Background check policy template and best practices

While 93% of organizations worldwide report conducting some form of background screening, only 76% have a documented background check policy in place.* In other words, just about everyone understands the importance of vetting new hires, but fewer recognize why getting it down in writing is equally important. 

Laying out exactly how the process should go and who’s in charge of each step keeps it repeatable and consistent. Without clear ownership, it’s easy to skip steps or send candidates mixed messages.

This guide explains what a strong background check policy includes and offers a free template to get you started. You’ll also get a step-by-step breakdown of what falls to HR, what’s in the hands of the hiring manager, and what requires working together.

Rules for screening, consent, retention, and permitted checks vary by location. This article focuses on U.S. requirements, such as compliance with the Fair Credit Reporting Act (FCRA).

* PBSA and HR.com, 2021

What’s a background check policy, and what does it include?

An employment background check policy is a written document that guides the way an organization screens candidates and employees. At minimum, it should cover these bases:

• What to check and when: Name which roles need a background check and which checks they require, such as criminal, employment, or education. Cover whether checks happen before or after a conditional job offer.

• Consent and disclosure: If using a third-party background check service, the FCRA requires organizations to inform candidates in writing that a background check will take place. Employers must also obtain explicit written authorization, as SHRM notes.

• Concerning results: Spell out what should happen if a background check comes back with a concern. This often involves sending a pre-adverse action notice and allowing time for the candidate to respond before finalizing the decision.

This sample employee background check policy can kickstart the creation process. Keep in mind that background check laws vary by jurisdiction. Review with your organization’s legal counsel before adopting your own policy.

Background check policy template

Purpose and scope

[Company Name] runs employee background checks to confirm candidate qualifications and protect the organization’s people, property, and information. All conditional job offers are contingent upon clearing this process.

Types of checks and timing

[Company Name] runs only checks relevant to the position. These may include a criminal background check, an employment verification, and, where legally permitted, a credit check. Criminal background checks are conducted only after a conditional job offer.

Disclosure and authorization

Before [Company Name] requests a consumer report from a third-party background check service, candidates will receive a written disclosure as a standalone document and must provide written authorization for checks to proceed. [Company Name] follows FCRA requirements for all third-party checks.

Result review and adverse action

[Company Name] reviews background reports against each position’s job-related requirements. The same standards apply to every candidate, without discrimination.

When a report reveals criminal history, HR runs an individualized review that considers the type and severity of the offense, the amount of time elapsed since the criminal conviction, and the nature of the new position. Before taking any adverse action, [Company Name] will:

• Send the candidate a pre-adverse action notice with a copy of the consumer report and a summary of the candidate’s FCRA rights.
• Give the candidate at least [Grace Period] business days to review the report, dispute errors, or explain the situation.
• Send the candidate an adverse action letter if the decision stands after review. The letter will provide the name and contact details of the third-party background check service used, explain that the decision was solely [Company Name]’s, and detail the candidate’s right to dispute the report and receive a free copy within 60 days.

Ownership

[Company Name]’s HR department works with hiring managers and legal counsel to apply the process consistently across candidates. Hiring managers request checks and may advise on job responsibilities. HR staff manage disclosure, authorization, ordering, review, adverse action notices, and record storage. Legal counsel advises where appropriate.

Confidentiality and access

Background information is shared on a strict need-to-know basis. Hiring managers learn only whether a candidate will be moving forward, not what the background report shows. Reports and any personal identifying information contained in them are stored separately from standard employee records. Access is limited to authorized HR staff.

Retention and disposal

[Company Name] follows Equal Employment Opportunity Commission (EEOC) retention rules. Background check records are retained for at least one year after the record was created or the employment decision was made, whichever is later. When the retention period ends, records are destroyed according to Federal Trade Commission (FTC) requirements by shredding paper copies and permanently erasing digital background reports.

Insecure background report storage is a fast-track to compliance trouble. With Leapsome, security is built in from the start.

‍

‍🔐 Keep background reports under lock and key

Send and track policy and disclosure documents and gather signatures without leaving the platform, while keeping sensitive background reports stored safely away.

👉 Explore Documents & E-Signatures 

‍

Who owns each step: HR, the hiring manager, or both

“On the C-level, I learned to doubt people data because it arrived late and conflicted across files. Then, sitting in HR, I felt the pain from the inside and saw how much time went into rebuilding the same reports. Centralizing restores trust and your calendar.” — Florian Klages, Managing Partner, torq. partners

‍

Ambiguity about who should be doing what makes it harder to put a background check policy into practice. Creating and documenting your own list just once keeps you and your team from having to relitigate ownership for every new hire. Here’s a summary of what a background check workflow typically looks like and whether HR or hiring managers own each step:

Assigning ownership works, but only if owners follow through. Leapsome’s automation capabilities can help.

‍

🤖 Skip the manual labor 

Automatically assign owners and reminders to make your background check policy smooth and repeatable.

👉 Explore Workflows 

‍

“You could have three different employee files, one in the system, one in the Google Drive, one in paper, that could all be different.”

— Sammie Masley, People and Talent Partner, Leapsome

Managing background check records securely and compliantly

“We even flag compliance risks, for example, if a country requires a minimum of 20 paid days off, the platform won’t let you go below that.” — Suraj Paneru, Customer Success Coach, Leapsome

SHRM points out that it’s the employer’s responsibility to safeguard information gathered during the hiring process. And background reports contain personal identifying information that candidates understandably expect to stay out of unauthorized view.

Storage, access, and retention requirements vary by jurisdiction, so employers should verify the rules that apply to their company with legal counsel. However, the high-level principles for handling these sensitive files are the same across most locations:

• Restricted access: Limit access to the HR staff members who actually need it. Mistakes can be expensive, with IBM research showing an average cost per breached employee record of $189.

• Distinct storage: Separate background reports from general employee records. This keeps a well-meaning payroll specialist from accidentally opening an employee’s criminal or credit history while looking for something else.

• Set retention schedule: Keep reports for at least a year, in accordance with EEOC rules. When it’s time to destroy them, follow the FTC Disposal Rule: Shred paper copies and permanently delete digital files.

Simplify background check policy workflows with Leapsome

Even the most well-written background check policy can fall apart when task and document management are inconsistent. HR teams miss steps, candidates are kept out of the loop, and critical files can end up somewhere they shouldn’t be. 

Leapsome’s all-in-one HRIS and people management platform keeps every step connected and accounted for throughout the hiring process. Our platform helps you manage:

• Policy documents and acknowledgments: Store your background check policy as a reusable template and gather signatures electronically with Documents & E-Signatures. Separate background reports from general employee profiles to apply your organization’s retention and secure-disposal rules.

• Clear task ownership: Assign each step to the right owner using automated Workflows. Keep everything running on time with built-in reminders.

• Secure access: Configure role-based permissions to keep sensitive information like background reports out of reach of unauthorized users.

“There is no more fighting with the review process for managers, and the administrative work for HR is reduced by about 90%.” — Amanda Heeg, Senior HR Manager, Junique

‍

💪 Keep loose ends from forming in the first place

Assign a clear owner to every background check step and automate reminders to keep the process on track from disclosure to day one.

👉 Request a demo

‍

FAQ

What should a post-hire background check policy include?

A post-hire background check policy looks much the same as a pre-hire one, usually covering items like:

• When checks happen: Outline what triggers a check for existing employees, such as a promotion to a more sensitive role.

• Ongoing authorization: Ensure the employee’s authorization covers checks during employment or obtain new authorization.

• Adverse action steps: Current employees typically get the same pre-adverse action notice, time to respond, and final notice as candidates.