FCRA Checklist Hiring Managers Should Tape to Their Desk

The FCRA Checklist Every Hiring Manager Should Print and Tape to Their Desk

Estimated reading time: 5 minutes

• Follow the FCRA sequence: standalone disclosure + authorization, then pre-adverse, then adverse action.
• Make screening job-specific and state-aware: only request reports relevant to the position and respect local restrictions.
• Document everything: preserve disclosures, reports, notices, reviewer notes, and vendor attestations for audits and defense.

• Before you order a consumer report: the pre-checklist
• When you receive a consumer report: how to review it
• Pre-adverse and adverse action: follow this exact sequence
• State rules, EEOC risk, and job-related analysis
• Recordkeeping and audits: keep a clean trail
• Common mistakes that create risk (and how to avoid them)
• The quick, printable FCRA checklist to tape to your desk
• Practical takeaways for hiring managers
• Conclusion
• FAQ

Before you order a consumer report: the pre-checklist

Do these things before you request any consumer background report.

• Confirm permissible purpose. Only obtain a consumer report when you have a permissible purpose under the FCRA (employment screening is one). Make sure the report type (criminal, credit, motor-vehicle) is appropriate for the job.
• Provide a standalone disclosure and obtain written authorization. Give the applicant a clear, written disclosure that you may obtain a consumer report for employment purposes, separate from the job application, and get their signed authorization. Do not bury this inside another form.
• Use consistent policy and documented job-related criteria. Have a written background-screening policy that explains which checks are run for which roles and how results will be considered.
• Screen for state and local rules. Check whether the jurisdiction restricts credit checks, prohibits asking about convictions on applications (ban-the-box), or limits lookback periods.
• Gather accurate identity data. Request full legal name, date of birth, and Social Security number (or last four) to reduce mismatches and false positives.
• Decide whether a consumer report is necessary. Use the least intrusive report that meets the hiring need (for example, consider driving records only for driving roles).
• Confirm vendor compliance. Work only with consumer reporting agencies (CRAs) and screening partners that understand FCRA rules and state-specific restrictions.
• Train hiring staff. Anyone involved in ordering, reviewing, or acting on reports should know the FCRA workflow and the pre-adverse/adverse action sequence.

When you receive a consumer report: how to review it

Treat every report as a legal document. Follow a consistent review process.

• Check identity and match issues first. Confirm the report applies to the candidate by comparing identifiers (name variations, DOB, SSN trace). If identity mismatch is likely, pause and clarify before acting.
• Evaluate relevance to the position. Focus only on convictions or records that are job-related and consistent with your policy.
• Distinguish arrest records vs. convictions. Many jurisdictions treat arrests differently than convictions; convictions are generally more relevant, but follow state rules.
• Look for sealed or expunged records. If a record appears that might be sealed or expunged, verify applicable state law before relying on it.
• Document factual findings. Note what in the report you relied on, who reviewed it, and whether you sought clarification.
• Consider an individualized assessment for adverse findings. For disqualifying criminal history, consider factors such as nature of offense, time elapsed, and job duties—consistent with EEOC guidance.
• If you have reason to doubt the accuracy, initiate a reinvestigation through the CRA rather than taking immediate adverse action.

Pre-adverse and adverse action: follow this exact sequence

The FCRA requires a specific two-step sequence before you deny employment based on a consumer report.

1. Pre-adverse action (give the candidate a chance to respond)

• Provide the candidate a copy of the consumer report you relied upon and a copy of the CRA’s “A Summary of Your Rights Under the FCRA.”
• Allow a reasonable period for the candidate to review and dispute inaccuracies. Many employers allow at least five business days, though you can choose a different reasonable timeframe if your policy explains it.
• If the candidate disputes information, trigger a CRA reinvestigation—do not use the disputed data while under reinvestigation.

2. Adverse action (final notice if you proceed)

• After you decide to take adverse action, send a written adverse action notice that includes:
  • A statement that adverse action was taken based in whole or part on the consumer report.
  • The name, address, and phone number of the CRA that supplied the report.
  • A statement that the CRA did not make the adverse decision and cannot provide the specific reasons.
  • A statement of the individual’s right to dispute the accuracy or completeness of the report.
  • A statement that the individual can obtain a free copy of the report from the CRA within 60 days.
• Retain proof that the pre-adverse and adverse notices were delivered.

Follow this sequence every time a consumer report influences a hiring decision—whether for applicants, contractors, or current employees.

State rules, EEOC risk, and job-related analysis

FCRA compliance is necessary but not sufficient. Layer in the following practices to reduce legal and regulatory risk.

• Map state and local restrictions. Some states ban credit checks for hiring, limit use of arrest records, or require notice/consent for certain searches. Use a jurisdictional grid tied to your hiring locations.
• Avoid blanket exclusions. Per EEOC guidance, blanket policies that automatically disqualify applicants with certain convictions are vulnerable to disparate impact claims. Use individualized assessments tied to job duties.
• Keep decisions consistent. Apply the same policy and thresholds across similarly situated candidates to reduce discrimination risk.
• Document job-relatedness. For roles where credit reports or criminal histories are used, document why this information is relevant to the job’s duties and responsibilities.
• Consider timing. Many jurisdictions limit how far back you can look for convictions or require you to focus on recent history only.

Recordkeeping and audits: keep a clean trail

Good documentation is your best defense in a dispute.

• Keep copies of the standalone disclosure and signed authorization.
• Archive the consumer report you relied upon and the CRA’s summary of rights you provided.
• Save pre-adverse and adverse action communications and delivery confirmations.
• Log reviewer notes, individualized assessment factors, and final hiring decisions.
• Maintain vendor certifications and compliance attestations from your CRA.
• Establish a retention schedule. Retain records long enough to meet federal, state, and internal audit needs—many employers keep records for at least two to five years, depending on local rules.
• Conduct periodic audits. Review a sample of background checks to ensure policy adherence and identify training gaps.

Common mistakes that create risk (and how to avoid them)

Avoid these frequent errors.

• Mistake: Using a disclosure that is buried inside an employment application. Fix: Use a standalone, clear disclosure and separate signature.
• Mistake: Taking adverse action without providing the report and summary of rights first. Fix: Always follow the pre-adverse/adverse sequence.
• Mistake: Ignoring state restrictions. Fix: Build screening rules that vary by jurisdiction and integrate them with your applicant tracking system.
• Mistake: Making a hiring decision before resolving identity mismatches. Fix: Pause and verify identity to avoid wrongful denials.
• Mistake: Failing to document individualized assessments. Fix: Use a template to capture factors considered and rationale for final decisions.

The quick, printable FCRA checklist to tape to your desk

Print this list and keep it visible during every screening decision to avoid costly missteps.

• [ ] Confirm permissible purpose for the report
• [ ] Provide standalone disclosure; get signed authorization
• [ ] Check state/local screening restrictions
• [ ] Confirm candidate identifiers (name, DOB, SSN)
• [ ] Order only job-relevant report types
• [ ] Review report for identity match and relevance
• [ ] If negative, give copy of report + summary of rights (pre-adverse)
• [ ] Allow reasonable response time (commonly 5 business days)
• [ ] If still adverse, send full adverse action notice with CRA details
• [ ] Save disclosures, reports, notices, and reviewer notes in file
• [ ] Run periodic audits and staff training

Practical takeaways for hiring managers

• FCRA compliance is procedural: if you follow the disclosure/authorization, pre-adverse, and adverse action process, you substantially reduce legal risk.
• Make screening job-specific. Only request data that is directly relevant to the role, and document why it matters.
• Integrate state rules into your screening workflow so one-size-fits-all policies don’t create violations.
• Train hiring managers and recruiters on the FCRA checklist—you should be able to demonstrate consistent process across candidates.
• Rely on reputable CRAs and partners who understand FCRA and state nuances; build documentation of their compliance practices.

Conclusion

The FCRA checklist every hiring manager should print and tape to their desk is a short set of actions that protect candidates and employers alike: standalone disclosure and consent, careful report review, a clear pre-adverse/adverse action sequence, state-aware decision-making, and strong recordkeeping. Following these steps makes your hiring faster, fairer, and far less risky.

If you’d like a ready-to-print checklist, policy template, or a review of your current screening workflow, Rapid Hire Solutions helps HR teams build compliant, defensible background-screening programs tailored to state rules and business needs.

FAQ