Summary. Background check compliance fails on formatting and sequencing rather than on judgment, which is why the violations are uniform and the cases are classes. The disclosure must sit alone on its own page; the report and the current summary of rights must be delivered before any decision is communicated; a real waiting period must elapse; and the adverse action notice must contain four specific elements. This checklist covers each in order, adds the individualized assessment that federal guidance and a growing number of fair chance laws require, and includes the governance items that convert an isolated failure into a defensible program.

What this checklist is for. Running a compliant employment screening process. For the full framework, see Hiring With Background Checks.

Phase 1 — Before the report is ordered

  • Deliver a clear and conspicuous written disclosure that a consumer report may be obtained for employment purposes.
  • Confirm the document consists solely of the disclosure. No liability waiver. No state notices. No application content. No vendor description. No arbitration agreement.
  • Deliver state and local notices on separate documents.
  • Obtain written authorization, which may appear on the same document as the disclosure — and nothing else may.
  • Confirm the disclosure is written in plain language a reasonable applicant would understand.
  • Where personal interviews will be conducted, deliver the additional investigative consumer report notice within three days, with a description of the nature and scope available on request and the required summary of rights.
  • Confirm no criminal history question appears on the application in any jurisdiction that prohibits it — and remove it everywhere if you hire in multiple states.
  • Confirm no salary history question is asked.
  • Confirm the inquiry occurs at the point the applicable fair chance law permits — after an interview, or after a conditional offer in the strictest jurisdictions.
  • Certify to the consumer reporting agency that you have complied and will comply with the adverse action requirements and with equal opportunity law.

Phase 2 — Scope the report

  • Order only what the role requires, documented by job family. A single broad package for every position is wasteful and creates discrimination risk.
  • Confirm the vendor suppresses records the applicant's state prohibits reporting — expunged, sealed, pardoned, juvenile, dismissed, deferred, and in several states convictions older than seven years regardless of salary.
  • Maintain a written targeted screen stating, by job family, which records are potentially disqualifying and why, addressing:
    • the nature and gravity of the offense or conduct;
    • the time elapsed since the offense, the conduct, or completion of the sentence; and
    • the nature of the job — duties, environment, degree of supervision, and contact with the public or with vulnerable populations.
  • Confirm no blanket exclusion applies without regard to those factors.
  • Identify any statutory or regulatory disqualification applicable to the role.

Phase 3 — Pre-adverse action

Before any decision is communicated:

  • Send a copy of the consumer report.
  • Send the current CFPB "A Summary of Your Rights Under the Fair Credit Reporting Act." Confirm the version; the form has been revised and an outdated form is itself a violation.
  • Send any state-required notices and forms.
  • Include a cover letter identifying the specific information at issue and providing the vendor's contact information and dispute instructions.
  • Where a fair chance law applies, include the written individualized assessment, identifying the conviction, the reasoning, and the factors considered.
  • Wait. A minimum of five business days, and longer where a state or local law requires it. Enforce the wait in the applicant tracking system rather than by memory.
  • Do not communicate any decision — not verbally, not by silence with a filled position, not by an automated rejection.

Phase 4 — Considering the response

  • Read and consider any response substantively, and document that consideration.
  • Where the applicant disputes accuracy, hold the decision until the agency's reinvestigation concludes, and re-evaluate on the corrected report.
  • Where a fair chance law provides an extended period for the applicant to gather evidence, honor it.
  • Consider the information the EEOC's guidance identifies as relevant: the facts and circumstances; the number of offenses; age at the time; the same work performed without incident since; employment history before and after; rehabilitation, training, and education; references; and bonding.
  • Record the decision and its basis, tied to the targeted screen.

Phase 5 — Adverse action notice

If proceeding, send a written notice containing:

  • The name, address, and telephone number of the consumer reporting agency, including a toll-free number for a nationwide agency.
  • A statement that the agency did not make the decision and cannot explain why it was made.
  • Notice of the right to obtain a free copy of the report from the agency within 60 days.
  • Notice of the right to dispute the accuracy or completeness with the agency.
  • Any state-required content, including reconsideration or appeal rights.
  • Send reasonably promptly after the decision, in writing, with a record retained.

Phase 6 — Adjacent screening

  • Credit reports used only where the state permits and only for roles with financial responsibility, access to significant assets, or managerial authority, with the reason stated where required.
  • Drug testing consistent with state law, including the states that prohibit adverse action based on off-duty cannabis use or on a positive test for metabolites, with exceptions for safety-sensitive and federally regulated roles.
  • Reference checks conducted directly are not consumer reports; document what was said and by whom.
  • Social media review performed by someone who is not the decision-maker, using defined criteria, passing along only job-related findings — and never requesting passwords or private account access.
  • Off-duty conduct protections checked in the applicable state.
  • Form I-9 completed for every hire, and E-Verify used only where required and only after an offer.

Phase 7 — Governance

  • Build the workflow to be jurisdiction-aware in the applicant tracking system, driven by the position's location and the applicant's location.
  • Train recruiters, hiring managers, and HR business partners annually.
  • Have counsel review the forms annually against current case law and current CFPB forms.
  • Retain the disclosure, authorization, report, pre-adverse and adverse action notices, individualized assessment, and applicant response for at least the applicable limitations and recordkeeping periods.
  • Manage vendors: accuracy procedures, record-matching protocol, suppression rules, the forms the vendor sends on your behalf (which you are liable for), dispute turnaround, data security, indemnification backed by insurance, and audit rights actually exercised.
  • Do not delegate the judgment. A vendor's automated pass/fail adjudication does not transfer liability and looks like the blanket exclusion enforcement targets.
  • Confirm the EPLI policy covers FCRA claims and at what limit; many exclude or sublimit them severely.
  • Inventory any automated employment decision tool, obtain its bias audit and validation study, provide required notice and an alternative process, and keep a human decision-maker who can explain the reasoning.

Common mistakes

  1. A disclosure with a liability waiver in it, which courts have held is a willful violation.
  2. State notices on the same page as the federal disclosure.
  3. The disclosure embedded in the application.
  4. No pre-adverse action notice, or one sent simultaneously with the decision.
  5. An outdated summary of rights.
  6. No waiting period, or one enforced by memory.
  7. An adverse action notice missing the toll-free number or the sixty-day right.
  8. A blanket criminal history exclusion applied to every role.
  9. A national process run in cities with their own fair chance ordinances.
  10. Vendor forms never reviewed, and used for years.

Primary authority

Related

This checklist is educational and not legal advice. State and local fair chance, credit, salary history, and drug testing laws differ substantially and change frequently, and FCRA form requirements are updated periodically. Consult qualified employment counsel before implementing or modifying a screening program.