FCRA Checklist for Hiring Managers to Keep at Their Desk

FCRA at a glance: what matters for hiring managers

The Fair Credit Reporting Act (FCRA) regulates consumer reports when they are used for employment decisions. When you order a background check, you become responsible for how that information is collected, disclosed, used, and stored.

• Consumer report scope: includes criminal records, credit reports, employment/verifications, and other third-party data used to evaluate a candidate.
• Mandatory disclosures & consent: you must have a permissible purpose and provide a written, standalone disclosure plus written authorization before ordering a report.
• Adverse action steps: specific pre-adverse and adverse action procedures apply if a negative decision follows.
• State/local overlay: state and local laws can add restrictions (ban-the-box, credit-check limits, timing rules). FCRA compliance is necessary but not always sufficient.

The FCRA checklist every hiring manager should print and tape to their desk

Follow these steps in order. Treat them like a workflow—skip none.

1. Confirm permissible purpose and job relevance

Ensure the screening is for employment purposes. Confirm the position legitimately requires the type of report being requested (for example, driving records for driving roles). Document job-relatedness for criminal history or credit checks where state law or EEOC guidance may require it.

2. Use a standalone written disclosure

Provide a clear, standalone disclosure that a consumer report may be obtained for employment purposes. Don’t bury it inside an application or combine it with other consents.

3. Obtain written authorization

Get the candidate’s written authorization (electronic authorization is acceptable) before ordering the report. Keep proof of consent on file.

4. Choose a reliable consumer reporting agency (CRA)

Use a CRA that follows FCRA procedures, maintains data accuracy, and provides the required Summary of Rights. Confirm their turnaround, dispute handling, and data sources.

5. Certify to the CRA

When placing an order, certify to the CRA that you have a permissible purpose, obtained authorization, and will comply with adverse action requirements.

6. Review the report for accuracy and relevance

Assign a trained reviewer (not an untrained hiring manager) to interpret results. Verify identity mismatches and obvious reporting errors before acting.

7. Follow pre-adverse action procedures if information may lead to a negative decision

• Share a copy of the consumer report and the CRA’s Summary of Rights with the candidate.
• Give a reasonable opportunity to dispute or explain (common practice: 5 business days, but allow local or internal policies to define “reasonable”).

8. Investigate disputes and allow reinvestigation

If the candidate disputes accuracy, notify the CRA and allow time for reinvestigation. Document steps taken.

9. Send a compliant adverse action notice if you move forward negatively

The adverse action notice must include:

• Name, address, and phone number of the CRA
• Statement that the CRA did not make the adverse decision and cannot provide reasons
• A notice of the candidate’s FCRA rights
• When applicable, specific information about the report items that led to the decision

Keep copies of all pre-adverse and adverse notices.

10. Protect and retain records securely

Keep authorizations, disclosures, reports, and decision documentation for the period required by law or policy. Implement secure storage, access controls, and a destruction schedule for unnecessary records.

11. Check state and local rules before ordering

Confirm ban-the-box timing, criminal history restrictions, credit-check prohibitions, and any statutory forms or notices required by state/local laws.

12. Apply consistent policies and conduct individualized assessments

Adopt and enforce a written policy for background checks. For adverse decisions based on criminal records, use an individualized assessment considering the nature, severity, and time elapsed since the offense, and any rehabilitation evidence.

13. Train your hiring teams and audit routinely

Provide regular training on FCRA steps, permitted uses, and adverse action processes. Audit your process quarterly or after major incidents.

What to include in pre-adverse and adverse notices

Pre-adverse (before final decision)

• A copy of the consumer report
• A copy of the CRA’s Summary of Rights (or a clear written explanation of dispute rights)
• A statement that you may take adverse action after reviewing the report
• An invitation to respond or dispute within a reasonable timeframe

Adverse action (after final decision)

• Name, address, and phone number of the CRA that supplied the report
• Statement that the CRA did not make the adverse decision
• Statement of the candidate’s FCRA rights
• Specific items from the report that factored into the decision (where possible)

Common FCRA pitfalls to avoid

• Combining disclosure and authorization with other application text (not standalone)
• Ordering credit reports without separate disclosure where required by state law
• Failing to send the report copy and Summary of Rights before taking adverse action
• Using arrest records without an individualized assessment or ignoring expungements
• Inconsistent use of background checks across similar roles leading to disparate impact claims
• Not tracking and responding to candidate disputes within the CRA’s reinvestigation timelines
• Retaining reports longer than necessary or failing to secure access to sensitive data

Practical takeaways for employers

• Create standardized, FCRA-compliant disclosure and authorization templates and host them in your applicant tracking system so they’re always used correctly.
• Build the pre-adverse/adverse action workflow into HR systems with automatic copies of the report and Summary of Rights attached.
• Maintain a central log (audit trail) of all background checks: who ordered, what was ordered, copies of notices, and decision rationale.
• Train recruiters and hiring managers on what constitutes job-related information and how to perform individualized assessments for criminal history.
• Run quarterly compliance reviews and spot-checks of your screening vendor’s processes and certifications.
• Consult legal counsel for complex situations or where state/local laws impose additional notice or timing requirements.

Why consistent process matters

Background checks are not just a legal checkbox—they are part of your risk management and candidate experience. A predictable, compliant process protects your organization from legal exposure, speeds up hiring by reducing rework, and shows candidates you treat personal data responsibly. Consistency also reduces bias: when every candidate for a similar role is screened the same way, you lower the chance of disparate-impact claims.

The FCRA Checklist Every Hiring Manager Should Print and Tape to Their Desk — printable version

(Condensed for printing)

• Confirm permissible purpose and job relevance
• Provide standalone disclosure; obtain written authorization
• Use an FCRA-compliant CRA; certify when ordering
• Review report for accuracy; verify identity
• Send pre-adverse: report + Summary of Rights; allow response time
• Investigate disputes; document reinvestigation
• If adverse: send adverse action notice with CRA info and rights
• Check state/local requirements before ordering
• Keep records secure; follow retention/destruction policy
• Apply consistent policies; perform individualized assessments
• Train staff; audit processes regularly

Closing thought

“The FCRA Checklist Every Hiring Manager Should Print and Tape to Their Desk isn’t a legal substitute, but it is a practical guardrail: follow it consistently and you’ll reduce legal risk, improve hiring speed, and treat candidates fairly.”

If you need help translating this checklist into compliant disclosure templates, ATS workflows, or vendor certifications, Rapid Hire Solutions can review your screening program and help implement FCRA-aligned processes that fit your business and local requirements.