Security primer: Outsourcing employee background checks

For security directors and company executives, protecting a company’s people and assets encompasses the implementation of a wide variety of different solutions. For some this might be the addition of video surveillance or an employee card-based ID system. Still for others it might involve the use of information security policies to protect company data. -

Perhaps overlooked by some security directors, however, is the need to make sure the people working for the organization are honest, safe and legally qualified to work. One of the best ways that companies can make sure that its employees are on the “up and up” is to conduct background screenings on new employees in sensitive positions. More and more often, corporations turn to companies that specialize in such background screenings. However, before selecting a screening firm, companies must make sure the screening firm has the necessary tools at its disposal to ensure that the information about the potential hire is both timely and accurate.

According to Jim Collins, president of HR Plus, a division of AlliedBarton which conducts background screenings, one of the first recommendations he makes to clients is to consult with an expert in their industry to examine what their risks are. Knowing the company’s overall risk exposure tells both the security director and the screening firm what they need to look for when screening new hires.

“They really have to understand what their risk is first. Once they understand that piece of it, they can come to a background screening company or if the background screening company has an industry expert… we can tell them what to use, what package and searches to use to make it a better option for them to hire the correct person,” Collins said.

Collins added that just as important as an initial screening is to consider doing a follow-up check on employees. He said that some companies should even consider an annual check.

“All too often, companies are very careful about who they hire, but once they hire somebody, they never recheck that individual for years, if at all,” Collins said.

Bill Whitford, senior vice president and general manager of workplace solutions for LexisNexis owned ChoicePoint, a background screening firm based in Alpharetta, Ga., suggests that businesses do some checking themselves before hiring a screening firm. Whitford says that a company needs to make sure that the screening firm is reputable and has good references. He added that it’s also important to understand what its security and privacy policies are (i.e. how is their data warehoused and maintained), and whether the screening firm is financially stable.

What to check when checking a background

In addition to determining if an employee is ethically qualified to fill a vacant position, companies must also take steps to determine if a person is even legally able to work.

Former Immigration and Naturalization Service Special Agent Neville Cramer says that many organizations either fail to adequately check or outright ignore the immigration status of an employee. Not checking, said Cramer, exposes a company to substantial risks and possibly compliance and liability issues.

Unlike many positions held by illegal immigrants in industries such as farming and landscaping that are considered to have a low security risk, Cramer said that illegal immigrants are often hired to fill such positions as security guards and cleaning crews, which can give them “unfettered access” to sensitive information. To avoid such a liability, Cramer, who now runs a security consulting firm in his home state of Arizona, advises companies to use the Department of Homeland Security’s E-Verify system.

“What that does is two things. First of all, it allows the company to electronically verify the information submitted by the employee regarding their Social Security number, their alien registration number, their name, their date of birth and it makes certain that that information, whether it be for a citizen or an alien, matches the data that is both in the Homeland Security database and the Social Security database,” he said. “The second thing it does is it allows the government to profile that information and to begin to locate questionable activity such as the verification of a single social security number being verified 25 times in 15 different states all within the same two or three days. That type of activity would obviously raise concern any to law enforcement agency regarding the theft and use of that Social Security number for fraudulent purposes.”

Another aspect of background checks that organizations need to consider is the type and depth of screening that needs to be done. There are different tiers of background searches which can be conducted on prospective and existing employees. The depth of the search typically depends upon the type of information or assets a person would be privy to within the organization. In other words, the night janitor of a specific facility might not be subjected to as intensive a check as an incoming CEO who would have access to all of the company’s funds and financial records, information secrets and facilities.

“The more intense the information is the individual will be handling, the more thorough the background check you want to do. The main thing is you want to guard your company and your company’s secrets,” said Collins.

Whitford says that it may also be worth considering utilizing sources beyond the screening firm when it comes to high level positions.

“Firms like ChoicePoint are good for due diligence on the run of the mill employee. If (a company) is looking for a CFO, they’re probably going to go hire a private investigator and will [also] use some information from a company like ChoicePoint,” he said.

How background checks are conducted

According to Collins, HR Plus pulls its information from a variety of sources, as well as directly from the courts in the jurisdictions where the employee lives. The company then checks it against the information they have for the individual to make sure it matches. That information is then submitted to the company, which will make a pass or fail determination of that person.

In most cases, Collins said the background check process can take just a matter of hours. If the information is incomplete or something raises a red flag, the process of verifying and finding information could take up to several days.

To avoid potential lawsuits, Collins recommends that the screening firm companies have an onsite compliance department to ensure that when a background check is done, that it is conducted within federal and state guidelines, which are frequently changing.

Collins said that the cost of a background check averages about $45, and he said that is small price to pay, compared to the alternative of hiring an unethical or unsafe employee. Those companies who don’t conduct or minimize background checks open themselves up to the “pool of undesirables,” according to the HR Plus president, which are people who seek out companies that follow such practices.

In the case of ChoicePoint, which conducts background screening in over 190 countries, the company offers a Web based solution in which its clients can log onto their CPScreen interface and enter in the employee’s information and select a package of services based upon the different verifications that may be needed for that position such as education, work history, criminal history, drivers license, etc.

According to Whitford, the average process for ChoicePoint takes anywhere from two to five days and costs range from $20 up to $100, depending on the type of information that’s requested.

Employee background check compliance issues

Lynn Mattice, former chief security officer for Boston Scientific and current chairman of the board of advisors of the Security Executive Council, warns that just hiring a screening firm may not protect a company from making a bad hire.

“I’m a little concerned about the move that’s taken place to go to what I call ‘production background investigation firms.’ It’s a ‘background-investigations-in-a-box’ kind of thing,” said Mattice. “I don’t think they typically get the depth and breadth of investigations that are necessary and many times they don’t have the oversight within companies that they should have to make sure that they have built the proper structure into the background investigation method that they’re using.”

Before a company hires a screening firm, Mattice recommends the employer first have a structure in place with categories which they can easily assign a potential employee’s information to either qualify or disqualify them as a candidate. This would therefore make sure that the screening company knows what types of things to look for when investigating an individual.

During his time as head of security at Boston Scientific, Mattice said he worked closely with the company’s human resources department to create just such a structure. Security and HR worked together to determine how far back into a person’s history the background check needed to search. The process was designed to validate work and education credentials; it also searched for issues that may have arisen in previous work jurisdictions.

He added that it is “incumbent” in today’s regulation-filled business world for organizations to not only thoroughly investigate who they hire, but also who they’re doing business with.

Laws, he said, which have provisions for how and who companies hire include the Patriot Act, the Foreign Corrupt Practices Act and the U.S. Sentencing Guidelines.

In today’s age of widespread Internet usage, Mattice said organizations hiring someone for an executive level position are checking social networking Web sites such as YouTube and MySpace to see what type of behavior -- if any -- has been exhibited which could later serve as a liability to the company.

The most important thing that he says companies need to keep in mind when they’re developing a methodology for background investigations is to be aware of the local and federal guidelines regarding screening procedures.

“I think (companies) have to seriously look at and clearly understand what it takes to be in compliance with laws and regulations and build a structure or program around that. And [they have to] understand what they’re willing to accept and what they’re not willing to accept,” he said.

Loading