How to Run a Background Check: An Employer's Guide

Background checks are a standard part of hiring, but they are also commonly mishandled. The Fair Credit Reporting Act (FCRA) imposes specific obligations on employers who use consumer reporting agencies for background screening. State laws add another layer of requirements. Understanding the process, the legal requirements, and the limits of standard background checks helps employers get more value from their screening programs.

The Legal Framework: FCRA Compliance

When an employer uses a consumer reporting agency (CRA) to conduct a background check, the FCRA imposes obligations at each stage.

Disclosure and authorization. Before ordering a background check, the employer must give the applicant a clear and conspicuous disclosure that a consumer report may be obtained. The disclosure must appear in a document that consists solely of the disclosure. The applicant must provide written authorization.

Pre-adverse action. If the employer intends to take adverse action based wholly or partly on the background check, it must give the applicant a pre-adverse action notice, a copy of the consumer report, and a summary of FCRA rights. The applicant then has a reasonable period (typically five business days) to dispute the report before the adverse action is finalized.

Adverse action notice. If the employer proceeds with the adverse action, it must provide a final adverse action notice. That notice must include the name and contact information of the CRA, a statement that the CRA did not make the adverse decision, and notice of the applicant's right to dispute.

Failure to follow these procedures creates FCRA liability.

State and Local Requirements

States and localities have added their own layers of background screening rules. "Ban the box" laws in many jurisdictions restrict when in the hiring process employers can ask about criminal history. They typically prohibit inquiry until a conditional offer of employment has been made.

"Fair chance" laws in some jurisdictions, including California and New York City, impose additional requirements. These include individual assessment of criminal history and consideration of the nature of the offense, time elapsed, and relevance to the job.

Some jurisdictions restrict the types of criminal history that can be considered, such as limiting consideration to convictions within a specific number of years. California also restricts the use of salary history and credit history in employment decisions.

Employers operating in multiple jurisdictions must comply with the most restrictive applicable rules for positions in each location.

What a Standard Employment Background Check Covers

Standard pre-employment background checks from major CRAs typically include:

Criminal history. Searches of criminal history databases at the county, state, and national level, depending on the scope ordered. National criminal databases are not complete. County court searches in all counties where the applicant has lived are more thorough.

Sex offender registry. National and state sex offender registry searches.

Social Security number trace. Verification of the SSN and identification of addresses tied to it. This is used to determine which jurisdictions to search for criminal records.

Employment verification. Confirmation of employment dates and job titles with prior employers.

Education verification. Confirmation of degrees and educational credentials with institutions.

Credit report. Available for positions where financial responsibility is relevant. Restricted by state law in several jurisdictions.

Motor vehicle records. Relevant for positions involving driving.

The Limits of Standard Background Checks

Standard background checks are valuable for high-volume hiring but have real limits.

National criminal databases miss records in counties that do not report to them. Without county-level searches in all relevant jurisdictions, criminal history may be missed.

International criminal history is not covered by standard checks.

The background check reflects public records. It does not include professional reputation information, conduct that did not result in criminal proceedings, or the kind of information that professional source interviews develop.

For positions of significant responsibility, executive roles, or positions with access to sensitive information or vulnerable populations, enhanced screening beyond the standard background check is appropriate.

Building a Tiered Screening Program

The most effective employment screening programs are not one size fits all. Treating every applicant to the same level of scrutiny wastes resources on low-risk roles and leaves gaps in high-risk ones. A tiered screening program matches the depth of the check to the risk profile of the position.

A typical tiered structure begins with a baseline package for entry-level and non-sensitive roles:

• SSN trace
• Seven-year county criminal searches in current and prior residences
• National criminal database search with county verification of any hits
• Sex offender registry
• Employment verification for the most recent two employers

For mid-level professional roles, the baseline package expands to include:

• Education verification
• Professional license verification where applicable
• Federal criminal searches in relevant districts
• Deeper employment verification covering a longer work history

Positions with fiduciary responsibilities, access to financial systems, or signatory authority warrant:

• Credit history review where permitted
• Civil litigation searches
• Bankruptcy searches
• Media and adverse news screening

Executive and senior leadership roles, along with positions involving access to trade secrets, regulated information, or vulnerable populations, call for the kind of investigator-led review our executive due diligence practice provides: source interviews, reputation inquiry, global media screening, and verification of claims that public records alone cannot confirm.

Documenting the tiering logic matters. If an applicant later challenges the depth of screening applied to them, an employer should be able to point to a written policy that applies the same standard to everyone in the same role category.

Resume Verification and the Fraud Employers Miss

Resume fraud is more common than most hiring managers assume. Studies by screening industry groups consistently find discrepancies between resumes and verified records in a substantial percentage of applications. These range from embellished job titles and inflated dates of employment to entirely fabricated degrees and credentials.

The most common categories of resume misrepresentation are:

• Employment date padding (extending tenure to cover gaps)
• Job title inflation (claiming management titles for individual contributor roles)
• Fabricated or upgraded degrees (claiming a degree never completed or upgrading an associate's to a bachelor's)
• Unearned professional licenses or certifications
• Undisclosed terminations presented as voluntary departures

A standard CRA employment verification will typically confirm dates of employment and job title with the prior employer's HR department. Many HR departments will only confirm that information without elaborating on performance or circumstances of departure. Getting to the substance of a candidate's prior work often requires direct outreach to former supervisors and colleagues. That includes whether they were actually effective, whether they left under a cloud, and whether there were allegations of misconduct that were quietly resolved. This is standard practice in our background investigation services but sits outside the scope of most CRA packages.

Credential fraud is particularly common in fields with high certification barriers. Diploma mills remain a live problem. Candidates sometimes list certifications from organizations that do not exist or that they never actually earned. Direct verification with the issuing institution is the only reliable check, not reliance on a copy of a certificate provided by the candidate.

Special Considerations for Regulated and Sensitive Industries

Certain industries have screening requirements that go beyond general FCRA practice. Healthcare employers must screen against:

• The HHS Office of Inspector General's List of Excluded Individuals and Entities
• The System for Award Management (SAM) exclusions list
• State Medicaid exclusion databases

Hiring an excluded individual can result in civil monetary penalties and the inability to bill federal healthcare programs for services that individual touches.

Financial services employers conducting FINRA-regulated hiring must run Form U4 and U5 history, Central Registration Depository (CRD) checks, and fingerprint-based criminal history through appropriate channels. Banking positions covered by Section 19 of the Federal Deposit Insurance Act require careful review of any criminal history involving dishonesty, breach of trust, or money laundering.

Schools and organizations serving children face the highest stakes. Essential checks include:

• Fingerprint-based state and federal criminal history checks
• Child abuse registry checks where available
• Verification of any gaps in employment history

Our work with schools on out-of-district investigations frequently surfaces information that standard packages miss. That includes allegations of misconduct at prior institutions that were resolved through quiet resignation rather than formal discipline.

Transportation employers covered by DOT regulations have prescribed drug and alcohol testing requirements, prior employer inquiries, and safety performance history checks that must be documented in specific ways.

Handling Adverse Information: Individualized Assessment

When a background check returns adverse information, particularly criminal history, the law in most jurisdictions now requires an individualized assessment before using that information to deny employment. The EEOC's guidance on the use of criminal history in employment decisions is not itself binding law. It has shaped how courts evaluate disparate impact claims and should inform employer practice.

The assessment considers the nature and gravity of the offense, the time that has elapsed since the offense or completion of the sentence, and the nature of the job sought. A decade-old misdemeanor possession charge is rarely relevant to a software engineering role. A recent embezzlement conviction is directly relevant to a bookkeeping role. Documenting this analysis in writing, before sending a pre-adverse action notice, is the best defense against a later discrimination claim.

Give the candidate a genuine opportunity to respond. The pre-adverse action process is not a formality. Candidates sometimes successfully dispute records, including mistaken identity, sealed or expunged records that should not have been reported, and records belonging to someone else with a similar name. They sometimes provide context that changes the analysis, such as a youthful offense followed by twenty years of unblemished work history.

When to Escalate Beyond Database Screening

Certain patterns in an application or screening result warrant escalation to investigator-led review:

• Unexplained gaps in employment history of six months or more, particularly in senior candidates
• Claimed employment with companies that cannot be verified or that have no public footprint
• Degrees from institutions with questionable accreditation
• Inconsistencies between the resume, the application, and the information returned from verification sources
• Any indication of prior litigation involving the candidate that did not appear in standard civil searches

Corporate HR programs use us to run FCRA-compliant screening at volume, with the option to escalate individual cases to investigator-led review. Law firms engage us through our law firm services practice for candidate vetting in the context of litigation and internal investigations, where the stakes of a hiring mistake are particularly high. Contact us to discuss your screening needs and design a program that matches your risk profile.