HR-3 Background Checks

What is HR-3 Background Checks Control about?

HR-3 Background Checks Control is about demonstrating that your organization evaluates potential new employees as part of the hiring process. A background check is a process to verify that an individual is who they claim to be. For organizations, it is important to ensure that any employees with access to confidential data are ethical and free of prior incriminating situations.

Background checks do not require the purchase of a tool. Purchasing a tool is a best practice, but it is not mandatory. Evaluation of the new hire’s integrity and morals is an important aspect of this control.

Background checks can be done in other ways, such as “Reference Checks.” For any new hire, you’ve conducted some research into the individual’s past and have reached a positive conclusion about their personality.

The research and conclusion have to be documented and maintained as records.

Available tools in the marketplace

The following listing is “crowdsourced” from our customer base or from external research. TrustCloud does not personally recommend any of the tools below, as we haven’t used them.

Background Check Tools

Checkr – Well known provider in the space.

Goodhire

Hireright

Sanctions

Available templates

TrustCloud has a curated list of templates, internally or externally sourced, to help you get started. Click on the link for a downloadable version.

• N/A for this section

Control implementation

To implement a background check tool, conduct the review and ensure the following components are taken into account:

• Ensure there is a process to conduct the background check during the hiring stage, before the new hire’s start date.
• Retain documentation of the background check during the duration of the employment and according to the retention policy or applicable regulatory requirements (at least 6-7 years).

To implement the reference check method, ensure the following components are taken into account:

• Document in your HR procedure the “what” details and the “how” details to perform a reference check (i.e., calling past employers, doing social media searches, etc.).
• For each new hire, ensure you maintain a checklist or documentation of the reference check that was performed. Include any notes and comments as necessary.
• Retain documentation of the background check during the duration of the employment and according to the retention policy or applicable regulatory requirements (at least 6-7 years).

What evidence do auditors look for?

Most auditors, at a minimum, are looking for the below-suggested action:

1. Provide a background check tool report that shows the following:
   1. full name of the new hire
   2. date of completion of the report.
2. Provide a reference check document that shows the following:
   1. New hire name
   2. Analysis conducted
   3. Date of analysis
   4. Analysis documentation, and results

Evidence example

For the suggested action, an example is provided below:

1. Provide a background check tool report.
   The following screenshot demonstrates a full report that is scrubbed down with the subject’s name and date of completion.
   
   
2. Provide a reference check document.
   The following screenshot demonstrates the reference check, with key details on the level of the reference checks done.