FCRA Checklist Hiring Managers Should Tape to Their Desk

• You must have a permissible purpose and written authorization before obtaining a consumer report.
• Disclosure must be a stand‑alone document (do not mix it with other hiring language).
• If you plan to take adverse action, provide a pre‑adverse notice with a copy of the report and the consumer’s Summary of Rights, then follow with a final adverse action notice.
• State and local laws may add restrictions (criminal history rules, credit report limits, “ban‑the‑box” requirements). Always check applicable state/local requirements in addition to the FCRA.

Use this step‑by‑step checklist whenever you order background checks or act on screening results.

• Verify the position justifies the type of report you’re ordering (employment purpose only).
• Limit searches to job‑relevant checks: criminal, education, license, driving records, and credit only when permitted and job‑related.

• Give the candidate a clear disclosure that solely states you may obtain a consumer report for employment purposes.
• Obtain a separate written authorization (signed or electronic) before ordering any report.

• Work with a CRA that follows FCRA procedures and can provide necessary documents (report copy, Summary of Rights).
• Certify to the CRA that you have authorization and a permissible purpose.

• Evaluate results against job‑related criteria and consistent policies.
• For criminal records, apply an individualized assessment where required by federal guidance and local law: consider the nature of the offense, time elapsed, and evidence of rehabilitation.

• Provide the candidate with a copy of the report and the CRA’s Summary of Rights.
• Give the candidate a reasonable period to review and dispute. Best practice: allow five business days (confirm state rules).

• Include the CRA’s contact information, a statement that the CRA did not make the decision, and a notice of the candidate’s right to dispute report accuracy.
• Keep a dated record of the notice and method of delivery.

• Retain disclosure, authorization, report copies, pre‑adverse and adverse notices, and related correspondence in a secure file.
• Follow federal and state retention requirements (confirm local rules; many employers keep records for at least five years).

• Use consistent screening policies and written criteria for job relevance.
• Train interviewers and decision‑makers on FCRA steps and state‑specific limits.

• Periodically audit screening practices for compliance gaps.
• Update templates for disclosures, authorizations, and adverse action notices for legal and operational changes.

Criminal record information is often the most legally sensitive. Follow these rules to protect your organization and treat candidates fairly:

• Apply screening consistently across similarly situated roles to avoid disparate impact claims.
• Use job‑relatedness: restrict use of specific offenses to roles where they are relevant (for example, theft‑related offenses for finance roles).
• When a conviction could lead to an adverse action, perform an individualized assessment. Consider:
  • Severity and nature of the offense
  • Time elapsed since the offense
  • Evidence of rehabilitation or mitigating circumstances
• Document the rationale and keep records of the individualized assessment.

Federal guidance emphasizes individualized review; many cities and states also require it. Make your process repeatable and defensible.

Don’t skip or rush these two distinct steps.

Pre‑adverse action (before you deny or rescind an offer):

• Provide the candidate a copy of the consumer report and the CRA’s Summary of Rights.
• Tell the candidate an adverse action is being considered and encourage them to dispute inaccuracies.

Final adverse action (after you decide):

• Send a formal notice stating the decision and including:
  • The name, address, and phone number of the CRA that supplied the report
  • A statement that the CRA did not make the adverse decision and cannot explain it
  • A reminder of the candidate’s right to dispute the report’s accuracy and obtain a free copy where applicable
• Keep proof of delivery and the exact notices used.

Timing: The FCRA does not prescribe a fixed waiting period between pre‑adverse and final adverse notices, but allowing a reasonable time for review (commonly five business days) reduces risk and is more candidate‑friendly. Account for state‑specific rules.

State law frequently adds requirements or restrictions beyond the FCRA. Common variations include:

• Ban‑the‑box or delayed inquiry rules that restrict asking about convictions early in the process.
• Limits on use of credit reports for employment.
• Different notice or waiting‑period requirements.
• Additional data privacy rules for storing and sharing background data.

Before you finalize an adverse action or select a screening package, confirm the rules that apply to the candidate’s work location and the employer’s principal place of business.

• Pick CRAs that supply FCRA‑compliant documentation (report copies, Summary of Rights) and support electronic disclosure and e‑signatures.
• Ensure your applicant tracking system (ATS) integrates securely with screening workflows and captures consent and notices automatically.
• Implement role‑based screening templates to prevent human error and inconsistent practice.

Vendors who proactively support compliance reduce your administrative burden—ask about their audit support and dispute‑handling procedures.

• Always use a standalone disclosure and obtain written authorization before ordering a report.
• Treat pre‑adverse and adverse steps as mandatory checkpoints; document them carefully.
• Keep screening consistent and job‑related; apply individualized assessments for criminal records where required.
• Check state and local rules before ordering or acting on a report.
• Train managers and automate notices through your ATS or screening vendor to reduce human error.

Checklist to print: Use the nine boxed steps under “The printable FCRA checklist” section as a quick daily reference.

FCRA compliance isn’t paperwork for its own sake—it’s how employers fairly evaluate candidates and minimize legal risk. A simple, repeatable process that includes a stand‑alone disclosure, valid authorization, careful review, pre‑adverse and adverse notices, consistent policies, and proper recordkeeping will protect your organization and support fair hiring decisions.

If you want a compliance‑ready screening workflow or need help building templates and processes that align with federal and state requirements, Rapid Hire Solutions can help you standardize screening, automate notices, and document results—so your team can make faster, defensible hiring decisions.

1. What is a stand‑alone disclosure and why is it required?

   Answer: A stand‑alone disclosure is a document that only states the employer may obtain a consumer report for employment purposes. The FCRA requires it to be separate so candidates clearly understand a background check is being requested and can give informed authorization.

2. How long should I wait after sending a pre‑adverse notice?

   Answer: The FCRA does not set a fixed waiting period. Allowing a reasonable time (commonly five business days) is a best practice and helps reduce risk, but you must also confirm any state‑specific waiting periods.

3. When is an individualized assessment required for criminal records?

   Answer: Federal guidance recommends individualized assessments whenever a conviction could lead to an adverse action. Many states and localities have explicit requirements. An individualized assessment should consider the nature of the offense, time elapsed, and evidence of rehabilitation, and it should be documented.

4. Can I use credit reports for employment screening?

   Answer: Some states limit or prohibit use of credit reports for employment. Where allowed, credit checks should be job‑related and comply with both the FCRA and applicable state/local rules. Verify restrictions before ordering credit reports.

5. What records should I retain and for how long?

   Answer: Retain disclosures, authorizations, report copies, pre‑adverse/adverse notices, and related correspondence in a secure file. Follow federal and state retention rules—many employers retain records for at least five years, but check local requirements.