=
The FCRA Checklist Every Hiring Manager Should Print and Tape to Their Desk
Estimated reading time: 4 minutes
- Follow the FCRA step‑by‑step: standalone disclosure + authorization, permissible purpose, and a compliant CRA.
- Document and communicate: provide pre‑adverse materials, allow a reasonable response period, and send a compliant adverse action notice when required.
- Minimize risk operationally: limit scope to job‑related checks, respect state/local rules, secure reports, and train staff consistently.
The FCRA Checklist Every Hiring Manager Should Print and Tape to Their Desk
Use the following items as your step‑by‑step reminder whenever you order or act on a consumer report (criminal, credit, driving record, employment/education verification, or other consumer reports).
1. Obtain a compliant disclosure and written authorization, separately
Action: Provide a clear, standalone disclosure that you may obtain a consumer report for employment purposes. Obtain the applicant’s written authorization (electronic is acceptable) and ensure it is separate from application materials — not buried in a general consent.
2. Confirm a permissible purpose
Verify you have an FCRA permitted purpose (employment screening). Document the business need and the job role that justifies the specific type of report.
3. Use an FCRA‑compliant consumer reporting agency (CRA)
Work only with vendors that certify FCRA compliance, provide timely reports, and furnish dispute handling and identity verification processes. Ensure contracts require adherence to FCRA obligations and data security standards.
4. Limit scope to job‑related checks
Order only reports and fields necessary for the role (e.g., driving records for drivers, credit histories only when legally justified). Avoid broad searches unlikely to influence job performance.
5. Check state and local restrictions before ordering
Confirm state/local laws that restrict credit checks or arrest records or that require special notices (for example, California, New York City, and others). When in doubt, pause the order and check legal guidance.
6. Review the report and identify adverse information
If the report contains information that could lead to denial, demotion, or rescission, prepare to follow the adverse action process. Document the findings and the job‑related basis for concern.
7. Provide a pre‑adverse action packet (must include a copy of the report and Summary of Rights)
Give the candidate a copy of the consumer report and the CRA’s Summary of Rights. Include a clear notice that they are being considered for an adverse action based on the report and explain the next steps in plain language.
8. Allow a reasonable time for the candidate to respond (commonly five business days)
Wait a reasonable period to allow the applicant to review and dispute inaccuracies. Many employers adopt a five business‑day wait — although the FCRA does not prescribe an exact interval — document whatever interval you choose.
9. Make a final decision only after considering any response
If the candidate submits evidence or disputes the report, evaluate the CRA’s reinvestigation results and your internal assessment before taking action.
10. If taking adverse action, send a compliant adverse action notice
Include: the name, address, and phone number of the CRA; a statement that the CRA did not make the decision and cannot explain why; a notice of the applicant’s right to dispute the accuracy or completeness of the report; and a notice of the right to obtain a free copy of the report from the CRA within 60 days. Keep a dated copy and proof of delivery.
11. Handle disputes promptly and document everything
When a candidate disputes, the CRA must reinvestigate within 30 days. Cooperate with the CRA, preserve communications and outcomes, and update your records to reflect the resolution and any change to hiring decisions.
12. Keep records and retention logs
Maintain copies of disclosures, authorizations, reports, pre‑adverse and adverse notices, and dispute correspondence in a secure file. Retain records for at least two years (or as required under state law). Document retention policies and access controls.
13. Protect privacy and secure data
Store consumer reports in encrypted, access‑limited systems. Limit who may view or act on report data and train them on confidentiality obligations.
14. Apply consistent, job‑related decision criteria
Use written policies that define which offenses, timeframes, and report elements disqualify a candidate. Apply them uniformly to reduce legal risk for disparate impact claims.
15. Train hiring managers regularly
Provide periodic FCRA and adverse action training for anyone who orders or interprets reports. Maintain training logs.
Quick adverse‑action timeline (at‑a‑glance)
- Step 1: Provide standalone disclosure + authorization before ordering the report.
- Step 2: Order report and review.
- Step 3: If unfavorable information is found, send pre‑adverse packet (copy of report + Summary of Rights).
- Step 4: Wait a reasonable period (commonly five business days).
- Step 5: Send adverse action notice if you proceed; retain documentation.
- Step 6: If a dispute arises, cooperate with CRA reinvestigation (CRA typically has 30 days to reinvestigate).
Common pitfalls that create unnecessary risk
- Burying the disclosure in a multi‑purpose application instead of using a standalone form.
- Failing to provide the report and Summary of Rights before adverse action.
- Skipping the wait period and immediately rescinding offers.
- Using inconsistent or ad hoc decision criteria that lead to discriminatory patterns.
- Relying on a vendor without verifying their FCRA processes or dispute handling.
- Ignoring state and local screening restrictions and notice requirements.
Making the checklist work for your organization
- Integrate the checklist into your applicant tracking system workflow so disclosures and authorizations are captured before reports are ordered.
- Create standardized pre‑adverse and adverse action templates that include all required FCRA elements.
- Assign a single compliance owner or small team to review background results and send notices — avoid leaving these steps to multiple untrained managers.
- Run periodic internal audits of your background check use to confirm adherence to policies and vendor performance.
- Maintain a living “job‑matrix” that documents permissible report types and disqualifying criteria for each role. Update it when legislation or business needs change.
Practical takeaways for HR leaders and hiring managers
Treat FCRA compliance as an operational step, not an afterthought. Embedding the checklist into hiring workflows protects your organization and improves candidate trust.
“Consistency matters. Use job‑related criteria and document decisions to defend against disparate impact or negligence claims.”
Vendor selection matters: confirm the CRA’s reinvestigation procedures, turnaround times, and security practices before signing an agreement. Train everyone who touches background checks — ignorance is not a defense. Short, scenario‑based training reduces errors and ensures smoother hiring.
Keep the candidate experience clear: transparency about what you’re checking and why reduces surprises and often shortens resolution time when disputes occur.
Contact / next steps
If you’d like a printable version of this checklist or an audit of your current background screening processes, Rapid Hire Solutions can help review your disclosure and adverse‑action templates, recommend compliant workflows, and validate vendor practices to reduce hiring risk. Contact our compliance team to get started.
FAQ
What is the FCRA and why does it matter for hiring?
Answer: The Fair Credit Reporting Act (FCRA) governs how employers obtain and use consumer reports for employment purposes. It sets requirements for disclosures, authorizations, CRA selection, and adverse action procedures to protect consumer rights and limit employer liability.
How long should we wait after sending a pre‑adverse packet?
Answer: The FCRA does not prescribe a specific wait period. Many employers adopt five business days as a reasonable interval. Whatever you choose, document the policy and follow it consistently.
What must be included in an adverse action notice?
Answer: The notice must include the CRA’s name, address, and phone number; a statement that the CRA did not make the decision and cannot explain why; a notice of the right to dispute the report’s accuracy or completeness; and a notice of the right to obtain a free copy of the report from the CRA within 60 days.
Do state or local laws change these steps?
Answer: Yes. State and local laws (for example, California and New York City) may restrict certain checks or require additional notices. Always verify local requirements before ordering reports.
How long should we retain background check records?
Answer: Retain disclosures, authorizations, reports, notices, and dispute correspondence for at least two years, or longer if required by state law. Maintain documented retention policies and access controls.