HR-3 Background Checks

What is this control about?

The HR-3 Background Checks control is about demonstrating that your organization evaluates potential new employees as part of the hiring process. A background check is a process to verify that an individual is who they claim to be. For companies, it is important to ensure that any employees with access to confidential data be ethical and free of prior incriminating situations.

Background checks do not require the purchase of a tool It is a best practice, but not mandatory. What is required is the evaluation of the new hire’s integrity and morals.

This can be done in other ways such as “Reference checks”.  The point is, for any new hire, you’ve conducted some research into the individual’s past and have reached a positive inclusion about their personality.

The research and conclusion have to be documented and maintained as records.

Available tools in the marketplace

The following listing is “crowdsourced” from our customer base or from external research. TrustCloud does not personally recommend any of the tools below, because we haven’t personally used them.

Available templates

TrustCloud has a curated list of templates internally or externally sourced to help you get started. Click on the link for a downloadable version:

• N/A for this section

Control implementation

The action required here is to implement a background check tool to conduct the review and ensure the following components are taken into account:

• Ensure there is a process to conduct the background check during the hiring stage; before the new hire start date
• Retain documentation of the background check during the duration of the employment and according to the retention policy or applicable regulatory requirements (at least 6 -7 years)

If you choose to go the reference check route instead, ensure the following components are taken into account:

• Document in your HR procedure the “what” details and the “how” details to perform a reference check (i.e calling past employers, social media search, etc..)
• For each new hire, ensure you maintain a checklist or documentation of the reference check that was performed. Include any notes and comments as necessary
• Retain documentation of the background check during the duration of the employment and according to the retention policy or applicable regulatory requirements (at least 6 -7 years)

What evidence do auditors look for?

Most auditors, at a minimum are looking for the below suggested action:

Provide a background check tool report that shows the:

• full name of the new hire
• date completed of the report.

Provide a reference check document that shows the:

• New hire name
• Analysis conducted
• Date of analysis
• Analysis documentation and results

Evidence example

From the suggested action above, an example is provided below:

1. Provide a background check tool report.

Screenshot shows a full report that has been scrubbed down. The importance here is showing the subject’s name and date completion.

Google search

2. Provide a reference check document.

Screenshot of the reference check that contains key details on the level of the reference checks done

Google search