Payroll hits, finance opens a spreadsheet, and one contractor's file looks off. Maybe the passport photo doesn't match the copy, maybe the work authorization has expired, maybe someone in ops assumed “HR probably handled it.” That's how a routine week turns into a compliance mess, and why work authorization verification should be treated like an operating discipline, not a clerical afterthought.
If you hire in the U.S., Canada, or across borders, the stakes are the same even when the forms aren't. Get this wrong and you don't just invite audit pain, you risk delayed starts, withheld pay, and a lot of wasted founder time that should've gone to revenue, not document archaeology. If you're also trying to keep up with compliance with AI hiring legislation, the lesson is simple, compliance is now part of the hiring product, not a back-office side quest.
The mistake many teams make is waiting until a problem surfaces. By then, someone's already onboarded, payroll has already kicked in, and the “quick fix” becomes a late-night scramble with legal, finance, and whoever drew the short straw in operations.
That's why work authorization verification belongs in the same bucket as access control and vendor payment approval. It protects the start date, the billing cycle, and the paper trail. It also keeps you from discovering, after the fact, that a person who was supposed to be billable wasn't cleared to work.
I've seen teams treat verification like a one-time upload. That's fine right up until a contractor's authorization expires, a remote inspection was handled loosely, or a manager assumes a 1099 label makes the issue disappear. It doesn't.
The modern hiring stack adds more ways to mess this up. Remote work means fewer in-person checks. Cross-border hiring means more document types. Contractors complicate things because people want the simplicity of flexible labor without the discipline that flexible labor requires.
Practical rule: if a hire can affect payroll, access, or client delivery, verification has to happen before the person becomes operational.
For a broader operating view, it helps to think about how compliance frameworks intersect with hiring tech and global HR compliance. The point isn't to worship process. The point is to stop avoidable breakage before it becomes expensive.
In the U.S., the backbone is Form I-9. USCIS says every U.S. employer must properly complete Form I-9 for every person they hire for employment in the country, including citizens and noncitizens, because the form exists to verify identity and employment authorization. That framework traces back to the Immigration Reform and Control Act of 1986, while E-Verify began as the Basic Pilot Program in 1996 to help employers confirm whether newly hired workers are authorized to work in the United States (USCIS Form I-9 guidance).
The employee must complete and sign Section 1 on the first day of employment. The employer then has three business days to finish Section 2 after inspecting acceptable documents. If the hire lasts fewer than three business days, Section 2 has to be done before the end of the first day of work (Form I-9 timing guidance).
That's not a “when convenient” rule. It's a deadline. The fastest way to create a paper trail you'll regret is to let onboarding drift because someone's waiting on payroll, signature routing, or a manager who's in three meetings and two airports.
E-Verify sits on top of that. It's not universal for private employers, but it is required for the federal government, its contractors, subcontractors, and many employers under state rules. Think of I-9 as the required audit trail and E-Verify as the database-based second opinion you use when your rules or contracts demand it.
E-Verify compares the Form I-9 information against records held by the Social Security Administration and the Department of Homeland Security. That shift from document inspection to records matching is useful, but it also means data quality matters. If the name is off, the numbers are off, or the identity data doesn't line up cleanly, the system can flag a case that a human still has to sort out.
Short version: I-9 proves you checked. E-Verify helps prove the records agree.
For teams that also need Identity verification, the lesson is similar. Don't confuse “we collected something” with “we verified it correctly.”
At scale, E-Verify is an operations system, not a nice-to-have admin tool. DHS-related reporting says the program handled about 43.5 million evaluations in fiscal year 2024, with over 11.5 million in the final quarter alone (fiscal 2024 E-Verify reporting). A platform does not survive that kind of load unless employers treat work authorization verification like a real process with owners, checkpoints, and cleanup for exceptions.
Roughly 98.3% of queries were confirmed as work-authorized either instantly or within 24 hours, about 1.5% were found not authorized, and the rest were later resolved. Most clean cases move fast. The expensive work sits in the small pile that does not.
That is why I reject the fantasy that verification should be “fully automatic” in the loose startup sense. It is automated the way a freight elevator is automated. The machine carries the load, but someone still has to control the flow and deal with the cases that stall.
Earlier program materials also described very high automated confirmation rates, and policy analysis has cited a 99.87% accuracy rate reported by USCIS. Different reporting frames, same operational lesson. The system clears most eligible workers quickly, but every exception still needs a human who knows what to do next.
The core issue is not volume. It is mismatch handling, identity consistency, and employer discipline. If your team does not know who owns the case when a query does not resolve cleanly, the process turns into a waiting room and the hire sits there burning time.
Operator's note: if a compliance tool only looks smooth in demos, side-eye it. Real value shows up when the weird case lands at 4:45 p.m. on a Friday.
For teams comparing workflow layers, Identity verification matters for the same reason. Collecting data is easy. Verifying the right person against the right records, then resolving the edge case without sloppy judgment, is the part that protects you. The DHS work authorization verification system is the control layer, not the hiring strategy. The strategy still belongs to you.
Canada is friendlier on the surface and more procedural underneath. The Canadian version of verification usually starts with the worker's right-to-work status, then moves to the Social Insurance Number, or SIN, as the identifier employers collect for payroll and reporting.
A SIN is not a magical proof of work authorization by itself. It's the number employers use to track pay, tax, and government reporting. The actual question is whether the person has the right permit or status to work in the first place.
That means your hiring team has to separate three things cleanly. First, the worker's authorization category. Second, the permit, if one is needed. Third, the SIN collection step that lets payroll function normally. Mix those up and you create privacy issues on top of compliance issues.
For open work permits and employer-specific permits, the document review has to match the role and the duration of the engagement. If the person is on a permanent resident path, the logic changes again, because the right-to-work basis may not look like a temporary permit at all. The mistake I see most often is U.S.-trained teams asking Canadian hires to produce the wrong proof, then pretending the resulting confusion is “just onboarding noise.”
The cleaner move is to verify the worker's category before offer acceptance, then collect the SIN only when payroll needs it. Keep the process narrow, and don't store more than the business needs. That's not bureaucracy, that's basic operational hygiene.
For teams doing both countries, the difference is simple. The U.S. leans on I-9 plus E-Verify. Canada leans on permit status plus SIN. Both need records, both need timing discipline, and both punish the manager who waits until the first paycheck to ask questions.
Most companies don't blow this up by ignoring verification entirely. They blow it up by getting almost all the way there and missing one tiny, miserable detail. That's how audits get ugly.
According to guidance summarized from the M-274, reverification is not required for U.S. citizens, noncitizen nationals, lawful permanent residents who presented Form I-551, or anyone who used a U.S. passport, U.S. passport card, or List B identity document. It is required for many time-limited work-authorization documents, including most EADs, a foreign passport with a temporary I-551 stamp, and certain refugee or asylee documents when the authorization expires (reverification guidance).
That's the trap. Teams remember the initial hire, then forget the expiration date. The fix is boring and effective. Track expiration dates at onboarding, assign one owner, and trigger reviews early enough that payroll doesn't learn about the issue on the day the document dies.
DHS's optional alternative procedure lets qualifying E-Verify employers inspect new hires' identity and work-authorization documents remotely, but only if they do it within three business days of the employee's first day, check the relevant box on the newer Form I-9, and retain clear, legible copies of the documents. Employers that used the COVID-era remote flexibility also had to re-inspect those documents in person or via the alternative procedure by August 30, 2023 (DHS remote inspection rule summary).
That's not “remote-friendly enough to improvise.” It's a gated exception with rules. If your team treats it like a casual upload flow, you're gambling with a form that exists specifically so you don't have to gamble.
If someone works like a W-2 employee but your contract calls them a 1099, that label doesn't protect you from the underlying reality. The system cares about the relationship, not the sticker. That's why a sloppy contractor setup can turn into a compliance headache even when the person's work authorization itself is fine.
For teams trying to clean up intake before the paperwork starts, background verification process is worth lining up with the right workflow. Separate identity, authorization, and worker classification. Then keep them separate.
If payroll is due Monday and legal is already asleep in another time zone, this is the process I trust.
The order matters because each step closes a different hole. Skip one, and you do not have a process, you have a liability with a polite label.
For teams tightening intake before anyone signs anything, pre-employment screening basics should sit beside your hiring checklist, not buried in a separate SOP. Keep role eligibility, identity checks, and worker classification in different lanes. That separation saves you from mixing a hiring decision with a paperwork cleanup.
Keep the verification record, the signed form, and any required copies in a restricted system. Do not scatter them across Slack, email, drive folders, and someone's desktop named “final_final2.” Once sensitive documents are everywhere, nobody can tell who touched what.
Access should stay narrow. HR or operations should own the file, managers should see only the status they need, and finance should get what it needs without becoming document reviewers. That setup protects privacy and keeps onboarding and payroll moving without turning every hire into a scavenger hunt.
If the status can expire, schedule a review before it expires.
That applies to temporary work authorization, renewal-based engagements, and anything else that becomes expensive the moment nobody owns the calendar.
A decent hiring platform should reduce the stupid stuff, not dress it up. The useful ones combine candidate matching, background checks, payroll support, and legal compliance into one flow so hiring teams aren't stitching together five tools and a prayer.
That's where LatHire is relevant. It's built to handle cross-border hiring with verification and compliance baked into the workflow, which is the right instinct if you're hiring in the U.S. and Canada at the same time. The key win is less tool sprawl and fewer handoffs, not magical thinking.
The cut-through is simple. Let the platform manage the repeatable parts, especially where remote inspection, international payroll, and document handling overlap. Keep a lawyer or specialist for edge cases like disputed classification, unusual expiration paths, or anything that smells like a jurisdictional headache. That's not me hedging. That's me refusing to mortgage your office ping-pong table for a preventable mistake.
If your hiring process still treats work authorization like a last-mile admin task, fix that now. Tighten the checklist, assign one owner, and stop letting managers improvise around deadlines. If you want a cleaner cross-border workflow without building the entire compliance stack yourself, evaluate LatHire with your next U.S. or Canada hire and see whether it can absorb the verification drag before it lands on your team.