Building a Compliance Program That Survives an Audit

Compliance programs in this area are frequently described as cultures or commitments. Neither can be produced on request. What an auditor, an administrative judge or a debarring official examines is a small set of documents, and a program that cannot generate them is indistinguishable, evidentially, from no program at all.

A named owner with authority

The first element is a person. Verification obligations are distributed across recruiting, human resources, payroll and site management, which means that in the absence of an owner nobody is accountable for the whole. The failures that follow are predictable: a notice routed to a site office and left there, a location whose files nobody has seen, a vendor whose output nobody checks.

The owner needs authority as well as responsibility. The ability to require a location to produce its records, to intervene in a hiring practice that is generating defects, and to escalate enforcement correspondence immediately. Where the correspondence carries a deadline as short as the thirty days described in negotiating a settlement before a hearing, an internal routing delay is a substantive risk.

Ownership also has to survive turnover. A program attached to an individual rather than to a role disappears when that person leaves, and the successor typically inherits the title without the working knowledge. Recording the role in a short description, with the escalation route and the location of the records inventory, is what makes the handover possible at all.

The written policy

The policy states who completes each part of the form and by when, that only the employee or a preparer may complete the employee's section, that the choice of documents belongs to the worker, that copies are either retained for everyone or for nobody, and that nothing is ever backdated or concealed. It should be short enough to be read and specific enough to be followed.

Its value is dual. It tells staff what to do, which reduces defects, and it establishes that the employer had a standard, which is what the good faith factor examines. A policy drafted after a notice arrives has neither effect, because its date is visible and its influence on past conduct is nil.

The policy should also record what the employer has decided in the areas where the rules leave a choice. Whether copies of documents are retained. Whether storage is on paper or electronic, and where. Whether the employer participates in electronic verification and, if so, on what basis. Each is a decision that must be applied consistently, and a decision nobody wrote down tends not to be applied consistently for long.

Training, and why uniformity is the point

Everyone who examines a document, completes a section, or answers a candidate's question about what to bring should be trained, and the training should be recorded. The content is not extensive: the completion deadline, who completes what, the published list of acceptable documents, and the prohibition on steering or demanding particular documents set out in the employee's choice of documents.

Uniformity across sites is what converts training from a good practice into a defense. Where each location develops its own habits, the differences between them are the raw material of a discrimination finding, because variation looks like selection. A single procedure applied everywhere removes the comparison before it can be drawn.

Training also has a refresh problem. Forms are revised, guidance changes, and the people who complete forms move on. A program with a single training event at implementation degrades quietly, and the degradation is invisible until a review or an inspection surfaces it. A short refresh at a stated interval, recorded like the original, is what keeps the evidence current.

The calendar

Three sets of dates need tracking. Completion deadlines, which run in business days from the hire and are missed most often for remote or seasonal hires. Any dates on which a limited authorization requires attention. And the retention schedule, which produces both the date a record may be destroyed and the confirmation that it was, calculated as described in retaining and destroying records.

The third set is the one employers neglect, because destroying records feels like the opposite of compliance. It is not. An unnecessarily large population enlarges what an inspection reviews and, with it, the error rate that positions any penalty. A calendar that only ever adds obligations is doing half its job.

Dates should live in a system rather than in a person. A calendar maintained by one administrator in a personal file disappears when that person changes role, and the obligations it tracked disappear with it. Whatever system holds hiring data is usually the right place for it, because that is where the underlying dates originate and where they are updated.

The review cycle and the response plan

A periodic review, run in tranches rather than as an occasional census, produces corrections and evidence at the same time. Its scoping, sampling and documentation are described in running an internal audit before the government does, and the memorandum it produces is the single most useful document an employer can hold when good faith is being assessed.

Alongside it should sit a short response plan: who is contacted when a notice arrives, who assembles the production, where the records inventory lives, and who instructs counsel. That plan is what turns a three-business-day period into an executed process rather than an emergency, and the production it drives is described in preparing the production an auditor expects.

The plan should also name the moment at which the employer will speak with an immigration lawyer, which is normally on receipt of the notice rather than after the boxes have been assembled. Deciding that in advance removes a judgment call from the one week in which nobody has time to make it, and it is the cheapest line in the whole program.