The need for accountability in background checks

So, how much trust do we put in background screening? The answer is: A lot. We generally assume that the data is accurate and current. But what if it isn't? It does happen, admittedly, as evidenced so perfectly in this case of a 13-year Army veteran who went to apply for a retail management position and then found out his background check information had been tainted by a criminal falsely using his social security number during an arrest. The incident went favorably for the vet, largely because he was picked for support by a privacy rights advocacy organization that was able to get his background information reviewed in an expedited manner. But what happens for all of the other persons who have incorrect information on their background checks?

According to MSNBC reporter Bob Sullivan in his article "Background check flaw almost costs Iraq vet", recourse for misinformation is designed to be part of the process, and it's even required by law:

Firms that use criminal background checks as a reason to deny a candidate are required by federal law to follow a two-step process for informing the applicant.  When the discovery is made, a "pre-adverse action" notice is supposed to be sent to the applicant. Later, if the applicant is rejected, an "adverse action" notice is required. Both are designed to give applicants a chance to correct errors that might appear in background reports and cause a firm to make an unfair decision.

But the problem is enforcement. Do most companies notify applicants? Do they even question whether the information received as part of the background check process might be inaccurate in this day and age of stolen identities? I'd venture to say, "No." They pick up the next application and move forward with another candidate.

This, then, is a compliance issue, and more than likely your own security department is not in compliance. Did you notify each applicant whom you rejected based on a background check of the flags against them on their record? If not, then why not? Would you expect the same level of accountability and notification if you were the one on the other side of the HR table with misinformation on your background file? My recommendation: Put together a process for notification of rejected applicants when they are rejected based on background checks and searches. One reason to do it is to become compliant. The other reason to do it is that it's simply the right thing to do for your fellow man.

-Geoff Kohl, editor-in-chief
SecurityInfoWatch.com