How to Run a Background Check on an Employee: Full Guide

Why the Process Matters More Than the Report

Background checks are close to universal in U.S. hiring. Roughly 92% of organizations conduct background checks, most of them at the pre-employment stage, according to SHRM survey data, and criminal record checks are by far the most common type of screen used. That means most job candidates already expect to be screened — but they also have real legal protections around how that screening happens.

Two separate legal frameworks apply at the same time. The FCRA governs the mechanics of using a third-party background check company: what you must disclose, what consent you need, and what happens if you plan to deny someone a job based on the report. Federal anti-discrimination law, enforced by the EEOC, governs how you can *use* the information you find — it applies regardless of where the information came from, and it prohibits blanket policies that disproportionately screen out people based on race, national origin, or other protected characteristics without a job-related reason.

Step 1: Get Your Legal Obligations Right Before You Search Anything

Before you run a single check, you need two documents in place and signed. Skipping this step, or burying it inside a job application, is one of the most common — and most litigated — FCRA mistakes.

Disclosure and authorization

The FCRA requires a clear, conspicuous, stand-alone written disclosure telling the candidate that you may obtain a consumer report (a background check) for employment purposes. Per FTC guidance, this disclosure cannot be folded into the employment application and should not include liability waivers, references to company policy, or state-specific disclosure language mixed in — it needs to stand on its own. You also need the candidate's written authorization to proceed, which can be part of the same document as the disclosure.

• Use a standalone disclosure form — not a clause buried in the application
• Get a dated, signed authorization before ordering any report
• Do not add liability waivers or unrelated legal language to the disclosure
• Keep signed copies on file for as long as your state's record retention rules require

State and local timing rules ("ban the box")

Beyond the FCRA, most of the country now restricts *when* you can ask about criminal history. As of 2026, 37 states and more than 150 cities and counties have adopted some form of "ban the box" law, according to iprospectcheck's state-by-state tracking. These laws typically remove criminal history questions from the initial application and delay the background check itself until after an interview or a conditional job offer, and several require an individualized assessment before you can deny someone based on a conviction.

Step 2: Choose a Background Check Provider

You are legally allowed to run some checks yourself (verifying a diploma by calling the school, for instance), but the moment you use a third-party company that regularly assembles background information for a fee, that company becomes a consumer reporting agency (CRA) under the FCRA, and specific rules kick in for both of you. Most employers use a CRA for every check simply because it's faster and creates a defensible paper trail.

What to look for in a provider

Turnaround time varies a lot by check type and provider. Industry data from Checkr and GoodHire shows roughly 89% of criminal background checks complete in under an hour when using automated database searches, while traditional providers like HireRight report an average of two to four business days. County-level courthouse searches that require an in-person pull can still take one to three business days regardless of provider, since they depend on how digitized that county's records are.

Step 3: Submit Candidate Information and Order the Check

Once you've collected a signed disclosure and authorization, you'll typically submit the candidate's legal name, date of birth, Social Security number, and current and prior addresses. Accurate identifying information matters more than people expect — a mismatched middle name or an old address can either miss a record entirely or, worse, pull up someone else's criminal history by mistake.

• Confirm the candidate's full legal name matches their government ID
• Ask for at least seven years of address history for a thorough county-level search
• Double-check the Social Security number before submitting — typos are the most common cause of a false or incomplete match
• Choose the check types relevant to the role: criminal history, employment verification, education verification, motor vehicle records for driving roles, and reference checks

Match the depth of the check to the job. A retail cashier role and a role handling client finances or driving a company vehicle carry different risk profiles, and running the same package for every hire either overspends on low-risk roles or under-screens high-risk ones.

Step 4: Interpret the Results

A background check report is not a pass/fail verdict — it's raw information that you have to evaluate against the job. Reports typically include several components, and it helps to know what each one actually tells you.

Common report components

• Identity verification — confirms the candidate is who they claim to be
• County, state, and federal criminal records — searches vary by jurisdiction depth and time; nearly all employer checks include a criminal search, per SHRM
• Sex offender registry search
• Employment and education verification — confirms dates, titles, and degrees claimed on the resume
• Motor vehicle records — relevant only for driving-related roles
• Credit history — used selectively; only about 13% of organizations run credit checks on all candidates, with roughly 47% limiting it to specific roles, per SHRM data

When a criminal record does appear, the EEOC cautions against a blanket policy of automatic disqualification. An arrest alone is not proof of guilt and generally should not be the sole basis for a decision. A conviction can be considered, but the EEOC recommends an individualized assessment — weighing the nature of the offense, how long ago it occurred, and how directly it relates to the job — rather than applying a one-size-fits-all exclusion across every applicant.

Step 5: Handle Adverse Action Correctly (If Needed)

If something in the report leads you to reconsider the candidate, the FCRA requires a specific two-notice sequence before you can finalize that decision — you cannot simply reject someone and move on. Per FTC guidance and confirmed by DISA's employer guide, the process runs in three parts.

The three-step adverse action process

• 1. Pre-adverse action notice — before making a final decision, give the candidate a copy of the background check report itself, along with a copy of the CFPB's "Summary of Your Rights Under the Fair Credit Reporting Act."
• 2. Waiting period — give the candidate a reasonable amount of time to respond or dispute the report before finalizing anything. The FTC recommends at least five business days.
• 3. Final adverse action notice — if you proceed with the decision, send a notice that includes the name, address, and phone number of the background check company; a statement that the company did not make the hiring decision and can't explain the specific reasons for it; and notice of the candidate's right to dispute the report's accuracy and request another free copy within 60 days.

This is also where a provider's automation earns its keep — generating and tracking these notices manually for every candidate is where most missed-deadline compliance problems come from.

Common Mistakes Employers Make

• Burying the disclosure inside the job application instead of using a stand-alone form
• Running the check before getting signed authorization
• Asking about criminal history too early in states or cities with ban-the-box laws
• Applying a blanket "no felons" policy instead of an individualized, job-related assessment
• Skipping the pre-adverse action notice and waiting period, and going straight to a rejection letter
• Using the same screening depth for every role regardless of actual risk or responsibility level

Quick Reference Checklist

• Stand-alone disclosure form signed before ordering any check
• Written authorization on file
• Confirmed local ban-the-box timing rules for the candidate's jurisdiction
• Selected a provider with transparent per-check pricing and FCRA-compliant notice generation
• Verified candidate identity details before submitting
• Matched check depth (criminal, MVR, credit, education) to the actual role
• Applied a pre-written individualized assessment standard to any record found
• Sent pre-adverse action notice + report + Summary of Rights if considering denial
• Waited at least 5 business days before finalizing
• Sent final adverse action notice with CRA contact info and dispute rights