FCRA Checklist Hiring Managers Should Tape to Their Desks

Quick overview: What the FCRA controls in hiring

The Fair Credit Reporting Act (FCRA) governs the use of consumer reports — including criminal background checks, credit reports, motor vehicle records, and certain investigative reports — when used for employment. The statute requires:

• a clear, standalone disclosure and written authorization;
• pre-adverse action steps and final adverse action notices;
• candidate rights to obtain and dispute report information; and
• employer certification to the consumer reporting agency (CRA) and secure handling of candidate data.

The FCRA checklist to print and tape to your desk

• Confirm the report type and permissible purpose
• Provide a standalone written disclosure that a consumer report will be obtained
• Obtain clear, documented written authorization from the applicant
• Verify any state or local limits (timing, scope, ban-the-box rules)
• Order the report from a reputable, FCRA-compliant CRA and obtain their certification
• Review the report for job-related issues and accuracy
• If you intend to take adverse action, issue a pre-adverse action packet:
  • Copy of the consumer report
  • Summary of consumer rights under the FCRA
  • Clear notice that you may take adverse action and a reasonable response window (commonly 5 business days)
• If after the response window you proceed, send a final adverse action notice including:
  • Reason for the adverse action (or a clear statement)
  • CRA name, contact information, and statement that the CRA did not make the decision
  • Notice of the consumer’s right to dispute the report’s accuracy
• Retain disclosure, authorization, reports, and adverse action records in secure files per FCRA and state retention requirements
• Train hiring staff on FCRA steps, consistent application, and privacy safeguards

Step-by-step explanation and practical how-to

Confirm permissible purpose and the report type

Before ordering a report, confirm the screening is supported by a permissible purpose under the FCRA. Employment is a permissible purpose, but treat different report types differently. For example:

• Credit reports: sensitive and restricted in many states; use only when job-related and consistent with business necessity.
• Criminal history: accuracy, jurisdictional limits, and relevance to the role vary; apply nondiscriminatory, job-related criteria.
• Motor vehicle, education, credential verifications: evaluate accuracy and scope before relying on results.

Disclosure and written authorization — get the form right

The FCRA requires a clear, standalone disclosure and a separate written authorization. Do not bury disclosure language inside an application. Practical steps:

• Provide a concise, standalone disclosure document plainly stating a consumer report may be obtained.
• Obtain a separate, dated written authorization — electronic signatures are acceptable if they meet e-signature standards.
• Retain both documents in the candidate file.

Example phrasing (for reference only): “We may obtain a consumer background report about you for employment purposes. By signing below, you authorize us to obtain such a report.”

Check local rules before deciding timing and scope

Many jurisdictions impose “ban-the-box” rules, limit when you can inquire about convictions, or restrict credit report use. Make checking jurisdictional requirements a routine step before ordering.

Choose your CRA carefully and get certification

Work only with CRAs experienced in employment screening that provide the FCRA-required certification. Your certification to the CRA should confirm you have authorization and will comply with adverse action requirements. Maintain records of that certification.

Review reports for accuracy and job-relatedness

When a report returns, verify identity matches, confirm dates and jurisdictions, and assess whether the information is job-related. For criminal records, apply consistent, nondiscriminatory criteria and — where required — perform individualized assessments considering the nature and recency of the offense and the role’s responsibilities.

Pre-adverse action is not optional

If information could lead to denial of employment or other adverse action, provide a pre-adverse action packet that includes:

• A copy of the consumer report used
• A copy of the FCRA consumer disclosure summary (commonly provided by the CRA)
• A clear statement that you may take adverse action based on the report
• A reasonable opportunity for the candidate to review and respond (many employers allow 5 business days)

This step gives the applicant a chance to correct errors or explain context.

Final adverse action notice — what to include

If you proceed with an adverse decision, the final notice must include:

• A statement that an adverse action was taken
• The name, address, and phone number of the CRA that supplied the report
• A statement that the CRA did not make the adverse decision and cannot provide reasons
• Notice of the right to dispute the accuracy of the report and to obtain a free copy within 60 days

Record retention and documentation

Keep copies of the disclosure, authorization, consumer report, pre-adverse and adverse notices, and any job-related decision documentation. Store records securely and follow state-specific retention requirements. Many employers retain records for at least five years as a practical safeguard, but confirm local obligations.

Protect candidate data and limit access

Consumer reports contain sensitive personal data. Limit access to hiring personnel with a legitimate need-to-know, store reports in secure systems, and delete or archive records when they are no longer required.

Common pitfalls to avoid

• Combining the FCRA disclosure with other consent language in the same document
• Skipping pre-adverse notices or failing to provide the report and summary of rights
• Treating all criminal records the same; blanket exclusions can trigger discrimination concerns
• Failing to check state/local laws that alter timing, permissible uses, or required notice language
• Ordering broader searches than necessary (e.g., nationwide searches when local records suffice)
• Not documenting the business justification for job-related background requirements

Practical takeaways for HR teams

• Standardize your process: build FCRA steps into your ATS so disclosures, authorizations, and notices occur automatically and in the right order.
• Use clear templates: keep pre-adverse and adverse action templates approved by legal and updated for state variations.
• Train consistently: ensure everyone who touches hiring understands FCRA steps and objective report evaluation.
• Audit periodically: sample files to verify procedural compliance and consistent application of decision criteria.
• Partner with experts: choose CRAs that actively support FCRA compliance and provide required notices and documentation.

A printable mini-checklist (ready to tape to your desk)

• Confirm screening is job-related and permitted in the candidate’s jurisdiction
• Provide standalone FCRA disclosure
• Obtain signed written authorization
• Order report from compliant CRA and get certification
• Review report for accuracy and job-related impact
• Send pre-adverse packet (report + summary + response window) if necessary
• Wait appropriate period, review any candidate response
• Send final adverse action notice if decision is adverse
• Keep secured records per FCRA/state requirements
• Train staff and document policies

Conclusion

Following a clear, repeatable FCRA checklist protects your organization and treats candidates fairly. Consistency and documentation are your best defenses if disputes arise, and thoughtful application of criminal and credit information reduces legal and reputational risk.

If you’d like help operationalizing this checklist — templates, workflow integration, or vendor assessments — Rapid Hire Solutions works with HR teams to build compliant, efficient screening programs that reduce hiring risk and fit your business needs.