Running your first background check comes down to six steps: write a short policy, get written consent, decide what to actually check, pick a provider, order the report, and handle it the right way if something comes back. Do them in that order and you'll save yourself a headache. Skip the first one and you're just making up rules as you go.
I ran background checks for almost 30 years before I retired, and my first one was rough. I ordered a report before I'd written down a single rule about who gets checked for what. Don't do what I did. Here's the order that actually works.
A screening policy is just a written answer to one question: who gets checked, and for what, decided before anyone applies. Every warehouse hire gets the same checks. Every office hire gets the same checks. Nobody gets picked on a hunch.
That consistency matters more than people think. If two candidates for the same job get different checks, and one of them happens to be in a protected class, you've handed a lawyer an easy case. Write the rule once. Apply it every time.
Before you can run anything, federal law requires two separate documents. The Fair Credit Reporting Act, FCRA for short, says you need a standalone disclosure telling the candidate you're going to run a background check, plus a signed authorization giving you permission to do it.
Standalone means just that. Not buried on page four of your job application, not mixed in with your at-will employment language. Its own page, its own signature. Vendors get this wrong constantly, and it's the single most common trigger for a lawsuit in this whole process.
I'm describing the shape of the requirement here, not the exact wording you need. Get your disclosure and authorization forms reviewed by a lawyer before a real candidate ever sees them. The rules shift by state too, so don't assume one form covers every hire.
What you check should match the job, not a generic template. A driving job needs a motor vehicle record. A finance job might need a credit check where your state allows it. Most office hires just need identity, criminal history, and past employment confirmed.
| Role type | Checks worth running | Skip if |
|---|---|---|
| Office / admin | SSN trace, national + county criminal, employment verification | Role has no cash, data, or vehicle access |
| Delivery / driving | All of the above, plus a motor vehicle record | No company vehicle or mileage reimbursement involved |
| Cash handling / finance | All of the above, plus a credit check where legal | Your state bans employment credit checks |
| Childcare / healthcare | All of the above, plus fingerprint or state registry checks | Almost never skip this for a licensed role |
When you're not sure, check less first and add more later if the role changes. Running a credit check on someone who'll never touch a budget just adds cost and risk for nothing.
Don't shop by price alone. Look for PBSA accreditation, which means an outside auditor actually checked the provider's compliance practices, not just their sales page. Ask about turnaround by search type, not their average. An average hides exactly the checks that'll blow up your start date.
Ask straight out whether they'll help you build compliant disclosure and consent forms, or just hand you blank templates and wish you luck. A good provider acts like a partner in this process. A bad one acts like a vendor, and dealing with one of those is more trouble than its worth.
Once you've picked a provider, ordering is usually the easy part. A form, a candidate email, a wait. Most candidates recieve that email within minutes and confirm consent right on their phone.
Most standard checks come back in one to five business days. County court records and old-fashioned phone verification calls take longer, sometimes a week or more. Tell your hiring manager that up front. Nothing burns trust in this process faster than a start date slipping because nobody explained the timeline.
This is the part people rush and shouldn't. If a report turns up something that might change your decision, you can't just reject the candidate on the spot. FCRA requires a two-step notice process called adverse action.
First comes pre-adverse action. You send the candidate a copy of the report and a summary of their rights, then give them real time to respond before you finalize anything. Many companies use five business days as their own internal standard. The law itself doesn't spell out one exact number, so check current guidance or a lawyer before you lock that into your policy.
If the candidate doesn't dispute anything and you still want to move on, you send a final adverse action notice. That's it. Skip this step and you're not being sloppy, you're breaking federal law.
Ordering a check before the offer is out, in states where that's not allowed, is the big one. A lot of states only let you ask about criminal history after a conditional offer, not during the interview or on the application.
Treating the disclosure form as paperwork instead of a real legal document is another. So is skipping pre-adverse action because the reason for the rejection "seemed obvious." It never is, not to the person on the other end of that email.
Do I need a lawyer for my very first check? You need one to review your disclosure, authorization, and adverse action templates once. After that, most small employers run the process themselves using their provider's tools.
Can I just use my provider's default forms? Only after someone with legal knowledge has actually read them for your state. A generic template built for a different state can leave you exposed.