A Guide to Professional Background Screening

Understanding the FCRA, consumer rights, employer and CRA responsibilities, adverse action, disputes, security and the procedures behind responsible professional screening.

Professional background screening affects consequential decisions. A report can influence whether someone receives a job, rents a home or serves in a position of trust. At the same time, organizations have legitimate reasons to verify identity, qualifications, credentials, driving history and other information relevant to employment, housing, safety and risk.

Compliance therefore cannot simply be added at the end of the process. It has to be built into the process itself.

The purpose of professional background screening is not to find as much negative information as possible. It is to provide relevant, appropriately researched and legally reportable information that supports responsible decisions while protecting consumer rights.

Legal-Source Verification Note

This full-length edition uses the verified Parts I–III document as the legal and structural source of truth and restores the fuller explanatory material developed for the guide. The underlying legal-source review was completed against authoritative sources available on September 3, 2026.

The primary federal authorities used were the Fair Credit Reporting Act, relevant sections of Title 15 of the U.S. Code, current FTC business guidance, CFPB materials, EEOC guidance, PBSA accreditation materials, and AICPA guidance on SOC 2.

The verification pass confirmed the guide’s central legal framework: CRAs must maintain reasonable procedures to assure maximum possible accuracy; employment users have disclosure/authorization and pre-adverse/adverse-action duties; CRAs reporting potentially adverse public-record information for employment must satisfy 15 U.S.C. § 1681k; consumers have dispute and reinvestigation rights; and tenant-screening reports are consumer reports subject to FCRA requirements.

Important precision choices are preserved throughout this edition. The guide does not claim that the FCRA imposes a universal fixed waiting period between pre-adverse and final adverse action. It distinguishes CRA report review or client-defined adjudication workflows from the employer’s or housing provider’s actual eligibility decision. It describes SOC 2 as an examination/report rather than a government certification, distinguishes PBSA organization accreditation from membership or individual certificates, and treats volunteer screening cautiously because legal classification depends on the facts and purpose.

1. Why the FCRA Matters

Despite its name, the Fair Credit Reporting Act is not limited to traditional credit reports. It regulates consumer reporting more broadly, including many third-party background reports used for employment and housing decisions.

The FCRA addresses permissible purposes for obtaining reports, disclosures and authorizations in employment screening, accuracy, consumer access, disputes and reinvestigations, public-record reporting, adverse action, privacy and responsibilities of both CRAs and users of reports.

It should therefore not be viewed simply as paperwork surrounding a background check. It establishes much of the federal legal architecture within which professional consumer reporting operates.

2. Compliance Is a Shared Responsibility

One of the most dangerous assumptions an organization can make is that its background screening company “handles compliance” for it. A professional CRA can provide technology, procedures, forms, information and support, but the end user retains responsibilities of its own.

The opposite assumption is also dangerous. A CRA cannot simply say that because the customer ordered a report, everything the customer requests must be permissible. The CRA has independent duties.

Responsibilities of the Organization Requesting the Report

Establish a permissible purpose
Make required disclosures and obtain authorization where applicable
Provide required certifications to the CRA
Determine appropriate screening criteria
Apply policies consistently
Comply with applicable federal, state and local requirements
Follow applicable adverse-action procedures
Make the actual employment or housing decision
Credential customers and verify legitimate use
Limit reports to permissible purposes
Maintain reasonable procedures designed to assure maximum possible accuracy
Handle public-record information appropriately
Protect consumer information
Maintain dispute and reinvestigation procedures
Provide required consumer disclosures and rights
Correct or delete information when the law requires it
Know when report information contributed to certain adverse decisions
Know which CRA supplied the report
Obtain information from the CRA when entitled
Dispute inaccurate or incomplete information
Receive reinvestigation results
Exercise other applicable rights under federal and state law
Criminal research: identity matching, aliases, dispositions, duplicate records, source verification, escalation and reportability
Verification: employer contact attempts, education research, documentation, escalation and alternative methods
Disputes: consumer authentication, intake, reinvestigation, source communication, correction and notification
Customer management: credentialing, permissible purpose, required certifications, account access and termination
Security: user access, authentication, incident response, vendor access, data handling and disposal
Quality assurance: researcher monitoring, provider performance, exception review, internal audits, error tracking and corrective actionResponsibilities of the CRA

Rights of the Consumer

3. Permissible Purpose

Consumer reports contain private information. They cannot simply be obtained because someone is curious about another person.

The FCRA identifies permissible purposes under which reports may be furnished. Employment and housing can qualify when applicable statutory requirements are met. A professional CRA should have procedures designed to determine who its customers are, why they are requesting reports and whether required certifications have been obtained.

This is why a responsible CRA may ask new customers detailed questions before granting access. That friction can be a sign of good consumer-reporting practice rather than poor customer service.

4. Employment Disclosure and Authorization

For covered employment consumer reports, employers generally must provide the applicant or employee with a clear and conspicuous written disclosure that a consumer report may be obtained for employment purposes and obtain written authorization, subject to the statute’s details and exceptions.

Modern electronic workflows can make this process easier by presenting documents, capturing authorization and preserving records. But technology does not change the underlying legal requirements. Organizations should have qualified counsel review the forms and processes they actually use rather than relying on generic templates.

5. Maximum Possible Accuracy

One of the most important standards for a CRA appears in 15 U.S.C. § 1681e(b): when preparing a consumer report, the CRA must follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual to whom the report relates.

That is a procedural standard, not a guarantee that every source record in the world is perfect. Courts can contain errors, data can be incomplete, names can be common and cases can change. The CRA’s responsibility is to maintain and follow reasonable procedures designed to address those risks.

That is why matching, source verification, disposition research, duplicate control, exception handling and dispute resolution are not optional “premium” functions. They sit at the center of screening quality.

6. More Data Does Not Automatically Mean More Accuracy

A screening company can have access to hundreds of millions of records and still produce poor reports if information is associated with the wrong person.

Consider a record for “Michael A. Johnson.” Finding that record is not the same thing as establishing that it belongs to the Michael A. Johnson who applied for the job or apartment. Additional identifiers, context or source-level research may be required.

The same problem appears with duplicate records, changed dispositions, dismissed cases, sealed or expunged information, aliases and stale data. The objective is not to maximize the number of negative entries in a report. It is to maximize the reliability of the information appropriately reported about the correct person.

7. Database Information vs. Source-Level Verification

Aggregated databases can be excellent discovery tools. They can broaden coverage and identify possible records in places that would not have been obvious from address history alone.

But discovery and verification are not the same function. A professional CRA should have documented procedures governing when a database result can be used, when source-level research is appropriate, when additional identifiers are required, when dispositions must be updated and when information should not be reported.

The correct approach can depend on the source, search type, applicable law and circumstances. This is why mature screening organizations combine technology with documented procedures rather than relying on one universal automated rule.

8. Public Records Create Additional Responsibilities

Criminal, civil and other courthouse information may originate as public records. “Public,” however, does not mean that anything found in a public record can automatically be reported for employment without further consideration.

15 U.S.C. § 1681k contains specific requirements for CRAs furnishing public-record information for employment purposes that is likely to have an adverse effect. Depending on the process used, the CRA must satisfy the statute’s notice option or maintain strict procedures designed to ensure that such information is complete and up to date when reported.

This requirement is specific and should not be reduced to the oversimplified claim that every public record must always be rechecked in exactly the same way.

9. Reporting Limits and State/Local Law

There is no universal answer to the question “How far back can a background check go?” or “Can this record be reported?” The answer can depend on the type of information, disposition, age, jurisdiction, purpose, salary or position, whether a record has been sealed or expunged and other applicable requirements.

The FCRA provides federal rules, but states and local jurisdictions may impose additional restrictions. That is why broad internet statements such as “background checks only go back seven years” or “all convictions can always be reported” are too imprecise to serve as universal rules.

Professional CRAs should maintain procedures for these distinctions and update them as requirements change.

10. Fair-Chance and Ban-the-Box Laws

Fair-chance and “ban-the-box” laws can regulate when employers may ask about criminal history or conduct criminal background checks. Requirements vary widely among jurisdictions.

Some rules apply only to public employers, while others reach private employers. Some restrict inquiry on an initial application; others delay screening until an interview, conditional offer or another stage. Some jurisdictions also add notice, assessment or timing requirements beyond federal FCRA requirements.

The practical lesson is that compliance concerns not only what information is considered, but also when and how it enters the hiring process. Multi-state employers should not assume that one national workflow satisfies every state and locality.

11. FCRA and Anti-Discrimination Law Address Different Questions

The FCRA regulates consumer reporting. Employment discrimination law addresses a different set of issues. An employer can theoretically obtain an accurate background report through an FCRA-compliant process and still use the information in a way that creates a separate legal issue.

EEOC guidance concerning arrest and conviction records discusses disparate treatment, disparate impact, job relatedness and business necessity. The guidance also distinguishes arrests from convictions and emphasizes that criminal-history information should not be treated as though every entry has the same meaning.

The CRA’s role is generally to provide an accurate, lawful consumer report. The employer’s role is to determine how information should be considered for the specific employment decision.

12. Arrests, Convictions and Dispositions Are Not the Same

An arrest indicates that a person was arrested. It does not by itself establish that the person committed the alleged conduct. A conviction has a different legal status. Cases can also be pending, dismissed, acquitted, deferred, reduced, sealed, expunged or resolved in other ways that matter to how information is understood and reported.

A quality screening report should communicate dispositions accurately rather than presenting every criminal-history entry as though it represents the same thing. The end user should likewise avoid treating every record as equivalent.

13. The Employer or Housing Provider Makes the Decision

This distinction deserves repetition because the word “adjudication” can blur responsibilities. A CRA may research records, verify identifiers, classify information, apply reporting rules or use client-defined criteria to route a report for review.

But the actual employment or housing eligibility decision belongs to the employer or housing provider. A screening provider should not become a substitute for the end user’s judgment.

The CRA supplies the report. The employer or housing provider makes the decision.

14. Pre-Adverse Action

When an employer is considering an unfavorable employment decision based in whole or in part on information in a consumer report, the FCRA generally requires a pre-adverse-action step before the decision becomes final.

The employer provides the individual a copy of the report relied upon and a copy of the CFPB’s Summary of Your Rights Under the Fair Credit Reporting Act. This gives the individual an opportunity to review the report and raise a concern before the final decision.

15. Why the Opportunity to Review Matters

The pre-adverse process is not merely procedural bureaucracy. It creates an important accuracy safeguard.

A criminal record could belong to another person. A court disposition may have changed. An employment verification may contain incorrect dates. A degree may have been marked unverified because the institution did not respond. Without an opportunity to review the report, a person could lose an opportunity because of an error they never knew existed.

16. No Universal Federal Five-Day Rule

The FCRA does not establish one universal federal rule requiring every employer to wait exactly five days—or any other single fixed number—between pre-adverse and final adverse action.

Employers should provide a meaningful opportunity for the individual to review and respond and should consider any additional state or local timing rules that may apply. Organizations should design this process with qualified legal guidance appropriate to the jurisdictions in which they operate.

17. Final Adverse Action

If the employer ultimately takes covered adverse employment action based in whole or in part on information in a consumer report, the FCRA requires an adverse-action notice containing specified information.

The notice identifies the CRA that supplied the report, explains that the CRA did not make the employer’s decision, and provides information concerning the consumer’s rights to dispute information and obtain an additional free copy of the report within the statutory period.

This again reinforces the separation of roles: the CRA supplied the report; the employer made the decision.

18. Disputes and Reinvestigation

No background-screening system is perfect. Source records can contain errors, information can become outdated, people can share identifiers and cases can be updated after they were originally collected. The FCRA therefore gives consumers dispute rights.

Under 15 U.S.C. § 1681i, when a consumer disputes the completeness or accuracy of information in the file, the CRA generally must conduct a reasonable reinvestigation free of charge. The statute generally establishes a 30-day period, subject to statutory details and possible extension in specified circumstances.

Information found inaccurate, incomplete or unverifiable must be treated as the statute requires. Dispute handling should therefore be viewed as a core consumer-reporting function, not an inconvenient customer-service problem.

19. What a Professional Dispute Process Should Look Like

1. Verify the identity of the consumer

2. Identify exactly what information is disputed

3. Review information supplied by the consumer

4. Identify the source of the disputed information

5. Conduct an appropriate reinvestigation

6. Contact relevant sources or furnishers

7. Determine whether the information can be verified

8. Correct or delete information when required

9. Update the consumer’s file

10. Communicate the reinvestigation results

11. Take other required actions concerning prior recipients where applicable

Speed matters, but the quality of the reinvestigation matters too. Merely checking that the same database still contains the same entry may not answer the underlying question when the accuracy of that entry itself is being challenged.

20. Tenant Screening Has Similar Principles but Different Workflows

Tenant-screening reports are consumer reports under the FCRA. Housing providers therefore also need a permissible purpose and must provide an adverse-action notice when report information contributes to certain unfavorable housing actions.

An adverse action in housing can include more than simply denying an application. Depending on the circumstances, it may include requiring a higher deposit, requiring a co-signer, charging higher rent or imposing another unfavorable condition because of information in the consumer report.

Unlike ordinary employment screening, the federal FCRA does not use the same pre-adverse-action sequence for typical tenant decisions. Housing providers must also consider fair-housing and state/local requirements. Employment and tenant screening may use similar technology, but they should not be treated as legally identical workflows.

21. Security and Disposal

Background-screening companies can process some of the most sensitive information an organization handles: Social Security numbers, dates of birth, driver’s-license information, addresses, criminal history, employment history, education history, financial information and other personal data.

Security should therefore address access control, authentication, encryption, logging and monitoring, vulnerability management, penetration testing, incident response, data backup, disaster recovery, vendor management, retention and secure disposal.

The FTC Disposal Rule requires covered businesses and individuals that possess consumer-report information for a business purpose to take reasonable and appropriate measures to dispose of it so it cannot be read or reconstructed.

22. What SOC 2 Tells You—and What It Does Not

SOC 2 is an independent examination/report concerning controls at a service organization relevant to security, availability, processing integrity, confidentiality or privacy, depending on the scope.

A Type II examination evaluates the operating effectiveness of specified controls over a period of time. That can provide valuable assurance concerning the control environment.

But SOC 2 does not mean that every background check is accurate, that the company is automatically FCRA compliant in every circumstance or that the provider has no security risk. SOC 2 is a security/control assurance signal. It should be evaluated alongside research quality, compliance procedures, data practicesand service.

23. What About PCI DSS?

PCI DSS concerns payment-card data. A screening provider or its platform may maintain PCI DSS compliance because its systems process payments or interact with cardholder-data infrastructure.

That can be relevant to security, but PCI DSS should not be presented as though it were a background-screening accreditation. It does not establish criminal-record accuracy or FCRA compliance.

24. PBSA Accreditation

The Professional Background Screening Association operates organization-level accreditation programs for qualifying background-screening organizations.

Accreditation can provide buyers with an additional signal that a CRA has undergone an external review against established industry standards. Current PBSA materials describe U.S. Employment Screening and General Background Screening standards, desk and virtual on-site audits, a five-year accreditation period and a three-year surveillance touchpoint.

PBSA membership, individual FCRA certificate programs and organization accreditation are distinct. Accreditation is an important quality/process indicator, but it does not guarantee that an accredited CRA can never make a mistake or that every accredited provider offers the same level of service.

25. Why Standard Operating Procedures Matter

Some of the most important things a CRA does are invisible to the customer because they happen inside Standard Operating Procedures, or SOPs.

Two CRAs can use the same screening platform and the same data providers yet produce different outcomes because their procedures, training, escalation practices and quality controls differ.

Examples of SOP Areas

26. Training Matters Too

Written procedures have limited value if employees do not understand them. Professional screening organizations should maintain training appropriate to each employee’s responsibilities.

Training can include FCRA fundamentals, privacy, security, criminal-record terminology, matching procedures, disputes, customer support, escalation, data handling and changes in applicable requirements. The more judgment a role involves, the more important that training becomes.

27. Compliance Should Be Auditable

A mature compliance program should be capable of demonstrating that documented procedures actually occur. Evidence can include training records, audit logs, quality reviews, security assessments, dispute records, researcher-performance monitoring, customer-credentialing records, incident tracking, corrective actions and periodic internal or external audits.

There is an important difference between “we have a policy” and “we can demonstrate that we consistently follow the policy.” The second is much stronger.

28. Compliance Technology Can Help—but It Cannot Replace Judgment

Modern screening platforms can automate disclosure and authorization workflows, customer certifications, adverse-action communications, dispute tracking, audit trails, user permissions, document retention, package consistency and client-defined routing rules.

These tools can reduce errors and improve consistency. But they should not create false confidence. A workflow can automate a poorly designed policy just as efficiently as it automates a good one. Technology should support sound compliance practices rather than substitute for them.

29. Compliance Is Not the Same Thing as Risk Elimination

No background-screening program can eliminate all risk. A report is a snapshot assembled from the searches ordered and the sources available at the time.

Someone with no reportable criminal history can commit an offense tomorrow. A driver’s license can be suspended after hiring. A professional license can expire. A source can contain an error. A court can update a case.

Likewise, searching everything imaginable does not necessarily create a better or more defensible program. The objective is not perfect prediction. The objective is a reasonable, appropriate, accurate and legally responsible process.

30. Accuracy Protects Both Sides

It is tempting to discuss compliance primarily in terms of employer liability. That misses something important.

A false positive can unfairly cost a person a job or an apartment. An incorrect criminal record can follow someone through multiple applications. A mistaken identity can have serious consequences.

At the same time, inadequate screening can expose employers, employees, residents, customers, children, patients or other vulnerable populations to risks that appropriate screening might have identified.

Responsible professional screening therefore requires both care not to report information improperly and care not to overlook information an organization legitimately and lawfully needs.

Responsible screening protects both the organization making the decision and the person whose information is being reported.

31. Compliance Questions Every Buyer Should Ask a CRA

1. Are you a CRA subject to the FCRA for the reports you provide?

2. Are you currently accredited under a PBSA organization accreditation standard, and which one?

3. What independent security assessments cover your organization and/or core platform?

4. How do you credential customers and verify permissible purpose?

5. What procedures do you use to assure maximum possible accuracy?

6. How do you match criminal records and handle common names, duplicates and changed dispositions?

7. When do you conduct source-level research?

8. How do you address sealed or expunged information and jurisdiction-specific reporting rules?

9. How do your pre-adverse and adverse-action tools work, and which responsibilities remain with the customer?

10. How can consumers access reports and submit disputes?

11. Who performs reinvestigations and how are corrections communicated?

12. How do you monitor researchers and data providers?

13. What SOPs govern screening operations and how are employees trained?

14. How is consumer information secured, retained and disposed of?

15. How do you audit whether documented procedures are actually followed?

32. The Central Principle of Part III

Compliance is sometimes presented as an obstacle that slows background screening down. That is the wrong way to think about it.

The objective of professional screening is not merely to produce information quickly. It is to produce information responsibly.

That requires the customer to establish an appropriate and lawful screening program; the CRA to maintain effective procedures for obtaining, matching, researching and reporting information; technology to move information securely; data providers and researchers to supply reliable information; the end user to make the actual decision; and the individual to have meaningful rights to see, question and correct information when applicable.

The strongest screening organizations do not view compliance as a department sitting beside operations. They build it into technology, data, research, training, security, procedures, customer education and quality control.

That is what makes professional screening defensible. More importantly, it is what makes professional screening responsible.

Authoritative Legal and Regulatory Sources

A Guide to Professional Background Screening - Part 3

Accuracy, Compliance and Responsible Decision-Making