=
The FCRA Checklist Every Hiring Manager Should Print and Tape to Their Desk
Estimated reading time: 6 minutes
Key takeaways
- Always obtain a stand-alone disclosure and written authorization before ordering consumer reports unless a state exception applies.
- Use pre-adverse and adverse-action steps to give candidates a chance to review and dispute report information.
- Follow state/local restrictions and document everything — permissible purpose, vendor certifications, notices, disputes, and retention.
- Limit report access and secure records to reduce privacy and breach risk.
Why the FCRA matters for hiring decisions
The Fair Credit Reporting Act (FCRA) governs the use of consumer reports — including criminal records, credit reports, tenant records, and driving records — when employers make hiring, promotion, or retention decisions. Noncompliance can lead to litigation, statutory damages, attorney fees, and reputational harm. Beyond legal exposure, errors in consumer reports create real operational risk: wrongful rejection of qualified candidates and missed verification of safety-sensitive qualifications.
Complying with the FCRA also builds trust in your hiring process. Candidates expect clear notice and the ability to challenge inaccuracies. Following the FCRA reduces risk and improves candidate experience.
The FCRA Checklist Every Hiring Manager Should Print and Tape to Their Desk
Keep this concise checklist where you can grab it in the moment. Each step includes what to do, why it matters, and quick timing or template notes.
1. Confirm permissible purpose
Do before ordering a report.
What to do: Ensure the reason for the report is a permissible employment purpose under the FCRA (hiring, promotion, retention, reassignment). Document the permissible purpose in the requisition or hiring file.
Why it matters: A consumer reporting agency (CRA) may not furnish a report without a permissible purpose.
2. Get a stand-alone disclosure and written authorization
Do before obtaining the report.
What to do: Provide a clear, conspicuous, stand-alone disclosure that you will obtain a consumer report, and obtain the candidate’s written authorization.
Why it matters: Combining other notices or embedding the disclosure in an employment application can violate the FCRA.
Sample disclosure language: “[Company] may obtain a consumer report for employment purposes. We will use the information to evaluate your application for employment. By signing below, you authorize [Company] to obtain a consumer report.”
3. Use compliant authorization forms
What to do: Authorization must be clear and can be electronic. If you collect biometric or medical data, get job-related consent and follow ADA guidance.
Timing: Obtain authorization prior to pulling the report. For certain checks (e.g., credit reports), state law may require post-offer only.
4. Verify the consumer reporting agency and certify permissible use
What to do: Order reports from a reputable CRA and provide required certifications to the CRA that you have a permissible purpose and will comply with FCRA obligations.
Why it matters: You share responsibility for compliance when using third-party screening partners. Keep vendor agreements and SOC/ISO documentation on file.
5. Provide a copy of the report and a Summary of Rights before adverse action (pre-adverse)
When required: If information in the report may lead to an adverse employment action.
What to do: Before rejecting or rescinding an offer, provide the candidate a copy of the consumer report and a copy of the FCRA Summary of Rights. Allow reasonable time for review and response.
Why it matters: This gives the candidate an opportunity to dispute inaccuracies before you make a final decision.
6. Follow the adverse action notice requirements
What to do: If you decide to take adverse action based on the report, send a final adverse action notice that includes:
- A statement that adverse action was taken based on the consumer report
- The CRA’s name, address, and phone number
- A statement that the CRA did not make the adverse decision and cannot provide specific reasons
- A notice of the candidate’s right to obtain a free copy of the report within 60 days and to dispute its accuracy
Timing: Send this promptly after making the decision.
7. Maintain dispute-handling and reinvestigation processes
What to do: If a candidate disputes report content, notify the CRA and allow the CRA 30 days to reinvestigate. If results change, reconsider decisions already made and document actions taken.
Why it matters: Failing to investigate disputes can create liability and expose your organization to claims.
8. Protect data and limit use
What to do: Limit report access to individuals with a business need, securely store records, and purge when retention periods end. Follow data-security best practices and any state privacy law requirements.
Why it matters: Sensitive information in reports (SSNs, medical flags) requires strict handling to avoid breaches and privacy violations.
9. Check state and local rules and “ban-the-box” laws
What to do: Review state/local laws for additional requirements: timing of background checks, disclosure language, criminal-history limitations, and credit-report restrictions.
Why it matters: State laws may be more restrictive than the FCRA (e.g., requiring post-offer timing or limiting the use of criminal convictions).
10. Keep records and audit regularly
What to do: Document disclosures, authorizations, pre-adverse materials, adverse notices, and dispute outcomes. Conduct periodic audits of screening procedures and vendor compliance.
Why it matters: Documentation supports defensibility in litigation and helps you spot process gaps.
Quick templates and timing cues
Stand-alone disclosure (one sentence, clear): “We may obtain a consumer report about you for employment purposes. By signing below, you authorize [Company] to obtain such a report.”
Authorization line: “I authorize [Company] to obtain one or more consumer reports about me for employment purposes and understand that information from the reports may be used in employment decisions.”
Pre-adverse packet: Provide the candidate with (1) a copy of the consumer report, (2) the FCRA Summary of Rights, and (3) a clear invitation to respond or dispute within a defined timeframe (e.g., 5 business days).
Adverse action notice checklist: include CRA contact info, statement the CRA didn’t make the decision, notice of right to free report and dispute.
Timing cues:
- Always get written authorization before ordering a report unless a specific state exception applies.
- Provide pre-adverse materials and allow time for candidate response before final adverse action.
- Send adverse action notice immediately after finalizing the decision.
Common FCRA pitfalls to avoid
- Embedding disclosures in long application forms or other documents.
- Forgetting to provide a copy of the report and Summary of Rights before adverse action.
- Using consumer reports for non-permissible purposes (e.g., marketing).
- Not accounting for state/local law restrictions — particularly with credit reports and criminal history ordinances.
- Failing to document certification and permissible purpose when ordering reports through a CRA.
- Not treating disputed information seriously or failing to document reinvestigations.
Practical takeaways for HR teams and hiring managers
– Make the stand-alone disclosure and authorization part of your standard workflow and track acknowledgments.
– Build pre-adverse and adverse notice templates into your ATS or HRIS so notices go out consistently and on time.
– Train hiring managers and interviewers on what to do when background report information appears to create ineligibility so decisions remain consistent and defensible.
– Maintain vendor oversight: review CRAs’ accuracy, reinvestigation processes, and compliance certifications.
– Run periodic internal audits that simulate the entire screening workflow to catch gaps before they become problems.
Desk-sized print-ready checklist
- Confirm permissible purpose recorded
- Provide stand-alone disclosure & get written authorization
- Order report from approved CRA and certify permissible use
- If report may affect hiring: send copy + Summary of Rights (pre-adverse)
- Allow candidate time to respond/dispute
- If adverse: send final adverse action notice with required elements
- Log actions, keep records for retention period, secure data
- Monitor disputes and document reinvestigation outcomes
- Check state/local law when using credit or criminal-history reports
Keep a laminated copy at the desk or an electronic shortcut in your ATS so every recruiter and hiring manager follows the same process.
When to involve legal or compliance
Escalate to legal or your compliance team if you encounter:
- Conflicting state law obligations
- Complex use of criminal-history or credit data in hiring decisions
- Large-volume automated decisioning or predictive analytics that use consumer-report data
- A candidate dispute that reveals significant inaccuracies affecting multiple hires
The FCRA sets baseline federal obligations; state law and sector-specific rules (healthcare, financial services) can add layers. Document the issue and the steps you took to resolve it.
The FCRA checklist every hiring manager should print and tape to their desk is designed to make compliance practical — not just theoretical. It reduces legal exposure, improves candidate experience, and helps your team make fair, defensible hiring decisions.
If you’d like a pre-formatted, printable checklist or compliant disclosure and adverse-action templates tailored to your state and industry, Rapid Hire Solutions can help. We provide FCRA-compliant screening workflows, candidate notices, and vendor oversight tools that integrate with your hiring systems to keep compliance operational and efficient.
FAQ
- Do I always need a stand-alone disclosure before ordering a background check?
- What must be included in a final adverse action notice?
- How long must I wait after sending pre-adverse materials?
- How should I handle candidate disputes?
- What state laws should I watch for?
Answer — Do I always need a stand-alone disclosure before ordering a background check?
Generally, yes: the FCRA requires a clear, conspicuous, stand-alone disclosure and the candidate’s authorization before a CRA furnishes a consumer report for employment purposes. Exceptions may apply per state law (for example, some states limit credit checks to post-offer situations). When in doubt, follow the stricter rule and consult legal.
Answer — What must be included in a final adverse action notice?
A final adverse action notice must include: an explanation that adverse action was taken based on a consumer report; the CRA’s name, address, and phone number; a statement that the CRA did not make the decision and cannot provide specific reasons; and a notice of the candidate’s right to obtain a free copy of the report within 60 days and to dispute its accuracy.
Answer — How long must I wait after sending pre-adverse materials?
The FCRA does not specify an exact number of days; it requires you to provide a reasonable opportunity for the candidate to review and respond. In practice, many employers use 3–7 business days. Document your timeframe and be consistent across similar cases.
Answer — How should I handle candidate disputes?
If a candidate disputes content, notify the CRA promptly and allow the CRA 30 days to reinvestigate. If the CRA updates the report, reconsider any employment decision that relied on the prior information and document the steps taken. Maintain records of dispute submissions, CRA responses, and any follow-up actions.
Answer — What state laws should I watch for?
Watch for state/local rules that may be more restrictive than the FCRA: mandatory post-offer timing for credit checks, local “ban-the-box” ordinances limiting when you can ask about convictions, and additional disclosure or authorization language. Maintain a jurisdictional matrix or vendor control that flags these requirements.