Employee Background Checks for Security Roles

What screening can and cannot establish

A useful programme starts by being honest about the boundary. Screening can verify that a person is who they claim to be, that they worked where they said they worked, that a qualification exists, that a criminal record does or does not appear in a particular jurisdiction's records, and whether an individual appears on a sanctions or politically-exposed-person list. Those are checkable facts held by someone other than the candidate.

Screening cannot establish intent, reliability under pressure, honesty in a new context, or future behaviour. It cannot see an unrecorded offence, an offence committed abroad, a settled civil dispute, or the fact that a person who passed a check five years ago has since developed a gambling problem, a debt crisis or a grievance against the company. It also cannot see the risk that most often materialises: an employee with legitimate access who decides, at some point, to misuse it.

Two consequences follow. First, screening is one control among several, and it should be designed to answer only the questions it can. Second, every check you add has a cost: money, time-to-hire, candidate experience, legal risk if the check is not permitted, and a false-positive rate that rejects good people. The discipline is not adding checks until the process feels thorough; it is adding the checks that map to a specific risk in a specific role and being able to justify each one in writing.

Start from the role, not from the checklist

Most screening programmes are built from a generic form that everyone completes, which produces two failures at once: roles that need deep verification get a shallow check, and roles that need almost none get an intrusive one. The alternative is to tier roles by the risk they actually carry, and to write the tiering down so it can be defended.

Tier 1 - baseline verification, for most roles. Identity, right to work, and confirmation of the employment and qualifications claimed in the application. No criminal record check unless the role is eligible for one under local law. This tier exists to stop impersonation and invented credentials, which are the two most common pre-employment frauds.

Tier 2 - roles with elevated access or fiduciary exposure. Finance, procurement, payroll, HR information systems, and anyone who can move money or change payee details. Add a check for undisclosed directorships or business interests that could create a conflict, and for professional standing where a licence is required.

Tier 3 - privileged technical access. System administrators, cloud and identity engineers, anyone with production access or the ability to grant it, and anyone who will hold the keys to backups. This tier needs the same checks as tier 2 plus a harder conversation about access governance, because the technical controls around the role matter more than the check itself.

Tier 4 - regulated activity. Roles working with children or vulnerable adults, or otherwise falling inside statutory vetting regimes. These are defined by law rather than by employer preference, and the eligibility rules are strict. In the United Kingdom, for example, a standard or enhanced DBS check can only be requested if the role falls within the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 and the Police Act 1997 provisions, and it is an offence to submit an application for an ineligible role.

Tier 5 - senior and board-level appointments. Add sanctions and politically-exposed-person screening, media and litigation checks where lawful, and a documented conflict-of-interest declaration. The purpose is not to catch wrongdoing but to avoid an appointment that becomes a governance problem: a director disqualified elsewhere, a sanctioned individual, an undisclosed role at a competitor.

The tiering also determines depth. Verifying five years of employment history is proportionate for a tier 3 role and disproportionate for a warehouse role that has no access to systems, money or vulnerable people. There is no single correct number of years; there is a defensible number, and the rationale should live in the policy rather than in someone's memory of how it has always been done.

The five verification layers, in the order they should run

Order matters because each layer can invalidate the next. Verifying employment history for someone whose identity is fabricated wastes money and produces a report that looks thorough and means nothing.

Layer 1 - identity. A government-issued photographic document checked for authenticity, ideally with a liveness or biometric comparison where the law permits and the population can comply. The failure mode to design against is not the obvious forgery; it is the genuine document belonging to someone else, presented by a person whose appearance and story are consistent with it. Address history is verified in this layer, because the address determines which jurisdiction's records are searched later.

Layer 2 - right to work or right to remain. In the UK this means a document check or a Home Office online share code, repeated at the point of a time-limited permission expiring. In the EU, the employer's obligations flow from national implementation of the single-permit framework and vary by member state. In the US, the I-9 process and E-Verify where applicable. This layer is a legal obligation rather than a discretionary control: getting it wrong produces civil penalties regardless of what the person does afterwards.

Layer 3 - history. Employment dates, job titles, reason for leaving where obtainable, and qualifications or licences verified with the issuing body rather than accepted from a certificate image. Most fabricated employment claims are small: a title inflated, a gap filled, a degree awarded by an institution that does not exist. The check catches them because it compares against a source the candidate does not control.

Layer 4 - legal history, where eligible. Criminal record checks are the layer where programmes most often go wrong: either the check is not permitted at all for the role, or the result is used without an individualised assessment. This layer is treated separately below because the legal frame differs so much between jurisdictions.

Layer 5 - specialised checks, for defined roles. Sanctions and PEP screening for senior appointments and for roles handling cross-border payments; professional registration checks for regulated professions; financial probity checks for roles with delegated financial authority, where local law permits them; and media or litigation checks for public-facing senior hires, subject to a documented necessity assessment.

The American frame: FCRA, adverse action, and a rescinded guidance that still matters

Where a third-party consumer reporting agency produces the report, the Fair Credit Reporting Act governs the process, and its requirements are procedural in a way that punishes good intentions. The obligations sit in sequence:

• A clear and conspicuous written disclosure, in a stand-alone document rather than buried in an application, that a consumer report may be obtained for employment purposes.
• Written authorisation from the candidate before the report is obtained.
• A pre-adverse action notice if the report may lead to a decision against the candidate: a copy of the actual report, not a summary, plus the CFPB summary of rights, and a reasonable opportunity to dispute. Five business days is the working standard the FTC has signalled.
• A final adverse action notice if the decision is made: the agency's name, address and telephone number, a statement that the agency did not make the decision, notice of the right to a free copy of the report within 60 days, and notice of the right to dispute accuracy.

The step that is most often skipped under time pressure is the pre-adverse one, because it delays a hire by a week and the hiring manager has already moved on. It is also the step that most litigation turns on, and it produces a better decision: a meaningful share of reports contain information that is inaccurate, out of date, or attributable to a different person with the same name, and the candidate is the only party who can identify that quickly.

On criminal records specifically, the federal picture changed in October 2026. The EEOC rescinded its 2012 enforcement guidance on arrest and conviction records, removing the agency's stated policy interpretation from the field. What did not change is the statute: Title VII still prohibits criminal history screening that produces a disparate impact on a protected group unless the practice is job-related and consistent with business necessity. The framework courts have used for that analysis - the three factors from Green v. Missouri Pacific Railroad: the nature and gravity of the offence, the time elapsed since the offence or completion of sentence, and the nature of the job - remains the practical test, and remains the reasoning that a defensible adjudication matrix should follow.

Two further American points are worth flagging because they are frequently missed. First, state and city law can be stricter than the federal floor in ways that change the sequence, not just the content: some jurisdictions bar the criminal history question until after a conditional offer, and some require an individualised assessment with a defined content. Second, a report produced internally rather than by a consumer reporting agency is outside the FCRA's process requirements but not outside discrimination law, privacy law or negligence - so "we do our own checks" is not a compliance shortcut.

The European frame: GDPR, purpose limitation, and a delayed AI rulebook

In the European Union and the wider GDPR sphere, screening is a personal-data processing operation before it is anything else, and the questions are permission, necessity and proportionality rather than procedure.

Legal basis. Consent is a fragile basis in an employment relationship, because refusal is not realistically free. The practical basis for most screening is that processing is necessary for the performance of a contract or for legitimate interests, supported by a documented balancing test, and in some member states by works-council agreement. Where the check is required by law, that provides its own basis for the specific check the law requires - and only that check.

Criminal record data. Article 10 GDPR treats criminal convictions and offences as a special category: processing must be authorised by Union or member state law with appropriate safeguards, or take place under official authority. That means a criminal record check that is lawful in one member state may be unavailable in another, and an employer operating across borders cannot apply a single European policy. National rules also differ on spent convictions and on how far back records may be considered.

Automated decisions. Article 22 restricts decisions based solely on automated processing that produce legal or similarly significant effects. A screening platform that scores candidates and auto-rejects is exactly the fact pattern that provision addresses; a human decision-maker with access to the underlying report is the practical safeguard, and the human has to actually look.

The AI rulebook and its new dates. The EU AI Act treats recruitment and worker-management systems as high-risk under Annex III, with obligations around risk management, data governance, logging, human oversight and transparency. Those Annex III obligations were originally scheduled for 2 August 2026. Under the Digital Omnibus package adopted in July 2026, they now apply from 2 December 2027, while enforcement of the Act's prohibitions and transparency duties began on 2 August 2026. One prohibition is relevant to screening immediately and is not a disclosure problem: emotion recognition in the workplace and in education is banned under Article 5, with narrow medical and safety exceptions. A vendor offering "sentiment" or "emotional fit" analysis of video interviews is offering a prohibited practice, not a feature.

Retention. Screening data is retained for a defined purpose and a defined period. A common and defensible pattern is to keep the report for the duration of any dispute or statutory claim window and then delete it, while keeping only the minimum decision record - the fact that a check was completed, its date, and the outcome category - rather than the full report with its address history and document numbers.

The UK frame: DBS levels, spent convictions and eligibility

The United Kingdom runs a statutory vetting system rather than a market one, and the employer's first duty is to establish whether it is entitled to ask at all. Four levels exist, and the differences are not cosmetic:

• Basic. Unspent convictions and unspent conditional cautions. Available for any role, and the only level an employer may request without an eligibility test.
• Standard. Spent and unspent convictions, plus adult cautions, subject to the DBS filtering rules. Available only for roles listed in the Exceptions Order - typically those involving regulated activity with children or vulnerable adults, or specified professions.
• Enhanced. A standard check plus a search of the police local records for relevant information. Available only for specified roles, and additionally required for certain regulated activity.
• Enhanced with barred list check. Adds a check of the children's or adults' barred list, and is only available where the role constitutes regulated activity - which has a specific legal definition and is narrower than most people assume.

Submitting an application for a level the role is not eligible for is an offence, which is why the eligibility decision belongs in the policy with a named owner rather than in a recruiter's judgement. The same principle governs the Rehabilitation of Offenders Act 1974: spent convictions are protected unless the role falls within the Exceptions Order, and in a number of roles the filtering rules remove old and minor cautions and convictions from the certificate entirely.

Two 2026 changes matter in practice. Since 21 January 2026, self-employed individuals can apply for an enhanced DBS check through an umbrella body where the work meets the eligibility criteria, which closes a gap that previously pushed sole traders into unverified subcontracted work. And the broader direction of travel is towards reuse: an increased emphasis on updated and portable checks for people who move between roles, which reduces cost but puts more weight on verifying that the certificate actually belongs to the person and the role in front of you.

Right to work is a separate regime from criminal records and is checked separately, whether by document inspection or by the Home Office online service using a share code. For time-limited permissions, the check has to be repeated before expiry, and the record of the check has to be retained for the statutory period. In regulated sectors, additional registration checks apply - the Teaching Regulation Agency, the General Medical Council, the Care Quality Commission's fit-and-proper-person requirements - and those registrations should be verified with the register, not with the candidate's screenshot of it.

Consent, proportionality and the paper trail

Whatever the jurisdiction, three artefacts carry the programme if it is ever challenged: what the candidate was told, what they agreed to, and what was decided and why. None of them need to be elaborate, and all three are routinely missing.

What they were told. A privacy notice written for candidates rather than copied from the corporate one, naming the checks, the sources, the retention period and the rights available. The test is whether a reasonable person could read it and know exactly what would be checked and for how long it would be kept.

What they agreed to. A specific authorisation, captured with a timestamp, that names the checks. A blanket "I consent to all checks the company deems necessary" is weak on both GDPR and FCRA grounds because it is neither specific nor informed, and it gives the candidate nothing to challenge later.

What was decided and why. An adjudication record for each candidate, including those who passed: which tier applied, which checks were completed, what was found, and the reasoning where something was found. Where the outcome was adverse, the record should show that a person reviewed the report rather than a rule firing, and that the candidate had an opportunity to respond.

Proportionality is the thread running through all of it. A check that is proportionate for a finance director is not proportionate for a delivery driver, and the difference has to be visible in the documents rather than asserted in a meeting. Where a regulator or a tribunal looks at a programme, it is looking for evidence that the employer thought about the specific role - not evidence that the employer applied the same process to everyone.

Where screening goes wrong: data quality

The gap between what a screening report claims and what it establishes is the most under-discussed risk in the whole process, and it cuts both ways. An error can reject an innocent candidate, and the same error class can clear someone who should have been caught.

The evidence for the first direction is unusually blunt. A study published in the journal Criminology & Public Policy in 2022 ran identically constructed test candidates through commercial background checks and found that roughly half of the reports on regulated checks, and roughly 60% on unregulated ones, contained at least one false-positive error - an offence attributed to the applicant that was not theirs. False negatives were higher still, with about nine in ten reports missing at least one offence that should have appeared. The authors' conclusion was not that screening is worthless but that it is frequently inaccurate in ways the buyer cannot see.

The second direction shows up in complaint data. The Consumer Financial Protection Bureau reported around 191,000 complaints about background check accuracy in 2020 alone, and inaccurate matching - typically a common name, a date of birth off by a digit, or a records search conducted in the wrong jurisdiction - is a recurring theme in fair-credit litigation. The practical implication for an employer is that the pre-adverse action step is not a formality: it is the quality-control mechanism, and skipping it converts the vendor's error rate into your hiring decision.

There is also a measurement trap worth naming, because vendors use it. Dispute rates are not error rates. A low dispute rate can mean the reports are accurate, or it can mean candidates never received the report, or that the process for disputing is difficult, or that the population screened has no realistic route to complain. A programme that treats a low dispute rate as evidence of accuracy is measuring its own lack of contact with candidates.

A vendor that cannot answer the first two questions precisely is reselling someone else's data, which means the employer's dispute process depends on a chain of suppliers it has never audited. That is not a reason to refuse all aggregators; it is a reason to know which chain you are in and to write the disclosure requirement into the contract.

Reference checks: what they actually return

Reference checks are the most over-trusted and least informative element of most programmes. Many employers now give only dates and job title, because of litigation fear and policy, which means the check confirms what the employment-history check already established and adds nothing about conduct. When a reference does say more, it is often unstructured, generous, and shaped by the referee's own incentives.

What makes references worth the call is structure. Ask about specific, observable behaviour in a defined situation rather than about character: how the person handled a disagreement with a manager, what happened when a project slipped, what they were trusted to do unsupervised, what their manager would have wanted them to do differently. Ask the same questions of every referee for the same role, so the answers can be compared. Record the answers, and keep them with the adjudication record.

Jurisdiction matters here too. In some countries a former employer may only confirm dates and title, and asking for an assessment of character may be unlawful or may expose the referee to a claim. In others, a reference is expected to be candid and can attract liability if it is negligently positive. The practical rule is to ask the candidate to nominate referees, to verify that the referee actually managed them, and to avoid designing a process that depends on information the referee is not permitted to give.

Criminal record decisions: the individualised assessment

Where a criminal record check is lawful and something is found, the decision is where the programme either works or becomes a liability. A rule that automatically excludes anyone with a conviction is simple, cheap, and - in most jurisdictions - legally exposed, because it treats a record as a proxy for risk without examining the link to the role.

The assessment that survives scrutiny considers the record against the job, not against a moral standard. Four questions do most of the work:

• What was the offence, and does it relate to the duties? A conviction for fraud is directly relevant to a role with payment authority. A conviction for a driving offence is not relevant to a software engineering role, unless the role involves driving.
• How old is it, and what has happened since? Time since the offence and since the end of any sentence, plus evidence of rehabilitation, are the factors most consistently applied. A ten-year-old single offence with no repeat is a different proposition from a recent pattern.
• What were the circumstances and the sentence? A conditional discharge or a caution is not the same as a custodial sentence, and the adjudication matrix should say so rather than treating all recorded events as equivalent.
• What is the actual access in this role? Money, systems, vulnerable people, customer data, unsupervised premises. The narrower the access, the weaker the case for exclusion on historical grounds.

Two procedural elements turn the assessment from an assertion into a decision. First, the candidate gets the record and the opportunity to explain, in writing, before the decision is made - not after. Second, the reasoning is documented in a form that a third party can review: which factors were considered, what was found, what was weighed, and why the outcome follows. Where the employer uses a matrix, an automatic "disqualifying offence" list should be short, role-specific, and reviewed by counsel, not a general list of everything the company finds distasteful.

The assessment framework, written down

A workable adjudication framework has three outcomes rather than two, which is the difference between a policy and a filter:

Clear. Nothing material found, or something found that is not relevant to the role and within the retention window. Proceed, and record why the result was clear so the same reasoning is applied next time.

Review with the candidate. Something found that may or may not be relevant. The candidate is given the information, invited to provide context - circumstances, rehabilitation, time elapsed - and a named decision-maker considers it against the role. Most records land here, and most of these end in a hire. That outcome is not a failure of the programme; it is the programme working.

Do not proceed. A record that directly undermines the specific duties of the role, with no mitigating context: a fraud conviction for a role with sole control of payments, an offence against a vulnerable person for a care role. Even here, the adverse action process has to run, and the reasoning has to be written down.

One further point, because it is a live issue in the United States after the 2026 rescission of the EEOC guidance: the absence of a federal policy statement does not make a blanket exclusion safe. The disparate-impact theory is statutory, the case law predates the guidance, and state fair-chance laws have their own enforcement mechanisms. The individualised assessment is not a compliance ritual to be dropped when enforcement attention shifts; it is the reasoning that makes the practice defensible in the first place.

The insider-risk gap: screening stops at the door

Every check described so far is a point-in-time measurement taken before employment starts. The risk it addresses is a small slice of the total, because most insider incidents involve people who would have passed every check. Verizon's 2026 Data Breach Investigations Report puts internal actors at 22% of breaches, with a human element in 62% and third-party involvement in 40%. Those figures describe a problem that exists after the screening is complete.

The 2026 report also names a newer pattern worth planning for: shadow AI use - employees pasting work content into unapproved tools - appeared as one of the most common non-malicious insider actions, with a fourfold increase year on year. That is not a case of a malicious employee; it is a case of a capable employee trying to work faster, and no background check predicts it. The controls that address it are data classification, approved tooling, access limits and a culture where asking is easier than working around.

The correct conclusion is not that screening is pointless. It is that screening belongs in a wider control set, and that the company should be able to say which control addresses which risk:

That mapping is the document a board actually needs, because it shows where money buys risk reduction and where it does not. It also prevents the most common governance failure in this area: treating a completed screening programme as evidence that insider risk is managed.

Continuous monitoring: proportionate or not?

The screening industry now sells continuous monitoring - ongoing checks against criminal, sanctions and media sources after hire, with alerts when something changes. The appeal is obvious; the legal and cultural analysis is less so.

In GDPR terms, continuous monitoring needs its own legal basis and necessity assessment, and it is a materially different processing operation from pre-employment verification. Monitoring every employee's name against criminal databases forever is difficult to justify; monitoring people in specific regulated roles, or checking sanctions lists for roles that handle cross-border payments, is easier. The principle of proportionality applies to time as well as to depth: a check that is proportionate once is not automatically proportionate as a permanent subscription.

There is also a practical asymmetry. Most of the value in continuous monitoring comes from a narrow set of signals - a sanctions designation, a licence suspension, a disqualification as a director - that can be checked directly against the authoritative register rather than bought as ambient surveillance. A regulated-professions register check costs nothing and is more accurate than a commercial alert. Building the programme around authoritative sources first, and buying monitoring only for the gaps, usually produces a cheaper and more defensible result.

Where continuous monitoring is used, the governance should include: which roles it covers and why, what triggers an alert, who reviews the alert, what the employee is told in advance, how false positives are handled, and how the data is deleted when the employment ends. Without those six answers written down, the programme is a liability with a dashboard.

Contractors, agencies and the third-party perimeter

Third-party involvement appears in 40% of breaches in Verizon's 2026 dataset, and the common configuration is not a hostile supplier: it is a legitimate supplier with legitimate access that nobody reviewed. Screening programmes routinely cover employees and stop at the perimeter, which means the people with the most direct access to systems - contractors, managed service providers, agency staff - are checked by their employer, to that employer's standard, if at all.

Closing that gap needs three things, none of them expensive. First, contractual: a clause requiring background screening to a defined standard for anyone who will access company systems or data, with evidence available on request rather than promised. Second, operational: a company-controlled onboarding route for non-employees that issues access, records the sponsor, and sets an expiry date. Third, verification: an annual attestation that the screening happened, plus a spot check on a sample rather than a blanket audit that nobody performs.

There is a limit worth being clear about. The company cannot lawfully demand the results of a contractor's criminal record check in most jurisdictions, and should not try. What it can require is that a check to a defined standard was completed, that the standard covers the risk, and that the contractor's own policy is auditable. The contractual standard is the control; the report is not yours to hold.

Privileged and remote roles: where the check matters least

For a role with production access, the marginal value of an extra screening layer is small compared with the marginal value of access governance. This is worth saying plainly because the instinct after an incident is usually to add screening, when the control that failed was nearly always technical.

The practical priorities for privileged roles are: just-in-time elevation rather than standing admin rights; two-person approval for destructive or high-blast-radius actions; session logging for privileged sessions, with the logging stored where the privileged user cannot delete it; break-glass accounts that are monitored and rotated; and an access review that a human actually performs, quarterly, against a list of who should have what. A screened administrator with standing access is a smaller obstacle than an unscreened administrator without it, and neither is as good as a screened administrator who has to request elevation for each action.

Remote work changes the same calculation rather than adding a new one. The relevant questions are where the work happens, which device and network it happens on, and what data is available from there. Screening does not answer any of them; device posture checks, conditional access and data classification do. Where a role is fully remote and handles sensitive data, the proportionate additions to screening are usually right-to-work verification with a repeat at permission expiry, and a clearer statement in the contract about data handling at home - not a deep dive into the candidate's personal history.

Metrics that show whether the programme works

Screening programmes usually report activity rather than outcome: checks completed, average turnaround, cost per hire. Those numbers tell you the vendor is billing you; they do not tell you whether the programme is proportionate or accurate. A better set:

• False-positive rate in adjudication - how often a reported record turns out to be someone else or is not relevant. High rates point at matching quality and at search scope.
• Dispute rate and dispute outcomes - how many candidates challenge a report, and how many challenges succeed. A rising success rate is a direct measure of vendor accuracy.
• Time to complete, by tier - because a tier 4 check that takes three weeks is a hiring problem, and a tier 3 check that takes one day may not have searched the jurisdictions that matter.
• Withdrawal rate after pre-adverse notice - how often candidates withdraw when they see the report. A high figure can indicate intimidating or inaccurate reports rather than a high-risk population.
• Coverage of the contractor population - percentage of non-employees with system access whose screening attestation is current.
• Access reviews completed on time - the metric that most reliably predicts insider incidents, and the one most often skipped.

Reported quarterly, with the trend rather than a single snapshot, those six numbers are enough to tell a board whether the programme is doing what it was bought for. They also give the vendor conversation a factual basis: a false-positive rate that rises after a jurisdiction change is a question about search quality, not a matter of opinion.

The procurement checklist

Buying screening is buying a data supply chain, and the questions that matter are the ones a sales deck will not volunteer. Ten questions, in the order that separates vendors:

1. Which sources do you query directly, and which through resellers? The answer determines who you can hold accountable when a record is wrong.
2. How is identity verified before any record search, and what happens when the identity check fails?
3. How are records matched to a person - name and date of birth, or additional identifiers - and is the matching logic disclosed?
4. What is your accuracy data, measured how, over what period, and on which jurisdictions?
5. What does your dispute process look like, how long does it take, and who reviews the underlying record?
6. How do you handle unavailable or sealed records - do you disclose the gap, or does the report read as a clear result?
7. Where is the data stored, for how long, and what is your deletion process - including backups?
8. What are your own security certifications, and when was the last independent assessment?
9. Do you support role-based packages so the employer can buy tier 1 checks without paying for tier 4 depth?
10. What happens if you are breached - notification timeline, contractual liability, and who tells the candidates?

Two contractual terms are worth insisting on regardless of the vendor's answers: audit rights over the subcontractor chain, and an obligation to notify the employer when a source becomes unavailable, because a report built on a jurisdiction that could not be searched looks identical to a clean report unless someone says otherwise.

Common failure modes, and the fix for each

The universal deep check. Everyone gets the same package, so the finance director and the intern are verified identically. Fix: role tiering with a written rationale, and a review of the tiering annually against actual incidents.

The skipped pre-adverse step. The offer is withdrawn on the strength of a report the candidate never saw. Fix: a workflow gate that prevents an adverse decision being recorded until the notice has been sent and the response window has run.

The ineligible criminal record check. A standard or enhanced check is requested for a role outside the statutory eligibility criteria. Fix: eligibility recorded per role, checked before the request is submitted, with the legal reference in the policy.

The abandoned adjudication record. Decisions are made in email threads, so no two cases can be compared and nothing can be shown to a regulator. Fix: one decision record per candidate, with the template designed before the first case arrives.

The contractor blind spot. Non-employees with system access are outside the programme entirely. Fix: an access-issuing route that requires an attestation before the account is created.

The vendor as risk-transfer. The contract is signed, the reports arrive, and nobody asks whether they are accurate. Fix: quarterly metrics, an annual sample review, and a dispute log that is read rather than filed.

The stop-at-the-door programme. Screening is treated as the answer to insider risk, and access governance is nobody's job. Fix: the risk-to-control map, with an owner for each row and a quarterly review that reports on both halves.

What a proportionate programme looks like in practice

Strip away the vendor language and a defensible screening programme is four decisions and one habit. The decisions: which roles carry which risk, which checks the law permits for those roles, how a finding is adjudicated, and what happens to the data afterwards. The habit is reviewing all four annually against what actually happened rather than against what the policy assumed.

For most organisations the shape is unglamorous. Identity, right to work and history verification for everyone. Conflict and professional-standing checks for roles with money or a licence. Statutory checks only where the role is eligible, with eligibility recorded. An adjudication step that a human actually performs, and an adverse action process that is followed even when it costs a week. A contractor route that requires an attestation before access is issued. And a quarterly report that includes access reviews, because the insider risk that screening cannot see is managed there rather than in the screening policy.

The failure that costs most is not a missing check. It is a programme that looks complete, is documented as complete, and has never been tested: nobody has run a sample dispute, nobody has asked the vendor for accuracy data, nobody has checked whether the tiering matches the roles that now exist. That is the difference between compliance paperwork and a control, and it is visible from outside in about twenty minutes of questions.

Where this connects to the rest of your security posture

Screening is the front door of a longer process. The controls that determine whether a well-screened employee becomes an incident are access governance, offboarding, monitoring and the ability to investigate quickly when something goes wrong. Our guides on building an incident response plan and email security for small businesses cover two of those layers, and our digital forensics work covers the point where a suspicion has to become evidence that stands up.

If the question is not pre-employment screening but a concern about someone already inside the organisation - unexplained access, data leaving, a colleague being pressured or impersonated - that is a different engagement, and it starts with authorisation and a lawful scope rather than with a database search. The distinction matters legally and practically: pre-employment checks are a routine administrative process, while an internal investigation is a documented, authorised process with evidence handling, and conflating the two is how organisations create problems for themselves.