Onboarding Compliance Evidence an Assessor Will Actually Ask For

Picture a mid-size federal contractor receiving a Department of Labor Wage and Hour Division desk audit notice on a Thursday afternoon. By Monday morning, the HR lead has to produce I-9s for 47 current employees and 12 separated employees terminated within the prior three years. Two of the current I-9s were missing Section 2 employer certification signatures. One reverification for a List A document that had expired was never completed. The fine exposure on those three deficiencies alone ran into five figures before the company even opened a conversation with counsel.

That scenario is not unusual. What is unusual is having the evidence package already organized before the notice arrives. This post walks through the specific artifacts assessors, auditors, and contracting officers actually request during onboarding compliance reviews, and what the record needs to show.

I-9 and E-Verify: The First Pull

Every federal contractor audit starts here. An assessor reviewing I-9 compliance is not looking for a binder labeled "I-9s." They are looking for a set of specific, verifiable facts inside each form.

• Section 1 completion date: Must be no later than the employee's first day of employment. A date after Day 1 is a technical violation even if the hire was otherwise clean.
• Section 2 completion date: Must fall within three business days of the first day of employment. The employer or authorized representative signature must be present. A stamped or typed name without a wet or valid electronic signature does not satisfy the requirement.
• Document list accuracy: The document title, issuing authority, document number, and expiration date recorded in Section 2 must match the actual document the employee presented. Assessors sometimes request copies if the employer retained them; if you retained copies for some employees, you must retain them for all employees in the same category.
• Reverification entries: Any List A or List C document with an expiration date requires a Section 3 reverification before that date passes. Missing reverifications are among the most common findings in I-9 audits.
• Retention math: For separated employees, the retention period is three years from date of hire or one year from date of separation, whichever is later. Assessors will ask for terminated employee I-9s within that window.

For E-Verify specifically, the assessor will want case numbers and final results. If your organization is a federal contractor subject to the FAR E-Verify clause (FAR 52.222-54), you are required to run E-Verify on all new hires and on existing employees assigned to covered federal contracts. The case must be initiated no later than three business days after the employee's first day. Tentative Nonconfirmations (TNCs) must be handled through the formal referral and resolution process; a TNC that was simply closed without proper referral documentation is a finding.

Offer Letters and Contractor Agreements

Assessors reviewing labor compliance or contractor classification will pull offer letters and independent contractor agreements. What they are looking for is consistency and specificity.

• Classification language: The offer letter or agreement must clearly state whether the individual is an employee or an independent contractor. Ambiguous language like "project-based engagement" without explicit classification creates exposure under IRS common-law tests and DOL economic reality tests.
• Compensation and FLSA status: For employees, the offer letter should state the FLSA classification (exempt or non-exempt) and the basis of pay. An exempt classification without a corresponding salary basis and a legitimate exemption category is a red flag.
• Signed and dated copies: Both parties must have signed. An offer letter with only the employer signature, or one where the employee signature is undated, leaves the acceptance timeline ambiguous.
• Contractor agreement scope: For 1099 contractors on federal work, the agreement should define the scope of services, confirm the contractor's responsibility for their own taxes, and avoid language that implies behavioral control (set hours, required tools, mandatory attendance at internal meetings).

Electronic Signature Compliance Under ESIGN and UETA

If your onboarding process uses electronic signatures, and most do at this point, the assessor will ask how those signatures were captured and whether the process satisfies the Electronic Signatures in Global and National Commerce Act (ESIGN) and the Uniform Electronic Transactions Act (UETA).

The core requirements are consent, intent, and attribution. The signer must have affirmatively consented to transact electronically, must have taken an action that demonstrates intent to sign, and the signature must be attributable to that specific individual. Your system needs to produce an audit trail that shows the signer's identity verification method, the timestamp, the IP address or device identifier, and the document hash or version that was signed. A PDF with a typed name and no audit trail does not satisfy ESIGN for purposes of a federal contractor compliance review.

Retain the audit trail alongside the signed document. If the document is ever challenged, the audit trail is the evidence. The document alone is not sufficient.

Background Investigation and Suitability Documentation

For contractors requiring facility access or access to federal systems, the FSO or security officer will be asked to produce suitability and investigation documentation. This typically includes:

• SF-86 submission confirmation: Evidence that the Standard Form 86 (Questionnaire for National Security Positions) was submitted through the appropriate system (currently DISS, managed by DCSA) within the required timeframe for the position sensitivity level.
• Interim access grants: If interim access was granted pending investigation completion, the record should show the date granted, the authorizing official, and the basis for the interim determination.
• Adjudication outcomes: Final adjudication notices or clearance grants should be retained in the contractor's security files. The record should also show periodic reinvestigation scheduling for positions requiring them.
• PIV credential issuance: For HSPD-12 compliance, the record should show the identity proofing steps completed before PIV card issuance, including the two forms of identity source documents reviewed and the in-person proofing event.

Training Completion Records

Assessors routinely ask for evidence that required onboarding training was completed before the employee or contractor began work. The specific training varies by contract and agency, but common requirements include cybersecurity awareness training (per FISMA and agency policy), insider threat awareness, and annual ethics training for contractors on certain agency vehicles.

The record needs to show the employee name, the training title and version, the completion date, and a score or pass confirmation if the training is assessed. A spreadsheet with names and checkmarks is not sufficient if it cannot be traced back to a system of record. Learning management system exports with timestamps are the standard.

How to Organize the Evidence Package

The practical answer is a per-employee compliance record that travels with the personnel file from Day 1. Each record should contain the I-9 and E-Verify case number, the signed offer letter or contractor agreement with the ESIGN audit trail if applicable, the background investigation status and clearance record, and training completion exports. When an audit notice arrives, the response package is an assembly job, not a search-and-reconstruct exercise.

Winrove, a product of IT Custom Solution LLC and available at winrove.com, is built around exactly this structure: capturing and retaining each compliance artifact at the point of collection so the evidence package exists before anyone asks for it.

Takeaway

Assessors do not grade on effort or intent. They grade on evidence. An I-9 with a missing employer signature, an E-Verify case opened four days late, or an electronic signature without an audit trail are findings regardless of how well-run the rest of the operation is. Build the evidence package into the onboarding workflow itself, not into a remediation sprint after the notice arrives.

If you want to walk through how your current onboarding documentation holds up against a realistic audit checklist, reach out to the IT Custom Solution team for a brief working session. No pitch, just a practical look at what you have and where the gaps are.