A background check policy is the document that tells everyone involved in hiring, human resources, the hiring manager, the person who pulls the report, and the applicant, exactly what gets checked, when, and why. Employers that screen without a written policy tend to run into the same problem: different managers apply different rules to different candidates, and that inconsistency is what turns a routine denial into a discrimination complaint or a Fair Credit Reporting Act claim. A clear policy does not eliminate legal risk, but it gives an employer a documented, defensible process to point to when a decision is questioned.
This guide walks through the sections a compliant policy generally needs: purpose and scope, consistency by role, the FCRA procedural steps, individualized assessment of criminal history, ban the box timing, record retention, and how drug testing fits alongside the background check. It closes with a sample section table and a short FAQ.
Why a written policy matters
Background screening sits at the intersection of several bodies of law: the FCRA governs how an employer orders and uses a report from a background check company, while federal antidiscrimination law addresses how criminal history and other factors are weighed once the report comes back. State and local law adds further rules on timing, disclosure format, and what can be considered at all. A written policy is the tool that keeps all of that consistent across every requisition, every hiring manager, and every candidate, rather than being reinvented ad hoc each time someone gets hired.
Without a policy, employers commonly end up with problems such as a manager rejecting one candidate over an old conviction while overlooking a similar record for another, or a report being pulled before the required authorization is signed. Both are the kind of inconsistency that regulators and plaintiffs’ counsel look for first.
Purpose and scope
The opening section should state plainly why the organization screens and who the policy applies to. That typically means:
- Which positions are screened (all new hires, only certain roles, promotions or transfers into higher trust positions, contractors and temporary staff)
- What categories of screening apply to each role (identity verification, criminal history, employment and education verification, motor vehicle records, credit checks, or drug testing)
- Who owns the process internally (HR, a designated screening coordinator) and who is authorized to review results
- That the policy applies uniformly, so the same category of role receives the same category of screening regardless of the individual manager
Scoping the policy by role also does compliance work on its own. A credit check, for example, is generally defensible for a position with financial or fiduciary responsibility but is harder to justify for a role with no access to funds or financial systems. Tying each screening component to a job-related reason, and writing that reason into the policy, is one of the simplest ways to reduce disparate impact exposure later.
Consistency by role, not by individual
The policy should define standard screening packages by job category rather than leaving the decision to each requisition. If two candidates are being considered for the same warehouse position, they should go through the same screening components in the same order, evaluated against the same written criteria. Any exception (a different package for a role added after the policy was written, for instance) should be documented and tied to a job-related reason, not left informal.
The FCRA steps the policy has to reflect
When an employer uses a third party consumer reporting agency to run a background check, the Fair Credit Reporting Act requires a specific sequence. The Federal Trade Commission’s guidance for employers lays out the core duties: a clear and standalone written disclosure to the applicant that a report will be obtained, separate from the job application; the applicant’s written authorization; and, if the employer decides not to hire (or takes another adverse action) based on the report, a pre-adverse action notice with a copy of the report and a copy of the Summary of Consumer Rights, followed by a final adverse action notice after a reasonable waiting period.
The policy should spell out each of these steps in order, name who is responsible for sending each notice, and reference the applicable section of the FCRA (15 U.S.C. 1681b covers permissible purposes for obtaining a report). It should not claim that following these steps guarantees compliance in every state, since some states and cities layer additional notice or timing requirements on top of the federal baseline.
Individualized assessment of criminal history
Where a criminal record shows up in a report, the policy should require an individualized assessment rather than an automatic disqualification rule. The Equal Employment Opportunity Commission’s enforcement guidance on arrest and conviction records explains that a blanket policy excluding anyone with any criminal record can have a disparate impact on groups protected under Title VII, and recommends that employers instead weigh factors such as the nature and gravity of the offense, the amount of time that has passed, and the nature of the job held or sought.
A policy section on this should require the reviewer to document that assessment for any conviction based decision, not just note “disqualified.” It should also make clear that employers may be able to consider certain records as relevant to specific positions, but that state law varies on what can be considered at all, and that questions about a specific record should go to counsel rather than being resolved informally by a hiring manager.
Ban the box and timing of inquiries
A growing number of states and localities restrict when an employer can ask about criminal history, commonly requiring that the question be deferred until after a conditional offer or an interview. The policy should state, by category of jurisdiction where the employer operates, when criminal history questions and record pulls are permitted in the hiring sequence, and should default to the more protective timing where multiple rules could apply. Because these rules differ significantly by state and city and change over time, the policy should point to counsel or a maintained internal reference for the current list of covered jurisdictions rather than trying to hardcode every rule into the document itself.
Record retention
The policy needs a retention section covering how long background check records, applications, and related hiring documentation are kept, and how they are stored and disposed of. Recordkeeping obligations under EEOC regulations require that personnel and employment records be retained for a set period after they are made or after a personnel action is taken, and longer if a charge or lawsuit is filed. The policy should also address secure disposal of consumer report information, since the FCRA’s disposal rule requires reasonable measures to protect against unauthorized access when those records are discarded.
Coordinating background checks with drug testing
Many employers run drug testing alongside, but separately from, the background check. The policy should clarify that these are two distinct processes with different consent forms, different vendors in most cases, and different review criteria, so that a drug test result and a background check result are not evaluated together as though they were one report. It should also route interpretation of a non-negative drug test result through the medical review officer process rather than letting a hiring manager make that call directly, and should note that any prescription related to a positive result is a matter for the MRO, not for HR to adjudicate.
Sample policy sections
| Policy section | What it covers | Key compliance point |
|---|---|---|
| Purpose and scope | Why the company screens, which roles and worker types are covered | Screening components should be tied to a job-related reason |
| Disclosure and authorization | Standalone written disclosure and signed authorization before ordering a report | Disclosure must be a separate document, not buried in the application |
| Screening by role | Standard package per job category (criminal history, employment, education, MVR, credit) | Applied consistently across candidates for the same role |
| Individualized assessment | How criminal history results are reviewed and documented | No automatic exclusion; document the factors considered |
| Adverse action process | Pre-adverse notice, waiting period, final adverse notice | Include a copy of the report and the Summary of Rights |
| Timing of inquiries | When criminal history questions may be asked relative to an offer | Defer to the more protective jurisdiction where rules overlap |
| Record retention and disposal | How long records are kept and how they are securely destroyed | Retention periods and disposal rules are set by regulation, not company preference |
| Drug testing coordination | Relationship between the background check and any drug screen | Kept as a separate process with its own consent and MRO review |
Frequently asked questions
Does every employer need a written background check policy?
There is no single federal rule mandating a written policy for every employer, but a documented process is one of the strongest tools for showing consistent, job-related decisions if a hiring decision is ever challenged. Employers should consult counsel to confirm what applies to their size, industry, and states of operation.
Can a policy automatically disqualify anyone with a criminal record?
A blanket exclusion policy can create disparate impact risk under Title VII. The EEOC’s guidance recommends an individualized assessment that looks at the nature of the offense, how much time has passed, and the job in question, rather than a flat rule.
What has to happen before an employer can pull a background check?
Under the FCRA, the employer generally needs to provide a clear, standalone disclosure that a report will be obtained and get the applicant’s written authorization first. State law may add further requirements.
How long should background check records be kept?
Retention periods are set by regulation and can vary depending on whether a charge or lawsuit is pending. Employers should check current EEOC recordkeeping rules and consult counsel rather than picking a retention period informally.
Should the background check and drug test be reviewed together?
They are typically kept as separate processes with separate consent and separate review paths. A non-negative drug test result should go through the medical review officer process rather than being folded into the same review as the criminal history report.
Does a background check policy guarantee legal compliance?
No policy can guarantee compliance on its own. Laws vary by state and change over time, so a policy should be reviewed periodically with counsel rather than treated as a one time document.
Building the policy alongside counsel
None of the sections above are meant to be filled in from a template without review. Ban the box timing, individualized assessment standards, and record retention rules all vary by jurisdiction and are updated by legislatures and agencies on an ongoing basis. Employers building or updating a policy should treat this guide as a checklist of sections to cover, then have counsel confirm the specific language and timing rules that apply in each state and locality where they hire. Related reading: our guides on ban the box and fair chance hiring laws and how long to keep background check records go deeper on two of the sections above. For background screening support, visit Reveal Background.
Sources: EEOC Enforcement Guidance on Arrest and Conviction Records, FTC, Using Consumer Reports: What Employers Need to Know, 29 CFR Part 1602, EEOC recordkeeping requirements, and 15 U.S.C. 1681b, permissible purposes of consumer reports.
This article is general information, not legal advice. Employers should consult qualified counsel before adopting or updating a background check policy.
