Top 4 Compliance Risks Stemming from Form I-9

John Fay

Corporate Counsel

2012-11-16 00:00:00.0

During the last few years, the Obama administration has turned up the heat on employers who fail to properly prepare and retain Form I-9, which must be completed for all new hires employed in the United States. Form I-9 collects basic biographical information (name, date of birth, and address) from the employee and requires employers to record documentary proof that the employee is authorized to work in the U.S. While Form I-9 has been around for over 25 years, employers are only now starting to feel the enforcement squeeze because of an increasing number of government I-9 inspections.

Since 2009, the U.S. Department of Homeland Security's Immigration and Customs Enforcement (ICE) has audited more than 7,500 employers and imposed more than $100 million in financial sanctions related to I-9 and worksite violations, as reported by The Wall Street ­Journal in May. While the agency's primary goal has always been preventing unauthorized employment, the government will now routinely issue fines and penalties for simple paperwork mistakes or clerical omissions on I-9 forms.

And yet, as it turns out, these audits (and the resulting fines) are just the tip of the I-9 compliance iceberg. Publicly traded companies now face a myriad of other compliance risks, including Securities and Exchange Commission investigations, whistle-blower complaints, lowered stock values, and shareholder lawsuits, all as a result of poor or insufficient I-9 compliance. While these traditional corporate governance risks will no doubt be familiar to counsel, the emerging I-9 compliance implications may come as a surprise to those who view the I-9 as just another form that must be completed during new hire orientation.

Sarbanes-Oxley section 404 requires companies to evaluate anything that could affect the company and have a direct (or indirect) financial effect for proper process controls. While this typically refers to accounts receivable transactions and cash balances, a company's I-9 forms also clearly fall into the SOX realm, since they involve defined legal rules and various record-keeping tasks. They are also likely to have a material effect on the company's financial statements (in the event of a government fine and audit). Indeed, over the last few years, large organizations have been susceptible to these section 404 reporting requirements as they relate to I-9 compliance. A recent high-profile example involved Chipotle Mexican Grill Inc.

In 2010, Immigration and Customs Enforcement (ICE) began investigating the company after an I-9 audit in Minnesota revealed that many workers had produced "suspect documents" (i.e., those that may be fraudulent or stolen) during the hiring process. In response, Chipotle was forced to terminate approximately 450 employees, which represented more than a third of its Minnesota workforce. In 2011 the ICE investigation expanded to restaurants in Atlanta, Los Angeles, Washington, D.C., and Virginia. Finally, in May 2012, the SEC issued subpoenas to Chipotle seeking information regarding the company's hiring practices and immigration compliance to determine if these issues were properly disclosed to investors in its public filings.

The connection between I-9 compliance (or noncompliance) and disclosure to investors is an important link recently highlighted by corporate governance expert F. Daniel Siciliano, a professor at Stanford Law School. According to Siciliano's tabulations, there is approximately $104 billion in potential liability related to I-9 compliance on U.S. corporate balance sheets today that has yet to be realized. These numbers are based on projected annual I-9 creation, a conservative I-9 error rate of 35.5 percent, and the typical fines issued by DHS. Siciliano estimates, however, that the numbers could be even higher in certain industries that experience frequent turnover.

Your company can greatly reduce its potential exposure to section 404 trouble by creating a culture of I-9 compliance through active partnering with experienced immigration counsel. Immigration attorneys should work with your in-house counsel, procurement departments, and human resources department to determine how your ­organization can improve its I-9 compliance through training, effective policies, and adoption of a well-crafted electronic I-9 solution that eliminates costly mistakes. A thoughtfully constructed system can also help your organizations manage any existing liability on your books by offering remediation tools that can be used under the advice of counsel.

The rise in whistle-blower protections—and temptations—in recent years is another factor that demands greater vigilance and proactive policy implementation on your part. With the passage of the Dodd-Frank Wall Street Reform and Consumer Protection Act in 2010, employees now have financial incentives to report securities or other SEC–related violations. Under Dodd-Frank, an undisclosed financial risk, or even a books and records problem, is a money-making opportunity for a whistle-blower, according to the SEC's website and the U.S. Senate Banking ­Committee. Specifically, provisions in the act reward whistle-blowers who report securities violations, giving employees a financial incentive to report unreliable processes and insufficient controls. This includes I-9 compliance problems.

A prime example of the damage whistle-blowers can cause can be seen in the recent case against a high-profile India-based consulting company. The whistle-blowing incident not only prompted investigations by different government agencies for potential visa and tax fraud, but also led to ongoing negative publicity surrounding the lawsuits and the investigations.

The only way to protect against this particular risk is to ensure that the I-9 process is compliant and that there are mechanisms in place to correct, train, retrain, and discipline em­ployees who are found to be engaging in noncompliant activities.

Financial markets today are much more responsive than in years past. Ongoing news cycles, news blogs, Twitter, and Facebook have all enabled the consumption of news data at a much faster pace than was formerly the case. Reports of whistle-blower lawsuits or investigations by the SEC (or any other government agency) will likely trigger stockholders to react by selling shares. This effect in the financial markets is indicative of the increasing savvy of stockholders and their ability to respond with their feet. American Apparel Inc., for example, suffered a drop of its stock price by 41 percent after reporting second-quarter losses in 2010 as a direct result of having to let go more than 1,600 non-work-authorized employees following an I-9 investigation.

By implementing an I-9 process that serves to address hiring needs while still meeting legal requirements, companies can avoid fluctuating stock prices and the resulting negative press.

Class action lawsuits are another real-world possibility for those companies that fail to accurately forecast or report the financial blowback from I-9 audits. From 2010 to 2011, there was a significant uptick in class action lawsuit filings, according to a recent Cornerstone Research Study that was reported by Stanford Law School. Most of these "kitchen sink" filings include an I-9 compliance component as well. To compound this matter, many large publicly traded companies have an ethics code that requires companies to aggressively address the risks of potential civil and criminal liability, though the practice varies from company to company.

Successfully developing an organization's I-9 compliance culture requires leadership from the top down to change the view of the I-9 from a simple paperwork function to a grown-up compliance process. Treating the I-9 as a critical control function within your company requires time and resources specifically dedicated to its compliance. As with other internal financial controls and processes, you should promulgate discrete protocols for training, retraining, disciplinary action, where needed, and remediation. And you should set up regular audits, preferably conducted by an independent party that does not participate in the everyday I-9 protocols or record-keeping of your company.

Many employers and counsel may still not be aware of the risks entailed by poor I-9 compliance, especially as it relates to SEC filings and shareholder value, but there are plenty of white papers and other resources to draw on to help inform stakeholders of the significant risk. Partnering with experienced immigration counselors, employment counselors, and I-9 software experts can make all the difference between a vibrant compliance culture and one that is on the brink of an investigation by multiple government agencies.

John Fay, an immigration attorney with a background in designing technology for HR compliance, is general counsel and vice president of product development at ­LawLogix Group Inc.