FCRA Checklist Every Hiring Manager Should Use

Why the FCRA matters for hiring decisions

The Fair Credit Reporting Act (FCRA) governs how employers may obtain and use consumer reports — including criminal histories, credit checks, driving records, and more — for employment purposes. Compliance is more than a legal checkbox:

• Protects candidate privacy and data accuracy that influence hiring outcomes.
• Reduces exposure to statutory damages and class-action risk when procedures are followed.
• Supports fair, defensible hiring decisions when background information is relevant to the role.

Federal requirements focus on transparency and opportunity: disclose when you will obtain a consumer report, get the applicant’s written authorization, give the candidate a chance to review and dispute report content before making a negative employment decision, and provide specific notices if you ultimately take adverse action based on a report.

The FCRA Checklist Every Hiring Manager Should Print and Tape to Their Desk

Follow this checklist every time you obtain a consumer report. Keep a printed copy in your hiring area and make the steps part of your ATS workflow.

1. 1. Confirm job-related policy and permissible purpose

   Verify the role requires the specific type of check (criminal record, driving record, credit report, etc.). Document the job-related business reason. Confirm permissible purpose under the FCRA: employment screening is a recognized permissible purpose when you comply with disclosure, consent, and adverse action rules.

2. 2. Check federal, state, and local restrictions

   Confirm any state or municipal limits (ban-the-box rules, credit check prohibitions, timing restrictions, sealed/expunged record rules). If the position is remote or the candidate lives in a different jurisdiction, apply the stricter of the two laws.

3. 3. Use a standalone, conspicuous disclosure and get written authorization

   Provide a clear, standalone disclosure that a consumer report may be obtained for employment purposes. Don’t bury it in an application or combine it with other authorizations. Obtain the candidate’s written authorization (electronic signatures are acceptable). Keep a copy in your file.

4. 4. Verify the consumer reporting agency (CRA)

   Use an FCRA-compliant CRA and confirm their dispute and data accuracy processes. Require the CRA to certify they will follow FCRA procedures. Document the CRA name, address, and phone number in your file for any later adverse action notices.

5. 5. Limit scope to what’s job-related

   Order only the components you need. Avoid blanket requests for every available record unless each is justified by the job.

6. 6. Verify candidate identity before relying on results

   Confirm you have accurate candidate identifiers (full name, date of birth, SSN where lawful) to reduce mismatches and false positives.

7. 7. Review the report with context and consistency

   Assign a trained reviewer to examine results. Consider nature of the finding, time elapsed, and relation to job duties. Apply the same standards across similarly situated candidates to reduce disparate impact risk.

8. 8. If a report may lead to an adverse decision, send pre-adverse action materials

   Provide the candidate a copy of the consumer report and a copy of “A Summary of Your Rights Under the FCRA” (federal guidance requires this). Allow a reasonable time for the candidate to dispute or explain the report. Best practice: wait at least five business days; document the date the materials were sent.

9. 9. Make and document the hiring decision

   If after review you proceed, document why the report did not alter the offer. If you will deny employment or take another adverse action, prepare a final adverse action notice.

10. 10. Send a compliant adverse action notice if applicable

    Include: the name, address, and phone number of the CRA; a statement that the CRA did not make the adverse decision and cannot provide reasons; notice of the candidate’s right to dispute the accuracy/completeness of the report; and the consumer’s right to obtain a free report within 60 days (per federal guidance). Keep a copy of the notice and proof of delivery.

11. 11. Maintain secure records and retention logs

    Securely store disclosures, authorizations, reports, pre-adverse/adverse notices, and decision documentation. Limit access to information on a need-to-know basis. Ensure your retention period satisfies both FCRA and state/local records requirements.

12. 12. Train hiring managers and audit processes

    Provide regular training on FCRA rules, state exceptions, and consistent application standards. Conduct periodic audits of files and vendor compliance.

Pre-adverse and adverse action: what to do and how to document

Pre-adverse action — give the candidate a chance to respond

• Send the candidate the report and the FCRA summary promptly once you identify an issue that may affect their eligibility.
• Include contact details for the CRA used and clear instructions for disputing inaccuracies.
• Document the date and method of delivery and any candidate response.

Final adverse action — specific information required

Use a plain-language notice stating the employment decision and the required FCRA disclosures:

• CRA name, address, and phone number.
• Statement that the CRA did not make the hiring decision.
• Notice of the right to dispute the report and obtain a free copy within 60 days.

Keep a copy of the notice and proof it was sent.

Quote: “Document the date the materials were sent and the candidate’s response — that documentation is often decisive in defending an employer’s process.”

Common pitfalls and how to avoid them

• Burying the disclosure inside another document: Use standalone disclosures. Electronic forms should clearly separate consent for background checks from other acknowledgements.
• Skipping state/local checks: Local laws add restrictions — verify before ordering.
• Failing to use a vetted CRA: Choose vendors that certify FCRA compliance and have dispute-handling processes.
• Ignoring documentation: No proof of disclosure, consent, or delivery of notices is a common liability driver.
• Inconsistent standards: Apply job-related criteria consistently to reduce disparate impact allegations.
• Not training hiring teams: Non-HR users often mishandle reports; restrict access and train reviewers.

Practical takeaways for HR teams

• Build the checklist into your ATS and hiring workflow so disclosures, authorizations, and notices are automated and logged.
• Use standardized, legally reviewed templates for disclosures, pre-adverse, and adverse notices to ensure consistency.
• Require CRA certification during vendor selection and request regular compliance reports.
• Maintain a simple decision log for each candidate: role, date report received, reviewer, issues identified, pre-adverse notice date, final decision, and adverse action notice date if applicable.
• Train managers to ask clarifying questions rather than making immediate adverse conclusions based solely on a report entry.
• Periodically review your process against state and local law changes and EEOC guidance on criminal-history considerations.

Sample minimal print-and-post reminder (one line per item)

• Standalone disclosure + signed consent?
• Job-related reason documented?
• CRA name & cert on file?
• Pre-adverse materials sent (report + FCRA summary)?
• Waited reasonable time, documented response?
• Final adverse notice includes required CRA info?
• File secured, retention logged, audit ready?

Keep that strip at your desk to force compliance discipline when making quick hiring calls.

Note: The FCRA Checklist Every Hiring Manager Should Print and Tape to Their Desk is a practical compliance tool — not a substitute for legal advice — and should be incorporated into your hiring policies. If you’d like help translating this checklist into templates, workflow automation, or a compliance audit, Rapid Hire Solutions can provide FCRA-compliant screening services, sample disclosure and adverse-action forms, and vendor-vetting support to make implementation straightforward.

FAQ