal time
Third-party platform (optional, recommended at 5+ locations): $400–$1,200 per location per year

Total first-year investment: $5K–$10K for a 3-location group. Annual ongoing cost: $1K–$3K.

Compare to the median NOI outcome for a non-compliant 3-location group: $100K–$300K in technical penalties before any substantive findings.

That is the math. Compliance is not optional and it is not expensive. It is the cheapest insurance the restaurant industry produces.

If you want a structured read on your current I-9 posture across your locations, book a discovery call. Bring a sample of three current I-9s (current employees) and one terminated-employee I-9. We will walk through the technical checklist on the call and tell you what to fix first.

The audit you have not had is the audit you will fail. The discipline that prevents the failure is documentable and cheap. The cost of skipping it is not.