Background Investigations & Screening

Why Background Screening Matters in Personnel Security

Personnel security is the layer of an enterprise security program built around the people who work inside the perimeter -- screening them before hire, monitoring changed risk during employment, and protecting the organization when a hiring decision must be reversed. The CPP exam tests background screening as an applied, legally constrained process, not just an investigative skill. A CPP-level security manager designs the screening policy, selects and evaluates information sources, and ensures every step complies with federal, state, and local screening laws -- chiefly the Fair Credit Reporting Act (FCRA).

Background Investigation and Screening Techniques

Pre-employment screening blends several investigative techniques, scaled to position risk:

• Identity verification -- confirming the applicant is who they claim to be (SSN trace, identity document review).
• Criminal history checks -- county, state, and federal court record searches, sometimes supplemented by a national criminal database as a locator (never as a final adjudication source, since national databases can be incomplete or outdated).
• Employment and education verification -- confirming dates, titles, degrees, and licenses directly with the issuing institution or past employer.
• Reference checks -- structured interviews with supervisors or peers, focused on job-relevant conduct.
• Financial/credit history review -- used selectively, generally for positions with fiduciary or financial-control responsibility.
• Drug screening and, where legally permitted, polygraph -- the latter is tightly restricted for most private-sector employers under the Employee Polygraph Protection Act.

Higher-risk or higher-trust roles (executives, finance, IT administrators, positions with access to classified or proprietary information) warrant deeper investigation; the exam expects candidates to scale screening depth to position risk rather than apply one standard package to every hire.

Information Sources

Social media screening carries particular risk: reviewers can inadvertently learn an applicant's protected-class status (religion, disability, pregnancy, and similar categories), creating discrimination exposure even when the hiring decision was unrelated. Programs that use social media screening should route it through a designated reviewer who filters out protected-class information before it reaches the hiring manager.

Screening Policies and Guidelines

A defensible screening program requires a written policy that defines: which positions require which screening package; who is authorized to order and review reports; how long results are retained; and how adverse information is adjudicated (an individualized-assessment process, not an automatic disqualifier). Consistency across candidates for the same role is essential -- inconsistent application of screening criteria is one of the most common sources of discrimination claims.

Screening Laws: FCRA Requirements

The Fair Credit Reporting Act governs any employer that obtains a consumer report -- including a criminal background check compiled by a third-party consumer reporting agency -- for employment purposes. FCRA compliance runs through three phases:

1. Before ordering the report:

• Provide a clear, standalone written disclosure that a consumer report may be obtained.
• Obtain the applicant's written authorization.
• Certify to the consumer reporting agency that the employer will comply with the FCRA, including the adverse-action process.

2. Before taking adverse action (not hiring, rescinding an offer, or terminating based in whole or in part on the report):

• Send a pre-adverse action notice that includes a copy of the consumer report and the CFPB's summary of consumer rights under the FCRA.
• Allow a reasonable waiting period before finalizing the decision -- industry practice and FTC guidance treat approximately five business days as a reasonable minimum, giving the applicant time to review the report and dispute inaccuracies with the reporting agency.

3. After the waiting period, if the employer proceeds:

• Send a final adverse action notice stating the decision, identifying the consumer reporting agency, noting that the agency did not make the decision and cannot explain it, and advising the applicant of the right to a free report copy and to dispute inaccurate information.

Ban-the-Box and EEOC Considerations

Ban-the-box laws -- enacted in many states, cities, and for federal contractors and agencies -- delay the criminal-history inquiry on the job application until later in the hiring process, typically after a conditional offer, so candidates are evaluated on qualifications first.

Under Title VII, the EEOC treats blanket criminal-history exclusions as a potential source of unlawful disparate impact against protected classes. EEOC guidance directs employers toward an individualized assessment before excluding a candidate for a criminal record: the nature and gravity of the offense, the time elapsed since the offense or completion of sentence, and the nature of the job held or sought. A defensible program documents this assessment for every adverse decision rather than applying a fixed conviction-based bar.

Key Compliance Checklist

1. Standalone disclosure and signed authorization before ordering any consumer report.
2. Position-scaled screening criteria applied consistently across candidates.
3. Pre-adverse action notice plus report copy and summary of rights, then a reasonable waiting period.
4. Individualized assessment before any adverse decision based on criminal history.
5. Final adverse action notice if the employer proceeds with the decision.