Skip to content
  • There are no suggestions because the search field is empty.

Guide to Professional Background Screening

Accuracy, Compliance and Responsible Decision-Making

Professional screening affects consequential decisions. Compliance must therefore be built into the process rather than added at the end.

The goal is relevant, appropriately researched and legally reportable information that supports responsible decisions while protecting consumer rights.

1. Why the FCRA Matters

The Fair Credit Reporting Act is not limited to traditional credit reports. It governs consumer reporting more broadly, including many third-party reports used for employment and housing. The statute addresses permissible purpose, accuracy, privacy, consumer access, disputes, public-record reporting and adverse action.

2. Compliance Is a Shared Responsibility

The customer and CRA have distinct obligations. Customers establish permissible use, follow applicable disclosure/authorization and adverse-action requirements, define screening criteria and make decisions. CRAs verify users and purposes, maintain reasonable accuracy procedures, handle consumer rights and disputes, and comply with other CRA duties. A CRA can support compliance but does not replace the customer's legal responsibilities.

3. Permissible Purpose

CRAs must maintain reasonable procedures to limit consumer reports to permissible purposes, require prospective users to identify themselves and certify their purposes, and make a reasonable effort to verify new users and their certified uses before furnishing reports.

4. Employment Disclosure and Authorization

For covered employment consumer reports, employers generally must provide a clear and conspicuous written disclosure in a stand-alone format and obtain written authorization before procuring the report, subject to statutory details and exceptions. Employers also provide required certifications to the CRA.

5. Maximum Possible Accuracy

15 U.S.C. § 1681e(b) requires a CRA preparing a consumer report to follow reasonable procedures to assure maximum possible accuracy. This is a procedural standard, not a promise that every source record will always be perfect. Matching, source verification, disposition research, duplicate control and dispute handling are therefore central to quality.

6. Public-Record Information for Employment

Under 15 U.S.C. § 1681k, a CRA furnishing potentially adverse public-record information for employment must either notify the consumer when that information is reported or maintain strict procedures designed to ensure that such information is complete and up to date. This requirement is specific and should not be reduced to a generic claim that all public records must always be rechecked in the same way.

7. Reporting Limits and State/Local Law

Federal FCRA rules operate alongside state and local requirements. The reportability of information can depend on record type, disposition, age, jurisdiction, purpose and other facts. Statements such as 'background checks only go back seven years' or 'all convictions can always be reported' are too broad to be universal rules.

8. Fair-Chance / Ban-the-Box Laws

State and local fair-chance rules can regulate when criminal-history inquiries or background checks occur and may impose additional notice or assessment procedures. Multi-state employers should not assume that one national workflow satisfies every jurisdiction.

9. EEOC Considerations

Title VII addresses discrimination, not consumer reporting. EEOC guidance explains that criminal-history practices can create disparate-treatment or disparate-impact issues. The EEOC guidance distinguishes arrests from convictions and discusses job relatedness and business necessity. The guidance itself states that it does not have the force and effect of law.

10. Pre-Adverse Action

Before taking covered adverse employment action based in whole or in part on a consumer report, an employer must provide the individual a copy of the report relied upon and a copy of the Summary of Rights under the FCRA. This gives the individual an opportunity to review the report before the decision is final.

11. No Universal Federal Five-Day Rule

The FCRA does not prescribe one universal fixed number of days that every employer must wait between pre-adverse and final adverse action. Employers should allow a meaningful opportunity to review and respond and must also consider any more specific state or local requirements.

12. Final Adverse Action

After covered adverse employment action based on a consumer report, the employer must provide the required notice, including the CRA's contact information, a statement that the CRA did not make the decision, and notice of the consumer's rights to dispute information and obtain an additional free report within the statutory period.

13. Disputes and Reinvestigation

Under 15 U.S.C. § 1681i, a CRA generally must conduct a reasonable reinvestigation, free of charge, when a consumer disputes the completeness or accuracy of information in the file. The statute generally sets a 30-day period, subject to statutory provisions and possible extension in specified circumstances. Information found inaccurate, incomplete or unverifiable must be treated as the statute requires.

14. Tenant Screening

Tenant-screening reports are consumer reports. Housing providers must have a permissible purpose and provide an adverse-action notice when information in a consumer report contributes to an unfavorable housing action. Unlike employment, the federal FCRA does not use the same pre-adverse-action sequence for ordinary tenant decisions; housing providers must also consider fair-housing and state/local requirements.

15. Security and Disposal

Screening involves highly sensitive information. Security should address access control, authentication, encryption, monitoring, incident response, vendor management, retention and disposal. The FTC Disposal Rule requires covered businesses and individuals that possess consumer-report information for a business purpose to take reasonable and appropriate measures to dispose of it so it cannot be read or reconstructed.

16. SOC 2

SOC 2 is an independent examination/report concerning controls at a service organization relevant to security, availability, processing integrity, confidentiality or privacy. It is not a government FCRA certification and does not establish the accuracy of individual background reports.

17. PBSA Accreditation

Accreditation-Logo-2-WHITE-transparent_PBSA-1024x841-1

PBSA's Background Screening Organization Accreditation Program is an organization-level accreditation program. Current PBSA materials describe U.S. Employment Screening and General Background Screening standards, desk and virtual on-site audits, a five-year accreditation period and a three-year surveillance touchpoint. PBSA membership and individual FCRA certificate programs are distinct from organization accreditation.

18. Standard Operating Procedures, Training and Auditability

Two CRAs using the same platform and data providers can produce different outcomes because their procedures, training and quality controls differ. Mature programs document criminal research, verification, disputes, customer credentialing, security, quality assurance and escalation—and retain evidence that those procedures are actually followed.

19. Compliance Is Not Risk Elimination

A background report is a snapshot based on ordered searches and available sources. No screening program can predict all future behavior or eliminate every error. The objective is a reasonable, appropriate, accurate and legally responsible process.

20. Accuracy Protects Both Sides

False positives can unfairly cost people jobs or housing. Inadequate screening can expose organizations and communities to risks that appropriate screening might have identified. Responsible screening requires both care not to report information improperly and care not to overlook information that an organization legitimately and lawfully needs.

Compliance Questions Every Buyer Should Ask
  • Are you a CRA subject to the FCRA for the reports you provide?
  • Are you currently accredited under a PBSA organization accreditation standard, and which one?
  • What independent security assessments cover your organization and/or core platform?
  • How do you credential customers and verify permissible purpose?
  • What procedures do you use to assure maximum possible accuracy?
  • How do you match criminal records and handle common names, duplicates and changed dispositions?
  • When do you conduct source-level research?
  • How do you address sealed or expunged information and jurisdiction-specific reporting rules?
  • How do your pre-adverse and adverse-action tools work, and which responsibilities remain with the customer?
  • How can consumers access reports and submit disputes?
  • Who performs reinvestigations and how are corrections communicated?
  • How do you monitor researchers and data providers?
  • What SOPs govern screening operations and how are employees trained?
  • How is consumer information secured, retained and disposed of?
  • How do you audit whether documented procedures are actually followed?

Authoritative Legal and Regulatory Sources