FCRA Checklist Hiring Managers Should Keep at Their Desk

Why the FCRA matters for hiring teams

The FCRA Checklist to print and tape to your desk

Pre-check (before you request a report)

• Confirm permissible purpose: Verify the position is covered by a permissible employment purpose under the FCRA.
• Job relevance and policy: Ensure your background-check policy specifies which positions require reports and that criteria are applied consistently.
• Check local laws: Confirm there are no state/local restrictions or waiting-period rules (e.g., “ban-the-box,” criminal-history timing limits, or CRA licensing).
• Choose a CRA and get documentation: Use a reputable consumer reporting agency and obtain their FCRA compliance certifications and data-security practices.

Disclosure and written authorization (must be before ordering)

• Provide a clear, standalone written disclosure that a consumer report may be obtained for employment. It must not be part of an acknowledgement or buried in an application.
• Obtain the candidate’s signed written authorization (electronic signatures permitted if compliant with e-signature rules).
• If requesting an investigative consumer report (background check involving interviews or character checks), notify the candidate that an investigative report may be obtained.

Receiving and reviewing a consumer report

• Limit access: Restrict report access to personnel who have a legitimate need to know.
• Verify identity and relevance: Confirm the report pertains to the correct candidate and review only the information relevant to the job.
• Accuracy check: If the report contains alarming or unexpected items, allow time for verification—reports can contain mistakes, name confusions, and outdated records.

Pre-adverse action (before denying or rescinding an offer)

Adverse action (if you proceed to deny/hire rescind/change terms)

• Send a final adverse-action notice that includes:
  • A statement of the adverse decision (e.g., withdrawal of offer)
  • The name, address, and telephone of the CRA that provided the report
  • A statement that the CRA did not make the adverse decision and cannot explain why the decision was made
  • A notice of the candidate’s right to dispute the accuracy or completeness of the report with the CRA and to obtain a free report from the CRA within 60 days
• Keep copies of the pre-adverse and adverse notices in the candidate’s file.

Post-hire and ongoing obligations

• If you later rely on a consumer report to change employment status or take adverse action, repeat the pre-adverse/adverse steps.
• Maintain consistent treatment of similar roles and follow your documented policy for updates or rescreens.

Recordkeeping and data security

• Retain copies of disclosures, authorizations, consumer reports, dispute documents, and adverse-action notices according to your records-retention policy and any applicable law. Retention practices vary by state—coordinate with legal or compliance.
• Securely store reports and limit who can view them. Destroy or redact reports when no longer required.
• Train hiring staff on FCRA steps and data handling.

Common FCRA mistakes hiring managers make (and how to avoid them)

• Embedding the disclosure in another document: The FCRA requires a standalone disclosure. Fix: create a separate disclosure form or a clearly labeled electronic screen that must be acknowledged before proceeding.
• Skipping the pre-adverse step: Sending only a final denial is a frequent trigger for litigation. Fix: always provide the report and a copy of the summary of rights before taking adverse action.
• Inconsistent application: Applying checks only to some candidates or different standards for similar roles increases disparate-impact risk. Fix: adopt and enforce a written screening policy.
• Ignoring state/local rules: FCRA compliance plus ignorance of local bans can still create exposure. Fix: maintain a state-by-state checklist for hiring restrictions.
• Mishandling investigative consumer reports: These require extra notice. Fix: disclose and obtain authorization specifically for investigative reports.

Quick example of a clear disclosure (use your legal review)

Print-ready checklist (compact version)

• Pre-check
  • Confirm permissible purpose and job relevance
  • Check state/local restrictions
  • Select certified CRA
• Before ordering
  • Provide standalone disclosure
  • Obtain written authorization (signature or compliant e-sign)
  • Note if requesting an investigative consumer report
• When report arrives
  • Verify candidate identity and relevance
  • Limit access to authorized staff
  • Document review and any follow-up steps
• If adverse action is possible
  • Send pre-adverse package: copy of report + summary of rights
  • Allow reasonable response time (document the timeframe)
  • If no timely dispute or issue unresolved, send final adverse-action notice with CRA contact info
• After action
  • Retain copies of disclosure, authorization, report, and notices per records policy
  • Securely store or destroy report according to retention rules
  • Update hiring decision notes and policy audit trail

Practical takeaways for HR leaders and hiring managers

• Build the checklist into your ATS: Automate the disclosure/authorization step so no check goes forward without it.
• Train every user: Recruiters and hiring managers should know when and how to execute pre-adverse and adverse steps.
• Centralize vendor controls: Use a CRA that provides compliant documentation, summary-of-rights forms, and secure report delivery.
• Make job-related criteria explicit: Document what findings will disqualify a candidate for each role and apply them consistently.
• Review and update for state/local law quarterly: Employment screening rules change. Assign someone to monitor and update screening policies.
• Keep an audit trail: Record dates when disclosures, authorizations, report receipt, and notices were sent.

Conclusion: The FCRA checklist every hiring manager should print and tape to their desk