Background Investigations Are Not All Created Equal

Background Investigations Are Not All Created Equal
About a year ago I was in process of trying to find an information security professional to augment existing staff. Our company used a personnel firm who specialized in placing contract IT and security professionals. It occurred to me that we weren't very circumspect about requiring background investigations before hiring contractors. That needed to change. I didn't know enough about how background checks were performed and I wasn't sure that our HR organization was requiring them for contractors, so I took it upon myself to ask the personnel firm to perform one. I never received any kind of report, just an email stating the check had been performed and the person checked out fine. We contracted the young man to work for us, but it bothered me that I didn't really understand what had been done and what "checked out fine" really meant.

I did a little research on the net and found very little helpful information. I did notice a variety of websites promising quick background checks for a small fee. I contacted a well known company in San Francisco and talked to the one the HR persons there and found out that they used a company called Inquest. I contacted a company representative to find out more.

A variety of checks can be performed including the usual resume verification, criminal background, DMV, credit report checks, and drug screening if required. Post hire, a social security and workman’s compensation search can be performed. But, the interesting thing I learned about the criminal check is that results depend upon what types of databases are searched. Not all databases are as up to date as others. For instance, the FBI’s National Crime Information Center database is an aggregate of police and court records and while it casts a wide net, it could be up to a year out of date in some instances. There are some commercial databases available, but not all states and counties participate and the records are mostly felony level records. The most accurate results are found when searching local county records, which implies you need to have prior address information which can be obtained by running a credit report or a social security trace. The gentleman I spoke with mentioned that they find an 8-10% hit rate for criminal records.

You would think that resume verification would be the smaller portion of a background investigation, but think about it. If a person is not truthful on his or her resume, why would you go to any further expense and effort to find out more? There are such things as “Internet diplomas” or degrees from schools that are not accredited. My contact mentioned that they find a 40% discrepancy rate when performing resume verifications, however that does include employment start and end dates; items that can be quickly cleared up with the candidate. Employment verification is pretty straightforward, nonetheless important.

There are a variety of drug screening tests that check for illicit drug use (meth, THC, cocaine), a urine test being the most popular. Some companies even request checking for prescription drug use (vicadine, valium) and drugs that fall under the barbiturate category. Drug testing is generally required by companies in the transportation industry, however many employers are now requiring a drug and alcohol free environment. DMV checks would produce moving violations and DUIs.

While not all companies run a full credit check, most run a quick check that will show at a glance what names the applicant has used, previous addresses, and if any major unfavorable situations are underway. Inquest must comply with Fair Credit Reporting Act and the candidate must sign an agreement giving permission for the credit report to be run. The candidate also has rights under FCRA should any negative information be considered that might affect the company’s decision whether or not to hire the candidate. If negative information is under consideration, the company must produce a “pre-adverse action letter” to the candidate and the candidate has the right to correct any inaccuracies and respond within 3-5 business days. If the candidate does not respond, an “adverse action letter” must be produced and even then the candidate has the right to respond. Inquest must reinvestigate incorrect information.

Companies can open themselves up to a lawsuit if they don’t follow the law exactly, especially in regards to credit checks. Statistically, those persons who are considered minorities often have lower credit scores and poorer credit reports than those who are not. Inquest recommends running credit checks only if specifically relevant to the position. For example, the receptionist’s credit report would not be as important as the controller’s.

In regards to International investigations, other countries have different rules and regulations than the United States. In some countries, privacy laws are much stricter. It is important to use a firm that specializes in International background investigations and that is familiar with local and country laws. Inquest partners with a firm that specializes in International investigations.

Only after a company has made an offer to a candidate can a workman’s compensation search be performed. The only reason for running a search of this type is to ensure that the candidate can perform the job functions with reasonable accommodation. Social Security searches are of two kinds: trace and verification. A trace can be performed and requires a credit report to verify that the person has used the same social security number throughout his or her life. Verification only requires calling the Social Security Administration with date of birth and gender to verify that the card produced by the candidate appears to be theirs.

And last but not least, how much do these investigations cost? I was pleasantly surprised to find the pricing between $50 and $100 U.S. depending upon the type of investigation requested. The cost is a small price to pay to ensure that the hiring decision has a good foundation. When choosing a company to perform background investigations, make sure that they follow a best practices approach. Your efforts to ensure a thorough and proper background investigation will reduce your risks associated with a poor hiring decision.


About the Author

Marcia J. Wilson, CISSP, CISM

Marcia J. Wilson is an Information Security Professional and a freelance writer. Her expertise includes network security assessments, information security policy and procedure development, business continuity and disaster recovery planning as well as security awareness training for small and medium sized companies.




Around the Network