The Compliance Calendar: Never Miss an I-9 or W-4 Expiration Again

Most HR mistakes are loud. Someone's offended, someone quit, someone's in your office. But the most expensive ones are silent: a work authorization that expired eight months ago and nobody reverified, an I-9 that was filled out wrong in 2023 and never corrected, a set of payroll records you tossed two years too early. Nothing happens — right up until an audit notice arrives, and then a year of quiet oversights becomes a stack of per-form penalties all at once.

This is the part of HR nobody warns you about when you're the only one doing it. Compliance isn't a project you finish and check off. It's a calendar you maintain — a rolling set of dates, expirations, and renewals that have to be caught before they lapse, by someone whose job is to remember. In a small company, that someone is you, buried under everything reactive, with no system quietly counting down the dates in the background. So they slip. Not because you're careless — because there's no machine watching the clock.

Here's how to build that machine. Not a binder. A calendar.

Why compliance slips on small teams (it's structural)

Every compliance obligation has the same dangerous shape: it's invisible until it's a crisis, and the gap between "fine, I'll deal with it later" and "we're being audited" can be years. There's no angry customer, no Slack ping, no deadline that announces itself. A document with an expiration date three years out generates exactly zero urgency today, which means it generates zero action today — and three years later, the person who would have remembered has changed jobs, or simply forgot, because nothing ever reminded them.

Big companies solve this with a compliance team and an HRIS that throws alerts. The HR-of-one solves it with heroics and a good memory, until the day the memory fails. The penalties are real: paperwork-only I-9 violations carry per-form fines that escalate fast across a roster, and that's before you get to the harder consequences of employing someone whose authorization actually lapsed. The fix is not to try harder. It's to stop relying on memory at all.

Step one: inventory everything that expires

You can't put dates on a calendar until you know which obligations have dates. Walk your operation and list every time-bound item. For most small employers, they fall into seven buckets:

• Work authorization & I-9. Employees with time-limited work authorization need reverification before it expires. The expiration date is the trigger; missing it is one of the most common and costly slips.
• Tax & payroll forms. W-4 changes when an employee's situation changes, new-hire reporting deadlines, year-end W-2 timing, and the state equivalents.
• Document retention & destruction. I-9s, payroll records, benefits records, and applications all have minimum retention periods — and keeping them too long can be its own liability. Both the "keep until" and the "safe to destroy after" are dates.
• Training & certification renewals. Anti-harassment training (required on a cycle in several states), safety certs, role-specific licenses. Each renews on a clock.
• Postings & notices. Labor-law posters and required notices change when laws change. An out-of-date poster is a citation waiting to happen.
• Benefits & ACA deadlines. Open enrollment windows, ACA reporting if you're at that size, COBRA timelines, plan notices.
• Policy attestations. Handbook acknowledgments, code-of-conduct sign-offs, and policy updates that need a fresh signature when they change.

Write down every item that applies to you, even the ones that feel far off. The far-off ones are exactly the ones that slip.

Step two: turn the inventory into a dated, alerting calendar

Now make each item a recurring entry with a lead-time alert — not the deadline itself, but a reminder early enough to actually act. The deadline is useless on a calendar; by the time it fires, you're already late. The lead time is the whole point.

1. Give every item a trigger date. An expiration, a renewal cycle, a fixed annual date.
2. Set the alert ahead of it. Sixty days before an I-9 reverification. Thirty days before a training renewal. A quarter before open enrollment. Enough runway to gather documents and not panic.
3. Attach the next action to the alert. The reminder shouldn't just say "I-9 expiring" — it should say "reverify Section 3 before [date]; do not re-request specific documents." The alert that doesn't tell you what to do still leaves you to figure it out at the worst moment.
4. Make it recurring. Renewals repeat. Set them once so next year's deadline is already on the calendar this year.

Step three: one source of truth, per employee

The thing that actually fails small teams is fragmentation — expiration dates living in a folder of PDFs, a spreadsheet someone started, and one person's head. You need a single place that tracks, per employee, what's on file and when each thing expires. One view you can scan to answer "whose authorization lapses this quarter?" without opening twenty documents.

It doesn't have to be fancy. A maintained spreadsheet beats a sophisticated system nobody updates. What it can't be is three places. If a date can hide, it will.

The one workflow worth getting exactly right: I-9 reverification

I-9s cause more small-employer pain than any other compliance item, and reverification is where it concentrates. A few rules that keep you out of trouble:

• Reverify before the authorization expires, using Section 3 (or a new section per the current form) — caught by your 60-day alert, not discovered after the fact.
• Never re-do Section 1. The employee's original attestation stands; you're updating, not restarting.
• Never tell the employee which document to present. They choose from the acceptable list. Demanding a specific document — or over-documenting — is document-abuse discrimination, a separate violation. The compliance fix and the anti-discrimination rule point the same way: watch the date, let the employee choose the proof.
• Don't reverify U.S. citizens or permanent residents' List B/expired-document situations that the rules exempt. Reverify only what the form actually requires — over-reverifying is its own problem.

The audit-ready file

Compliance you can't prove is compliance you don't have. Keep the records an auditor would ask for, for the period required, in a form you could produce on short notice: I-9s stored separately from personnel files (so an audit doesn't expose unrelated records), retention clocks tracked so you neither destroy too early nor hoard too long, and a simple log of what you reverified and when. The goal is that an audit notice is a filing exercise, not a fire drill.

Where software earns its place — and where it doesn't

Everything above can run on a spreadsheet and a calendar with reminders. That's genuinely how I'd start, because the discipline matters more than the tooling. But a compliance calendar is the textbook case of a system that fails manually: it only works if someone updates it every time a person is hired, a document changes, or a law moves — and it only pays off on a date that might be two years away. That is precisely the kind of recurring, low-urgency, high-stakes maintenance that quietly stops happening the first busy month.

So the right job for software here is narrow and honest: watch the dates and surface the next action with lead time. Not make the legal call — flag the deadline and tell the human what's due, so a person decides and acts in time. That's exactly the line we hold in our take on AI in HR: the machine handles the watching and the structure; the human owns every judgment and every legal determination. HRByDesign tracks I-9 and W-4 expirations and the rest of the compliance calendar this way — counting down the dates in the background and surfacing each one with its next action, so the silent slips stop being silent.

A necessary note: this is operational guidance, not legal advice. Compliance obligations vary by federal, state, and local law and by your company's size and circumstances — confirm specifics with qualified employment counsel before you rely on them.

Closing

The reason these mistakes are so common isn't negligence. It's that compliance asks you to remember things that won't matter for months or years, while everything in front of you is on fire today. Memory is the wrong tool for that. A calendar is the right one.

Inventory what expires. Put every item on a dated alert with lead time and a next action attached. Keep one source of truth per employee, and an audit-ready file you could produce tomorrow. Do that, and the I-9 you would have forgotten becomes a reminder you handle in ten minutes, sixty days early — and the audit notice, if it ever comes, is a filing exercise instead of a very bad week.

Compliance is a calendar, not a crisis. Build the calendar once; let it do the remembering.

— Tom