A CPA firm's SOC 2 guide, updated on 14 October 2026, lists what auditors look for under the control environment criteria: an approved code of conduct, leadership oversight of security, defined roles, "background checks, and annual acknowledgments." The same guide says that for population based controls like new hires, the auditor asks for the full list for the period and selects samples from it.
So every new hire in your observation period can end up in front of the auditor. This post is about what evidence to keep for each one, and how to run background checks so the process itself is not a legal problem. It is general information for US employers, not legal advice. State and city rules vary.
What's affected
Four onboarding artifacts get sampled in most programs:
- Background check completed before access to customer data.
- Signed code of conduct or acceptable use policy.
- Security awareness training completed within the window your policy sets.
- Access approved by a manager, with the date.
The first one carries legal obligations. A joint EEOC and FTC publication, "Background Checks: What Employers Need to Know," says it is not illegal to require a background check, but if you use a company that compiles background information, you must follow the Fair Credit Reporting Act (FCRA). The steps it lists:
- Give the applicant or employee a written notice, in a stand-alone format, that you might use the information for employment decisions. It cannot sit inside the job application.
- Get written permission to run the check.
- Certify to the reporting company that you notified, got permission, followed FCRA, and will not discriminate or misuse the information.
- Before an adverse action, give the person a copy of the report you relied on and the FTC's summary of FCRA rights.
- After an adverse action, give the notice the publication describes, including the reporting company's contact details and the person's right to dispute and get an additional free report within 60 days.
The publication also says to apply the same standards to everyone and to take special care with policies that exclude people with certain criminal records.
How to check if you're exposed
Pull your last five hires and look for these:
- A date for the completed check that is earlier than the date access was granted.
- A signed stand-alone disclosure and authorization.
- A signed policy acknowledgment and a training completion date.
- An access ticket with an approver.
- Contractors and part timers: do they get the same checks, or does your policy say they do not?
Any missing item is a likely exception in sampling, or a legal gap.
What to do now
- Write a one page onboarding standard: which roles get which checks, and when relative to access.
- Use a stand-alone disclosure form, separate from the application, and get written authorization.
- Record the outcome as a date and a pass or fail on your roster, and keep the vendor's full report only as long as you need it. The publication says employment records must be kept one year, and that background reports must be disposed of securely once recordkeeping requirements are satisfied.
- Block access provisioning until the check is cleared, using a ticket status or an HR system flag.
- Document the adverse action procedure even if you have never used it, so a manager does not improvise.
- Apply the same policy to employees and contractors, or write down the reason they differ.
- Ask your counsel about state and local rules, including limits on when criminal history can be considered.
How to avoid this trap
- Do not put the FCRA disclosure inside the application.
- Do not grant production access first and run the check afterward.
- Do not store raw reports in a shared drive where engineers can read them.
- Do not run checks only for some roles without a written risk reason.
- Do not skip contractors if they can reach customer data.
Why it matters
A background check that is legal but unrecorded fails the audit. One that is recorded but run improperly can fail a lawsuit. The cheap fix is a form, a roster column and a ticket gate.
Quick check
Can the FCRA disclosure be part of the job application?
No. The EEOC and FTC publication says the notice must be in writing, in a stand-alone format, and cannot be in an employment application.
What do you give the person before taking adverse action based on a report?
A copy of the consumer report you relied on and a copy of the summary of FCRA rights.
