ISO 27001 Personnel Screening: Proportionate Checks and Audit Evidence

Personnel screening should help an organisation decide whether a person can appropriately perform a role and receive its associated access. It should not become an unrestricted investigation into private life or a universal demand for every available check.

Under ISO/IEC 27001:2022, Annex A control 6.1 concerns screening. Its application should reflect relevant law, business needs, information sensitivity and risk. The organisation determines necessary controls through its risk-treatment process and records applicability. A list of possible checks is therefore a starting point for decisions, not proof that identical checks must be performed on everyone.

The method below is AuditPrepared guidance for connecting role risk, screening decisions and access evidence. Local employment, equality and privacy obligations must be determined for each operating jurisdiction.

Start with the role’s exposure

Assess the role before selecting checks. Consider the information the person will handle, financial authority, administrative privileges, physical access, degree of supervision and potential consequence of misuse or error.

Document which characteristics actually change the screening decision. A role with access to public marketing material may present different exposure from an administrator able to change production security settings. A contractor working for a short period can still hold high-impact access; duration alone is not a reliable risk classification.

Avoid using job seniority as the only measure. A junior support role may access large volumes of sensitive records, while a senior adviser may have little system access. The decision should follow the work and permissions rather than the title.

Define a proportionate screening profile

Create approved role profiles that state the objective of each check, how it will be performed, who reviews it and what result is needed before access is granted.

Check category	Possible decision purpose	Boundary to establish
Identity verification	Confirm the person presenting for the role	Acceptable evidence and secure handling
Employment history	Resolve material claims relevant to experience	Period, relevance and handling of gaps
Qualifications or professional status	Confirm a credential the role depends on	Issuer verification and current status where relevant
References	Corroborate relevant work history or responsibilities	Authorised contact and consistent questions
Legally permitted role-specific screening	Address a demonstrated exposure or obligation	Legal eligibility, necessity and permitted use

Credit, criminal-record, medical and other sensitive checks require particular care. A security label does not create legal authority to collect or use that information. Determine what is permitted and necessary before instructing an external provider.

Do not equate screening with a guarantee of honesty or future behaviour. It is one source of evidence alongside supervision, access control, segregation of duties, training and monitoring.

Confirm the legal and privacy boundary first

For each jurisdiction, assign responsibility for confirming lawful collection, notice, any required authorisation, retention and decision procedures. Consider the candidate’s location, employing entity, screening provider and destination of the information.

As a jurisdiction-specific example, the joint U.S. EEOC and FTC guidance explains that employers using background information must consider anti-discrimination law and, when obtaining reports from a reporting company, Fair Credit Reporting Act obligations. It discusses permission and steps before adverse action. These are U.S. requirements; they should not be presented as a universal ISO process.

Use qualified local advice where interpretation is needed. Record the approved rule for the operating location so recruitment teams do not improvise legal decisions under time pressure.

Separate collection, assessment and access approval

A clear workflow reduces unnecessary disclosure. HR or an authorised screening team can obtain and assess the evidence. The hiring manager can receive the decision relevant to the role. IT can receive the access-authorisation state without receiving the entire background report.

Suggested states include:

• not started;
• evidence requested;
• verification in progress;
• clarification required;
• approved for the specified role;
• approved with defined restrictions; and
• not approved or referred for a further decision.

Define what each state permits. “In progress” must not quietly become approval simply because a start date arrives. Nor should incomplete information automatically be treated as an adverse result.

The access-control governance guide explains how business approvals should connect to actual permissions. Screening should inform that connection rather than operate in a separate HR folder with no effect on access.

Handle discrepancies fairly and consistently

A discrepancy needs analysis. Different date formats, name changes, overseas education records or an employer that no longer exists can make verification difficult without demonstrating dishonesty.

Give the person an appropriate opportunity to clarify material issues, subject to the applicable process. Record the original question, information received, relevance to the role and authorised conclusion. Keep the assessment focused on the stated screening objective.

For example, a hypothetical infrastructure engineer reports a qualification that cannot initially be verified. HR obtains confirmation through the awarding institution’s official channel. The record then shows the issue was resolved; it should not retain an unexplained risk flag indefinitely.

Where a discrepancy remains, distinguish uncertainty from a confirmed false statement. Escalate according to the approved criteria and legal process, rather than allowing an automated label to make the employment decision.

Control access while a check is incomplete

If a business need requires work to begin before all checks conclude, use a documented exception where permitted. The decision should identify the outstanding check, reason, risk owner, permitted activities, restrictions, expiry and follow-up owner.

Possible safeguards include supervised work, restricted data access, no production privileges, limited physical access or postponement of particular duties. These are examples to evaluate, not substitutes for a legally mandatory prerequisite.

Confirm the restrictions in the systems and work arrangements. A signed exception saying “no privileged access” is ineffective if a standard onboarding group grants administrator rights automatically. Close the exception when evidence is complete or remove access when its authority expires.

Include contractors, transfers and role changes

Employees are not the only people who create personnel-security exposure. Determine screening responsibilities for temporary workers, agency staff and supplier personnel who perform relevant activities.

Where a provider performs screening, define the agreed standard, evidence of completion, escalation of exceptions and responsibility for updates. Seek proportionate assurance rather than automatically demanding copies of every individual’s sensitive records. Connect these obligations with the supplier-security lifecycle.

Reassess the profile when a person moves into a role with different exposure. A previously completed check may remain sufficient, require an update or leave a new requirement unanswered. Define ongoing review triggers and frequency according to risk and law; avoid inventing a universal annual rescreening requirement.

Protect the screening evidence itself

Screening records can contain sensitive personal information. Restrict access by function, use approved transfer methods and separate detailed source material from routine completion reporting. Establish retention and disposal rules based on applicable obligations and the organisation’s documented purposes.

An auditor usually needs evidence that required checks occurred and decisions were controlled. That does not automatically require unrestricted access to complete personal reports. Use redacted records, supervised review or other agreed methods that preserve sufficient audit evidence while limiting disclosure.

Credential verification is also distinct from evaluating practical competence. The professional-credentials guide explains how qualifications fit alongside observed performance and role requirements.

Test the process through an audit trail

Select a risk-based sample covering a new employee, a contractor, a role transfer, an unresolved discrepancy and an exception. For each case, trace:

1. the role profile and approved screening requirements;
2. the legal and privacy conditions applied;
3. completion dates and source-verification records;
4. discrepancy handling and decision authority;
5. the access actually granted;
6. any restriction and its expiry; and
7. subsequent review or closure.

Compare screening dates with access-activation dates. Investigate mismatches instead of relying on a dashboard that reports only final completion. The Annex A control lookup can support discussion of personnel controls and their relationship with access and information handling.

An effective process has approved role criteria, proportionate collection, traceable decisions and access consistent with the outcome. A partially effective process has reliable checks but weak exception or transfer handling. An ineffective process has unowned gaps or grants sensitive access without the required decision. These descriptions are audit guidance, not prescribed ISO grades.