BankInfoSecurity.com - Information Security News, Regulations, & Education

Bank Information Security Articles

6 Steps for Better Background Checks

Credit
Eligible
As a BankInfoSecurity.com annual member, this content can be used toward your membership credits and transcript tracking. Click For More Info
Stopping the Insider Threat Starts With Screening Your Job Applicants
January 21, 2008 - Linda McGlasson, Managing Editor

This article was originally created for BankInfoSecurity.com, and contains information that should interest our GovInfoSecurity.com readers.
Share

Comment on this article

Employee background checks - they're the first line of defense against the insider threat. And increasingly financial institutions are performing these investigations - or outsourcing them - as a means of screening applicants for jobs involving access to sensitive information of transactions.

"Everyone is doing background checks, including criminal and credit background checks, regardless of what industry a company operates in," says Garen E. Dodge, head of the employment and labor practice with Wiley Rein & Fielding, a Washington, D.C.-based law firm. The key driver behind the trend: Greater attention to internal security, with companies looking to cover liability issues due to privacy concerns. "Protecting the interests of customers, shareholders and the institution is something to consider when developing your institution's hiring practices," Dodge says.

Some banking institutions use their own human resources departments to check references; others use a third-party service provider to perform the checks. Either way, institutions must ensure compliance with state laws and the requirements under the federal Fair Credit Reporting Act (FCRA).

Scott Smith, Executive Vice President of American Background, a national firm that performs background checks for financial institutions, says he see some screening 100 percent of their employees, while others take a more targeted approach and assess each position by risk potential. "Certain positions have very high turnovers, so organizations, in attempting to balance the business case versus the cost of background checks, will assess the level of risk a certain job position holds and the level of information that the person will have access to," he says.

Click to Get Updates on the Latest Information Security News

Some points to consider in assessing risk and deciding about a background check:

  • What level of personal information will the employee have access to?
  • How closely will they be supervised, and will they have unsupervised access to sensitive information or transactions?
  • What authority will they have to commit financial transactions or change account records?
  • Should positions with high access or authority require more stringent background checks?

Following are six best-practices to consider when conducting background checks:

1) Start with Verifying the Resume

The first thing that must be stressed - people will lie on their resumes.

"This can range from what their grade point average was, or the job titles they held, or even the degrees they've earned," says Eric Cole, an independent information security and insider threat expert.

The best way to mitigate this deception, Cole says, is to have a disclaimer in your employment application that the applicant must attest that the information on their resume is true to the best of their knowledge. If they won't agree, that's your first warning sign. Proceed with caution.

2) Broaden the Reference Checks

Any authorization to perform background checks should include the candidate's okay to speak to anyone at their previous jobs -- not just supervisors or managers.

"That way you have a wider variety of people to speak with at previous jobs," Cole says. "When you have their permission to speak with anyone who they worked with, this helps uncover the candidate's moral and ethical thought processes."

Uncovering these processes includes questions about any changes in behavior when the person worked at the company. "Were there major changes in finances? For example, a person who had been driving an older model car suddenly shows up driving a sports car -- that would clearly indicate a point that you'd want to know more details about," says Cole.

One weakness in this process: Previous employers are often reluctant to provide candid information about a previous employee for fear of being sued. Attorney Dodge recommends that an institution have a release that an applicant signs during the interview process, allowing the institution to ask information from previous employers. "The release should say 'I waive my rights to sue a previous employer and allow them to give them the right to give information about my job performance'," says Dodge. This type of release helps uncover the real reasons why an applicant left a previous position, he adds.

3) Heed the Early Warning Signs


1 | 2




Question
Question
?For whom do you currently conduct background checks? And how?
Here's your chance to be a part of the dialogue and engage with your peers! Just enter your comment to the right, click submit to send it to our Editor. All entries are posted anonymously.
Please login if you would like to post a comment on this question.

"All employees. We do our own background checks because of the difference in the federal and state (Oklahoma) FCRA requirements. We are working with counsel but nothing has happened yet.