What Is a Background Check? The Complete Guide for Small Business Owners

When I hired my first employee, I did not run a background check. I assumed it was something big companies did. The hire worked out fine. The second hire also worked out fine. The third hire embellished two years of employment history on their resume, and I only discovered it four months later when their former employer came up in a conversation and the timeline did not match. By then I had invested months of training and a significant onboarding effort into someone who had misrepresented their qualifications.

That experience cost me time and money, and it taught me that I had been lucky with my first two hires, not smart. Background checks are not a bureaucratic hurdle for large corporations. They are a basic due diligence step that protects small businesses from negligent hiring liability, resume fraud, and the financial damage of a bad hire, which a small company absorbs far harder than an enterprise does.

This guide covers everything a US small business owner needs to know about background checks: what they are, the 9 types with real costs, how the process works step by step, where it fits in your onboarding workflow, the federal and state laws you must follow, how to handle negative results legally, and the mistakes that create lawsuits.

I built the onboarding workflow in FirstHR to handle the steps surrounding the background check (consent forms, task sequencing, document storage, onboarding automation) because at a small business, the person running the check is the same person doing everything else.

What Is a Background Check?

A background check is a process where an employer, landlord, or other authorized party investigates an individual's past records to verify their identity, criminal history, employment history, educational credentials, and other relevant information. In the employment context, background checks are conducted after a conditional job offer and before the new hire's first day of work.

The term "background check" covers a wide range of screening types. At one end: a simple criminal record search that checks county, state, and federal databases for convictions. At the other end: a comprehensive screening package that includes criminal records, employment verification, education verification, credit check, driving record, drug test, and professional license verification. What you run depends on the role, your industry, and your state's laws.

For small businesses, the most important thing to understand about background checks is that they are not a single product. They are a menu. You choose which items to order based on what the job requires.

A warehouse worker needs a criminal check and maybe a drug test. An accountant needs a criminal check, credit check, and education verification. A delivery driver needs a criminal check and a motor vehicle record (MVR) check. You do not need every type for every role, and running unnecessary checks wastes money and can create legal risk.

Why Small Businesses Run Background Checks

Small businesses run background checks for three reasons, and only one of them is obvious.

1. Negligent Hiring Liability

If you hire someone who harms a customer, colleague, or third party, and a reasonable background check would have revealed a pattern or prior offense, you can be held liable for negligent hiring. The legal standard is "knew or should have known."

Courts have consistently held that employers have a duty to exercise reasonable care in the hiring process, and that includes checking criminal records for positions where the employee has access to vulnerable people, homes, financial assets, or vehicles.

For an enterprise, a negligent hiring lawsuit is a legal expense. For a small company without the legal reserves and insurance coverage that large corporations maintain, it can be an existential threat. A single negligent hiring judgment can exceed the annual revenue of a small business. A criminal check on every hire costs far less than defending one of those claims.

2. Resume Fraud Is More Common Than You Think

Plenty of resumes contain fabricated or exaggerated information: inflated job titles, extended employment dates, claimed degrees that were never completed, and invented certifications. At a large company with a structured interview process, multiple rounds of evaluation, and a dedicated recruiting team, some of this gets caught.

At a small business where the founder conducts a single interview and makes an offer the same day, resume fraud goes undetected until the employee cannot perform the job they claimed to be qualified for. By then you have paid for the recruiting, the training and the months of output that never arrived.

Employment and education verification catches this. It takes anywhere from minutes to about a week, lists from $12.50 per check before any database fee, and confirms whether the candidate actually held the positions and earned the degrees they listed.

3. Industry and Regulatory Requirements

Some industries require background checks by law. Financial services firms must comply with Financial Industry Regulatory Authority (FINRA) background investigation requirements. Transportation companies regulated by the Department of Transportation (DOT) must run MVR checks and drug tests on commercial driver's license (CDL) holders. Childcare facilities must conduct state-mandated criminal checks, often including fingerprint-based FBI checks.

Healthcare employers are advised to screen new hires and current staff against the HHS Office of Inspector General (OIG) exclusion list, because anyone who hires an excluded individual may face civil monetary penalties, and many roles also call for state abuse registry checks. If your business operates in a regulated industry, background checks are not optional.

9 Types of Background Checks: What They Show, Cost, and Turnaround

Background checks are not one thing. They are nine different investigations that can be ordered individually or bundled into packages. Each type searches different records, costs a different amount, and takes a different amount of time. Understanding what each type does helps you build the right screening package for each role at your company.

The prices on each card are list prices from screening providers that publish them, as of September 2026, and they leave out the court access and database fees billed on top. The times are typical ranges; a search that needs a court researcher or a lab can run longer.

The most common mistake small businesses make is ordering too few checks or too many. Too few means a criminal check alone, which misses employment fraud. Too many means a credit check for every role, which is unnecessary, and illegal in the states that restrict employment credit reports to positions with genuine financial responsibility. The right approach is to build 2 to 3 standard packages based on role type and apply them consistently.

Writing those packages down is what keeps them consistent when you are hiring in a hurry. One row per role category, the checks it gets, and the reason each check relates to the work, so the same package runs every time and you can say why a credit check applies to one role and not another.

What About Civil Background Checks?

A civil background check searches court records for non-criminal cases: lawsuits, money judgments, evictions, restraining orders, and business disputes filed at the county, state, or federal level. It is not part of a standard package and most small businesses never order one. What it returns are disagreements, not crimes.

It earns its cost on roles with real fiduciary exposure: a controller, an executive hire, anyone who signs contracts for you. Read the results carefully even then. Section 605 of the FCRA bars a reporting agency from listing civil suits and judgments older than seven years (or the governing statute of limitations, if that runs longer) unless the job pays $75,000 or more, and being sued is not the same as losing.

County, State, National, and Federal Criminal Checks

A criminal background check is not one search. It is four record sources, and each covers ground the others miss. County searches read the courthouse where the case was filed. State searches read a central repository. National database searches read a commercial index. Federal searches read the US district courts.

Which Levels to Order Together

The working combination for a small business is an SSN trace, a national database search, and a county search in every county the trace surfaces. The trace tells you where the person has lived. The national search points at jurisdictions you would never have thought to check. The county searches confirm whatever either one turns up.

Nobody sells a genuinely free nationwide criminal check. What is free is looking up one county at a time on a court portal and searching the national sex offender registry the Department of Justice coordinates, which reaches all 50 states, the District of Columbia, the territories and Indian Country. That is fine for personal curiosity and useless as a hiring process, because the moment a third party gathers it for you, the FCRA applies in full.

Federal Criminal Searches Versus an FBI Check

A federal criminal search is a search of the US district courts through PACER (Public Access to Court Electronic Records). It is not an FBI check, and the two get confused constantly. The FBI record people have in mind is the Identity History Summary, which is fingerprint based and comes from a different system with different access rules.

The FBI issues that summary two ways. A person can request their own record, directly or through an FBI-approved Channeler, and the result is marked for personal review only, not for licensing or employment.

Employment and licensing screening happens only where a federal statute, or a state statute the FBI has approved under Public Law 92-544, authorizes it, and those requests go through the authorized state agency. A small business with no such statute behind the role cannot buy one.

That is why fingerprint-based checks turn up in childcare, healthcare, and government contracting and almost nowhere else. If your business is not in one of those categories, the county, state, and national searches your provider runs are the criminal checks actually available to you.

Will a Warrant Show Up on a Background Check?

Sometimes. A warrant attached to a case in a county you actually searched can appear in that court record, and some statewide repositories carry warrant data. But the nationwide warrant system, the FBI National Crime Information Center, is a law enforcement system, open to other agencies only for civil purposes a statute specifically authorizes. No screening provider queries it for you.

The practical answer is to treat warrant information as something you may or may not see, and never build a screening policy around catching it. If one does appear, it is a pending matter rather than a conviction, and several states restrict how much weight you can put on non-conviction records.

State Systems Like Massachusetts CORI

Several states run their own criminal record systems under their own names, and Massachusetts CORI causes the most confusion. CORI stands for Criminal Offender Record Information, the record set the state Department of Criminal Justice Information Services maintains and releases through its iCORI portal to employers who register and obtain written consent first.

A CORI check is not the same thing as a background check. It is one state's court and conviction data, so it verifies nothing about employment, education, licenses, or driving, and it stops at the state line.

Massachusetts also limits what you can ask. Chapter 151B bars the criminal-history question from the initial written application entirely, and it bars asking at any point about a misdemeanor conviction three or more years old where nothing has followed it. Other states have their own systems and their own limits, which is why background check laws by state is worth reading before you screen in a new one.

What Shows Up on a Background Check

What appears in a background check depends entirely on which types of checks you order. A criminal check only shows criminal records. An employment verification only shows employment history. There is no single "background check" that reveals everything about a person. Each type searches specific databases and returns specific information.

A critical distinction: the check shows records, not judgments. A criminal conviction appears in the report, but the report does not tell you whether that conviction should disqualify the candidate. That is your decision, and the Equal Employment Opportunity Commission (EEOC) has specific guidance on how to make it (covered in the EEOC section below).

What Does Not Show Up on a Background Check

Understanding what background checks cannot reveal is as important as understanding what they show. Several categories of information are either legally restricted from appearing in background check reports or simply not captured by the databases that CRAs search.

Legally Restricted Information

The FCRA and various state laws prohibit or limit the reporting of certain information. An arrest record older than seven years (or the governing statute of limitations, if that runs longer) stays out of the report under federal law unless the job pays $75,000 or more, and several states, California among them, restrict non-conviction records further than that.

Sealed and expunged records should not appear in CRA reports, although database lag can sometimes cause them to surface (the CRA is responsible for removing them when notified). Bankruptcies older than 10 years, and paid tax liens, collection accounts and other negative financial items older than 7 years, are excluded from credit reports.

Health information is off the table too, though the reason is not the one most owners assume. HIPAA, the federal health privacy law, governs health plans and providers, not your hiring file. What binds you is the Americans with Disabilities Act (ADA), which allows a medical inquiry or examination only after a conditional offer and requires anything you learn to be kept on separate forms and in a separate medical file.

The Genetic Information Nondiscrimination Act (GINA) goes further on genetic information: an employer generally may not request, require or purchase genetic information about an employee or their family, family medical history included.

Information That Requires Separate Investigation

Background checks do not cover everything an employer might want to know. Work performance, management skills, cultural fit, and interpersonal dynamics are not captured in any database. Reference checks (conversations with former managers and colleagues) are the only way to assess these qualities.

Immigration status and work authorization are verified through the I-9 process, not through a background check. Salary history is restricted from employer inquiry in an increasing number of states regardless of the screening method used.

How a Background Check Works: The 5-Step Process

The background check process follows the same sequence regardless of which types of checks you order. These five steps are dictated by the FCRA and apply every time you use a third-party CRA to screen a candidate. Skipping any step creates legal liability.

The information a check actually needs is short. Full legal name and any former names, date of birth, Social Security number, and about seven years of address history cover the criminal searches. Add driver license number and state for an MVR, employer names and dates for employment verification, and school and degree for education. Collect all of it on the authorization form rather than in an email thread.

Candidates without a Social Security number are screened on name, date of birth, and address history instead, which makes the county searches slower and the identity match weaker. Ask for an I-94 or passport number in that case, and never treat the missing number as a red flag: work authorization is an I-9 question, not a screening one.

The entire process takes 1 to 7 business days from consent to decision. The bottleneck is almost always employment and education verification, which requires contacting third parties who may not respond quickly. Criminal checks, SSN traces, and MVR checks typically return within 1 to 3 business days. Drug tests return in 1 to 3 days after the specimen is collected.

What a Background Check Report Looks Like

A background check report is a summary page followed by one section for every search you ordered. The summary carries the candidate's identifiers, the date the report completed, the package that was run, and an overall status. Everything below it is the evidence behind that status.

Most providers publish a sample report on their site. Ask for one before you sign, because that layout is what you will be reading under time pressure with a start date already promised. The two fields that matter most on any record line are the disposition and the source jurisdiction, since your decision rests on both.

One thing you will not find anywhere on the page is a recommendation. The report says what the records say. No status label is a hiring decision, and no provider makes one for you. That judgment stays yours, measured against your written criteria and the three EEOC factors below.

Where the Background Check Fits in Your Onboarding Workflow

The check runs between the verbal offer and Day 1 as part of the actual onboarding workflow: the sequence of steps that involves disclosure forms, consent signatures, compliance paperwork, and task sequencing. Most articles about background checks stop at the hiring decision, but for a small business owner who is running this process themselves, seeing the full timeline matters more than any individual step.

The key point: the background check is not a standalone event. It is one task in a sequence that includes the preboarding process, compliance documentation, and Day 1 preparation.

Treating the check as a standalone event creates gaps: the check comes back clear but nobody started the I-9 process, or the start date arrives but the onboarding tasks are not assigned. When you treat it as one step in an automated workflow, everything moves forward together.

This is specifically why I built task workflows into FirstHR: to sequence the steps that surround the background check (send disclosure, collect consent via e-signature, track check status, trigger onboarding tasks when clear) so that nothing falls through the cracks when the person running the process is also the person running the business.

How Long Does a Background Check Take?

The total time depends on which checks you order. Some return in minutes, while verifications that wait on a former employer or school can take up to a week.

For most small businesses, the practical total is 2 to 5 business days from consent to completed report. To minimize delays, submit the check immediately after receiving consent. Do not wait for the written offer to be signed. Do not wait for a start date to be agreed upon. The check runs in parallel with everything else.

How Much Does a Background Check Cost?

Background check costs depend on two variables: which types of checks you run and which provider you use. At published domestic prices, a single add-on check runs from about $8 for a credit report to about $60 for a clinic-based drug test. Most CRA providers sell bundled packages that cost less than ordering individual checks.

Those ranges are list prices from providers that publish them, as of September 2026, and they exclude pass-through fees. Published fee schedules put county court access fees anywhere from $0.20 to just under $100 depending on the county, and third-party employment verification database fees at $17.95 to $119.95 per search.

For a small business hiring 5 to 15 people per year, the annual list-price cost of background checks runs from $120 to $3,300 (at $24 to $220 per check).

Set that against the cost of a bad hire. The 2025 SHRM benchmarking survey put the average cost per hire at $5,475 for nonexecutive roles. A talent-management consultant quoted by SHRM in 2022 goes further, estimating the full expense of filling a role at three to four times the position's salary once soft costs such as managers' time are counted. Background checks are the highest-ROI investment in the hiring process.

Most CRA providers do not charge monthly fees. You pay per check. This makes background checks accessible even for businesses that hire infrequently. Volume pricing is usually quoted rather than published, so ask for it once you screen regularly.

Cost by Role: 4 Real Scenarios for Small Businesses

Abstract pricing ranges are less useful than seeing what a background check actually costs for the specific roles you are hiring. Here are four common scenarios for small businesses, with the checks you should run and the approximate total at published list prices, before court and database fees.

The pattern: the more sensitive the role, the more checks you need, and the higher the cost. But even the most comprehensive screening (healthcare worker, from $155) is a fraction of what it costs to hire, train, and then replace someone who should not have been hired.

FCRA Compliance: The Law You Must Follow

The Fair Credit Reporting Act (FCRA) is the federal law that governs how employers use background checks in hiring decisions. If you use a third-party CRA (which includes every background check provider, from the national platforms to local screening companies), you must follow FCRA requirements.

Breaking those requirements willfully is expensive: the applicant can recover either actual damages or statutory damages of $100 to $1,000, with punitive damages and attorney fees on top. That per-applicant figure looks survivable until you multiply it by everyone you screened the same way, which is why defective disclosure forms keep turning into class actions.

The FCRA requirements for employers are straightforward but must be followed precisely.

Before the Check: Disclosure and Consent

You must provide the candidate with a clear, conspicuous, written disclosure stating that you may obtain a consumer report (background check) for employment purposes. This disclosure must be a standalone document. It cannot be included in the job application. It cannot be combined with the offer letter. It cannot be part of an employee handbook acknowledgment. One document, one purpose.

The candidate must then provide written authorization for you to proceed, and the statute allows that authorization to sit on the disclosure document itself. An electronic signature is fine: the federal E-Sign Act says a signature cannot be denied legal effect solely because it is electronic.

During the Check: Permissible Purpose

You must have a "permissible purpose" for ordering the check. Employment screening is a permissible purpose, and the statute defines it as evaluating someone for employment, promotion, reassignment, or retention. Running a check on someone who has not applied for a job, or running checks on employees without their written authorization, can violate the FCRA.

The Federal Trade Commission (FTC) publishes the employer-side version of these obligations, written jointly with the EEOC, and it covers the disposal duty most owners have never heard of: once your retention period ends, reports have to be destroyed so they cannot be read or reconstructed.

After the Check: Adverse Action Process

If you decide not to hire someone (or to take any other negative action) based in whole or in part on the background check results, you must follow the adverse action process. This is a two-step procedure with a mandatory waiting period, covered in detail in the adverse action section below.

EEOC Guidance: Non-Discrimination in Background Screening

The Equal Employment Opportunity Commission (EEOC) publishes specific guidance on background checks, and its core point binds every employer the federal anti-discrimination laws cover: whenever you use background check results to make a decision, those laws apply. You cannot treat results differently because of race, national origin, sex, religion, disability, age, or genetic information (protected under Title VII of the Civil Rights Act, the ADA, the Age Discrimination in Employment Act, and GINA).

On June 9, 2026, the Justice Department concluded that the EEOC's disparate-impact guidelines are unconstitutional, and said businesses can use criminal-background checks and other hiring practices generally related to job performance without fear of violating Title VII simply because outcomes differ across demographic groups. The disparate-impact provision itself remains in Title VII, and the EEOC's 2012 conviction-records guidance is still posted.

The Three-Factor Test

When a criminal record appears in a background check, the EEOC's 2012 conviction-records guidance measures any decision to exclude against three factors, and California's Fair Chance Act writes the same three into its required individualized assessment.

What the EEOC Guidance Warns Against

The EEOC's position is that an automatic, across-the-board exclusion of everyone with a criminal record is inconsistent with the three factors, because it screens people out without regard to the offense or the job. Do not write a policy that says "no felonies, ever, for any position." The guidance recommends an individualized assessment for each candidate with a record, including a chance to explain the circumstances before a final decision.

This does not mean you must hire people with criminal records. It means evaluating each case individually rather than applying automatic exclusions, and in California, Illinois, New York City, and Washington that assessment is a statutory duty rather than a recommendation.

Ban-the-Box: State-by-State Overview

Ban-the-box laws restrict when employers can ask about criminal history in the hiring process. The term refers to removing the checkbox on job applications that asks "Have you ever been convicted of a crime?"

Most states have passed a ban-the-box law, and so have a long list of cities and counties, but the coverage question that matters to you is narrower than that headline count. The majority of these laws bind only public employers and state contractors, and a smaller group reaches private businesses.

The practical implication for small businesses: keep criminal history off your job application wherever you hire. A growing list of states and cities requires this of private employers, and the EEOC recommends it even where no law does.

Make a conditional offer first. Run the background check after the candidate accepts the conditional offer. Then evaluate any results using the EEOC's three-factor test. This sequence complies with ban-the-box laws in all states and follows EEOC best practices regardless of your state's specific law.

Some states go further than the application form. California's Fair Chance Act covers employers with five or more employees and bars any question about conviction history until a job offer has been made, then requires an individualized assessment before you withdraw it.

New York City requires a written analysis of each criminal record under Article 23-A of the state Correction Law, shared with the applicant. Illinois requires written notice and an interactive assessment before a conviction can cost someone the job. Massachusetts, as the CORI section covers, limits which convictions you may ask about in the first place.

The Adverse Action Process: What to Do When Results Are Not Clear

Adverse action is the legal term for any negative employment decision based on a background check: deciding not to hire, rescinding an offer, terminating employment, or denying a promotion. The FCRA requires a specific two-step process: a pre-adverse action notice with the report attached, then a pause, then the final notice. Skipping either notice is a violation.

The adverse action process exists to protect candidates from inaccurate background check reports. CRA databases are not perfect. Records can be misattributed (common names, data entry errors), outdated (showing arrests that were later dismissed), or simply wrong. The waiting period gives the candidate time to identify and dispute errors before you make a final decision.

How long the pause has to be is the question nobody answers cleanly, because the statute does not answer it either. The FCRA names no number of days. Courts and FTC guidance point to five days as a reasonable period to wait after the pre-adverse notice, and several state and city fair chance laws impose their own window on top, so treat five business days as the floor to work from rather than a safe harbor.

For small businesses, the adverse action process feels bureaucratic. You found something concerning. You do not want to hire this person. You want to move on. But skipping the process creates legal liability that far exceeds the inconvenience of waiting a week.

Background Check Requirements by Industry

Some industries require specific background checks by law. Others have no requirements but follow industry standards. Which category your business falls into sets your minimum screening obligations.

If your business does not fall into a regulated industry, background checks are voluntary. But "voluntary" does not mean "unnecessary." Negligent hiring liability applies to all employers regardless of industry. The question is not whether to run checks but which checks are appropriate for each role.

DIY vs. Using a Background Check Provider

Small business owners sometimes consider running background checks themselves to save money. You can search county court websites, call former employers, and verify degrees directly with universities. The question is whether the savings justify the risks and the time investment.

The recommendation for small businesses: use a CRA provider for criminal checks, credit checks, and any check that involves accessing regulated databases. You can do employment and education verification yourself (by calling former employers and schools directly), but even this is more efficient through a CRA if you are hiring more than 2 to 3 people per year.

The time you spend manually verifying employment is time you are not spending on revenue-generating work. At a founder's effective hourly rate, the $40 to $80 you save by doing it yourself is almost never worth the 2 to 4 hours of effort.

How to Choose a Background Check Provider

The background check provider market has dozens of options, from enterprise platforms built for thousands of checks a year, to self-service providers aimed at small employers, to local screening companies that pull county records by hand. For a small business, five criteria matter most.

For most small businesses hiring 5 to 15 people per year, a self-service provider with published per-check pricing and no monthly minimum gives the right balance of price, speed, and ease of use. Enterprise providers are designed for companies running hundreds or thousands of checks per year, and their pricing and contract structures rarely fit a business that screens once a quarter.

Background Check vs. Reference Check vs. Employment Verification

These three terms are frequently confused, but they serve different purposes and return different information.

The best practice for small businesses: run a background check (criminal + employment verification at minimum) on every hire. Conduct reference checks on candidates for senior or high-trust roles. Use employment verification as part of your background check package rather than as a standalone step.

8 Common Mistakes That Create Legal Risk

After working with dozens of small business owners on their hiring processes, I see the same mistakes repeatedly. Every one of them creates legal exposure that is entirely preventable.

The mistake behind most of these mistakes: treating the background check as informal due diligence rather than a legally regulated process. The FCRA, federal anti-discrimination law, and state laws create specific requirements for each step. Following them is not difficult, but you have to know they exist.

State-Specific Background Check Laws

Federal law (the FCRA and Title VII, read with EEOC guidance) sets the baseline. Many states add requirements on top. These state laws affect what you can search, when you can search it, how far back the results go, and what you must do with the results. Operating across multiple states means following the most restrictive applicable law.

Lookback Period Restrictions

Start with the federal floor, because it is not what most owners assume. A reporting agency may not list arrests or civil judgments older than seven years (or the governing statute of limitations, if that runs longer), convictions carry no federal time limit at all, and the whole seven-year cap falls away once the job pays $75,000 or more (15 U.S.C. 1681c).

Several states are stricter and delete the salary carve-out. California bars reporting any conviction more than seven years old, measured from disposition, release or parole, with no salary exception at all. New York applies its own seven-year conviction limit and sets the exemption at $25,000, not $75,000. Confirm your state before you assume the federal rule is the one that governs.

Credit Check Restrictions

A block of states restricts or prohibits credit checks for employment unless the position carries genuine financial responsibility: California, Colorado, Connecticut, Hawaii, Illinois, Maryland, Nevada, Oregon, Vermont and Washington, with Delaware limiting public employment and cities including New York City, Chicago and Philadelphia adding their own ordinances.

The exemptions are narrower than they sound. California permits a credit report only for a short list of positions, among them managers, sworn peace officers, anyone with regular access to $10,000 or more in cash, and anyone with authority to sign or transfer payments. If the role does not handle money, financial data, or company assets, do not run a credit check.

Drug Testing Laws

Drug testing laws vary dramatically by state, and the states pull in opposite directions. Alabama, Florida and Georgia run voluntary drug-free workplace programs that pay you to test: certifying a program earns a 5 percent discount on workers' compensation premiums in Alabama and at least 7.5 percent in Georgia, while Florida requires insurers' rating plans to give certified programs a credit without fixing its size.

States that legalized recreational cannabis moved the other way, though not as far as the headlines suggest. California does not ban testing. It makes it unlawful to act on off-duty cannabis use, or on a screen that found only nonpsychoactive cannabis metabolites, with carve-outs for the building trades and federally screened roles. Nevada and New York restrict pre-employment cannabis screening along similar lines.

DOT-regulated positions (CDL holders, pipeline workers, transit employees) test under federal rules regardless of state cannabis law. This area of law changes nearly every legislative session, so confirm your own state before you write a testing policy.

Salary History Bans

A long and growing list of states and cities prohibits employers from asking about salary history during the hiring process. While this is not strictly a background check issue, it intersects when employment verification includes salary disclosure. Some CRA providers automatically exclude salary information from employment verification results in states with salary history bans. If you are verifying employment in a state with a salary ban, ensure your CRA provider knows not to request or report salary information.

How to Handle Background Check Results

When background check results come back, they fall into one of three categories: clear, flagged, and needs adjudication. Each requires a different response, and having a written policy for all three before you start screening prevents inconsistent and potentially discriminatory treatment.

Clear Results

No records found, all verifications confirmed. This is the ideal outcome and the most common one. Proceed directly to onboarding. Trigger the preboarding process: send the welcome email, begin I-9 preparation, assign Day 1 tasks, and confirm the start date. Store the background check report with the signed disclosure and consent forms, in a screening file kept separate from the employee's general personnel file.

Flagged Results (Minor Issues)

Minor discrepancies that do not necessarily affect the hiring decision: a job title that differs slightly from what the candidate listed, an employment date that is off by a few months, an education record that shows "attended" rather than "graduated." These require a conversation with the candidate, not an adverse action.

Contact the candidate, share the discrepancy, and ask for clarification. In many cases, the explanation is simple: the candidate used a working title instead of their official title, or remembered graduation dates incorrectly. Document the conversation and the explanation in the file.

Needs Adjudication (Criminal Records or Significant Discrepancies)

Criminal convictions, significant resume fabrication (claiming a degree that was never earned, fabricating an entire employer), or failed drug tests require formal adjudication. Apply the EEOC's three-factor test for criminal records. For resume fabrication, the decision is more straightforward: fabricating credentials is a trust issue that most employers consider disqualifying regardless of the position.

For drug tests, follow your written drug-free workplace policy. If you decide not to hire, follow the full adverse action process. Document your reasoning in writing and retain it with the background check report.

That written reasoning is the whole defense, so it is worth having a form for it rather than a paragraph in an email. One record per candidate, covering every finding the report returned, filled in before the decision is made and while the candidate's explanation is still being collected. It also carries the FCRA trail: whether the record actually belongs to this person, whether anything was disputed and how the reinvestigation closed, and the dates both adverse action notices went out. Where the finding is a criminal record, the three-factor analysis goes on a separate individualized assessment attached to this record; the ban-the-box guide has that form.

Continuous Screening and Re-Screening Current Employees

Pre-employment background checks are a snapshot. They tell you what the candidate's record looked like on the day the check was run. They do not tell you what happens after the person is hired. Some employers implement continuous screening programs that monitor employees' records on an ongoing basis, or conduct periodic re-screening at set intervals.

How Long Is a Background Check Good For?

No law puts an expiration date on a background check. The report is accurate as of the day it was run and slightly stale the day after. A practical rule is to treat one as usable for about 12 months, and to re-run it when a start date slips more than a few months past the day the check cleared.

Regulated roles are the exception, and there the interval is written into the rule rather than left to you. A DOT-regulated motor carrier has to obtain and review each driver's motor vehicle record at least once every 12 months (49 CFR 391.25), whatever the pre-hire check showed. If a role is licensed or federally regulated, the re-check schedule is set for you.

When Continuous Screening Makes Sense

Continuous screening is most relevant for roles where a post-hire change in status could create serious risk. CDL holders whose license gets suspended. Healthcare workers who get added to an exclusion list. Financial services employees who develop credit problems. Employees with security clearances whose circumstances change. For these roles, waiting until the next scheduled re-screen (which might be years away) creates an unacceptable risk window.

Legal Requirements for Re-Screening

If you want to run background checks on current employees, you need fresh written consent. The consent the employee signed at hiring does not automatically extend to future checks unless it explicitly stated that ongoing screening would occur. The safest approach is to include a continuous screening consent clause in your initial authorization and then notify employees before each re-screen.

Apply the same FCRA requirements to employee checks that you apply to candidate checks: written disclosure, written consent, and adverse action process if the results lead to any negative employment action (termination, demotion, reassignment).

Practical Approach for Small Businesses

Most small businesses do not need a continuous screening program. The cost and administrative burden outweigh the risk reduction for general roles. Instead, implement re-screening triggers: run a new check when an employee is promoted to a role with greater responsibility, when they transfer to a position that requires additional screening (moving from office work to a driving role), or when a specific incident raises concerns.

Background Checks for International Candidates

If you are hiring someone who has lived or worked outside the United States, domestic background checks will not cover their international history. International background checks are more complex, more expensive, and take longer than domestic checks. They are also less standardized because each country has different record-keeping systems, privacy laws, and access rules.

What International Checks Cover

International criminal checks search the equivalent of court records in the countries where the candidate lived. Some countries (UK, Canada, Australia) have centralized criminal record systems that respond relatively quickly. Others (many countries in Asia, Africa, and South America) require in-country researchers to visit local courts, which takes weeks. International education and employment verification follows the same pattern: centralized systems respond quickly, manual systems take time.

Cost and Turnaround

International background checks list at about $32 to $124 per country searched at published prices, on top of domestic check costs. Turnaround runs from about 4 to 20 days per country. For a candidate who lived in two countries before the US, the international component alone could cost $64 to $248 and take up to four weeks.

For most small businesses hiring domestically, international checks are unnecessary. They become relevant when hiring foreign nationals, employees with significant international work history, or remote employees working from abroad.

The USCIS I-9 verification process confirms work authorization but does not replace a background check. I-9 verifies that the person is legally authorized to work in the United States. It does not search criminal records, verify employment history, or confirm educational credentials. They are separate processes with separate purposes.

Building Your Background Check Policy

A written background check policy protects your business from inconsistent screening practices, discrimination claims, and FCRA violations. The policy does not need to be long. One to two pages covering the essentials is sufficient for most small businesses.

What to Include in Your Policy

The most important element is the adjudication criteria. Without written criteria, every negative result becomes an ad hoc decision. Ad hoc decisions are inconsistent. Inconsistent decisions create disparate treatment liability. Write down your criteria before you run your first check, apply them consistently, and document your reasoning for every adverse decision.

Record Keeping and Storage

Background check records are employment records subject to federal and state retention requirements. Proper storage protects your business during audits, litigation, and compliance reviews.

What to Retain

For every background check you run, retain the following documents: the signed disclosure form, the signed consent form, the complete background check report, any adverse action notices (pre-adverse and final), the candidate's response to adverse action notices (if any), and your written adjudication analysis (if the check returned negative results). These documents should be stored together, either in a physical file or in a digital document management system.

How Long to Retain

Federal law sets the minimum, and it is one year. Under the Title VII record-keeping rules, each personnel or employment record has to be kept for one year from the date it was made or the date of the personnel action, whichever is later. Once a discrimination charge is filed, you must hold everything relevant to it until the matter is finally resolved.

Some states require longer. California requires four years for applications, personnel files and related records. The safest approach is to retain background check records for 5 to 7 years, which covers the FCRA's outer deadline for a lawsuit: five years after the violation occurred.

Storage and Access

Background check reports contain sensitive personal information: Social Security numbers, dates of birth, criminal history, credit data. These records must be stored securely with limited access.

Physical files should be in a locked cabinet separate from general employee files. Digital files should be in a system with role-based access controls. Only people with a legitimate business need (the hiring manager, the owner, the HR person if you have one) should have access to background check reports.

Keep the screening file separate from the employee's main personnel file. That is partly good practice, because it stops criminal history and credit data reaching supervisors who have no need for it, and partly law: anything medical you gathered after the offer has to sit on separate forms in a separate medical file, and GINA imposes the same separation on genetic information.

Background Check Playbook for Your First Hire

If you have never run a background check before, the process can seem overwhelming. FCRA, EEOC, ban-the-box, adverse action, CRA providers, adjudication criteria. It sounds like you need an employment lawyer before you can hire your first employee. You do not. Here is the simplified playbook for a small business owner running their first background check.

Total time investment: 15 to 30 minutes of your time, plus 1 to 3 days of waiting. Total cost: about $70 to $80 at list price, before any court or database fees.

Frequently Asked Questions