FCRA Checklist Every Hiring Manager Should Keep Handy

Why the FCRA matters for hiring managers

The Fair Credit Reporting Act (FCRA) governs the use of consumer reports — including criminal background checks, credit reports, education and employment verifications, and investigative reports — when they are used for employment purposes. When you obtain a consumer report through a consumer reporting agency (CRA), the FCRA imposes specific notice, authorization, furnishing, and adverse-action obligations.

Key consequences of noncompliance:

• Civil liability, statutory damages, and attorneys’ fees
• State-law penalties on top of federal exposure
• Disqualification of evidence or operational setbacks in hiring
• Reputational damage and lost time handling disputes

Understanding the basic FCRA triggers will keep hiring smooth: a clear, standalone disclosure and candidate authorization are required before requesting a report; if you plan to take adverse action based on the report, you must follow the pre-adverse and adverse action procedures; and you must work with CRAs that follow reinvestigation obligations. Also remember that many states and localities layer additional restrictions and timing requirements on top of the FCRA.

The FCRA Desk Checklist — step-by-step for every hire

Follow these steps in order whenever you’re ordering a consumer report for employment:

1. Confirm permissible purpose

Only request a consumer report for an FCRA-permitted purpose (hiring, promotion, retention, etc.). Document the permissible purpose in the applicant’s file.

2. Use a clear, standalone disclosure and obtain written authorization

• Provide a standalone, clear and conspicuous disclosure that a consumer report may be obtained for employment purposes. This cannot be buried in an employment application or mixed with other materials.
• Obtain the candidate’s written authorization (electronic authorization is acceptable if compliant with electronic signature laws).
• For investigative consumer reports (references, character investigations), include separate disclosure language that alerts candidates to the scope and nature of the investigation.

3. Select and vet your consumer reporting agency

Work only with CRAs that comply with FCRA requirements and have procedures for reinvestigation, data accuracy, and security. Confirm the CRA’s identity and ensure your service agreement includes FCRA-specific certifications.

4. Certify the purpose to the CRA

When ordering a report, you must certify to the CRA that you have a permissible purpose and that you will comply with adverse-action procedures.

5. Define job-related criteria in advance

Adopt written, job-related standards for how background results will be evaluated (e.g., specific convictions that disqualify, or timelines for considering certain offenses). Tailor criteria to the role and document the rationale to support consistent decisions and defend against disparate-impact claims.

6. Consider state and local laws before ordering

Check for state/local restrictions around criminal record use, credit checks, arrest records, and “ban-the-box” policies. Some jurisdictions require additional disclosures or delay questions about criminal history until later in the hiring process.

7. Review the report carefully and verify accuracy

Scrutinize the report for identity mismatches, stale information, or obvious errors. If you have questions, ask the CRA for clarification before taking adverse action.

8. Follow pre-adverse action procedures if the report may lead to a negative decision

Provide the candidate with:

• A copy of the consumer report used
• A written summary of the candidate’s FCRA rights (the CRA provides this)

Allow the candidate reasonable time to review and dispute inaccuracies. While the FCRA does not prescribe a specific waiting period, many employers allow 3–5 business days.

9. Make a reasoned decision and document it

Document how the report and any candidate response were considered against your job-related criteria. Record the dates and content of any candidate communications.

10. If you proceed with an adverse action, send a final adverse action notice

A compliant adverse action notice must include:

• Notice that an adverse action was taken
• The name, address, and phone number of the CRA that provided the report
• A statement that the CRA did not make the adverse decision and cannot explain the employer’s reasons
• Notice of the candidate’s right to obtain a free copy of the report from the CRA and to dispute its accuracy

Deliver the adverse action notice promptly and retain proof of delivery.

11. Keep careful records

Maintain copies of disclosures, authorizations, reports, pre-adverse and adverse notices, and documentation of decision-making. Retention practices should align with company policy, state law, and legal counsel recommendations.

12. Train hiring teams and review processes periodically

Provide recurring training on FCRA basics, state-specific rules, and how to evaluate background information fairly. Periodically audit screening practices and CRA partners for quality and compliance.

Quick printable mini-checklist (for taping to your desk)

• Do I have a permissible purpose documented?
• Is there a separate, clear disclosure and signed authorization?
• Has the CRA been vetted and certified?
• Are job-related standards documented?
• Did I provide copy of report + FCRA summary before any adverse action?
• Did I send a compliant adverse action notice (if applicable)?
• Is the file documented and retained per policy?

Pre-adverse vs. adverse action — what to send, and when

Understanding the two-step adverse-action process is essential:

• Pre-adverse action: This is a notice that you are considering an adverse employment action based on information in a consumer report. At this stage you must provide the candidate with a copy of the report and a copy of the FCRA summary of rights so they can review and dispute inaccurate information. Allow time for a response.
• Adverse action: If, after any candidate response or after your review period, you still decide to take an adverse step (withdraw an offer, terminate an employee, rescind conditional employment), you must send a formal adverse action notice that includes the CRA’s contact information and explains the candidate’s rights to obtain and dispute the report.

Those two steps are distinct. Skipping pre-adverse delivery and jumping straight to adverse action is a common compliance gap.

Common pitfalls and how to avoid them

• Burying the disclosure: Embedding FCRA language in the general application creates risk. Use a standalone disclosure and explicit authorization every time.
• Using the wrong report type: Investigative reports and consumer credit reports have unique disclosure and authorization requirements. Confirm the nature of the report before ordering.
• Failing to tailor job-related criteria: Adverse decisions that appear arbitrary are vulnerable to legal challenge. Document the job-related rationale and how specific information relates to role duties.
• Neglecting state/local rules: State laws can impose stricter requirements than the FCRA. Regularly update screening policies to reflect local regulations where you hire.
• Poor recordkeeping: Lack of proof that you provided disclosures or adverse notices is often fatal in litigation. Retain dated copies and delivery confirmations.
• Overreliance on a single CRA’s findings: If a candidate disputes inaccuracies, coordinate promptly with the CRA to reinvestigate and, if necessary, correct records before taking final action.

Practical takeaways for HR and hiring teams

• Standardize: Create a standardized FCRA workflow within your ATS for every report-ordered hiring flow.
• Document everything: Disclosures, authorizations, report copies, candidate responses, and the rationale for hiring decisions.
• Train regularly: Make sure recruiters and hiring managers understand pre-adverse and adverse steps and know where to find the pre-approved disclosure and notice templates.
• Audit vendors: Include FCRA compliance questions and audit rights in your agreements with CRAs.
• Localize policies: Maintain a state-by-state summary of special requirements (credit checks, arrest record limitations, ban-the-box) for all recruiting locations.
• Make decisions job-related and consistent: Use clear, documented criteria and apply them uniformly across candidates for the same role.

Bottom line: keep it simple, consistent, and documented. A compliant screening process protects candidates’ rights and reduces legal and operational risk for your organization.

If you’d like help translating this checklist into templated disclosures, ATS workflows, audit-ready records retention schedules, or vendor selection criteria, Rapid Hire Solutions helps employers build compliant screening programs that scale. Contact us to schedule a compliance review or operational consultation.