 |
Employers are increasingly concerned about the risks associated with employees, temporary workers, independent contractors, and others who have the ability to wreak havoc on an organisation from the inside. This is often referred to as “insider threat.”
There are numerous types of insider and post-hire threats that range from embezzlement, theft of trade secrets, workplace violence or active shooters, and everything else in between. Potential insider threats are not just employees but anyone with access to a business office including contractors, vendors, and temporary workers. While there are numerous tools that can be used for preventing insider threats, this article will focus on background checks.
Although pre-employment background checks are often cited as an essential element of an insider threat prevention programme, background checks are just one part of an overall strategy. The identification and prevention of insider threats requires an inter-disciplinary approach that can include mental health assessments, psychological testing, physical security, internal controls, continuous evaluation of personnel, supervisor and co-worker training to recognise danger signals, identification of risk factors, sharing and analysing information between responsible parties, and a culture of safety, reporting, and integrity. Most critically, an organisation needs to have a commitment to prevent these threats, and a leadership team and professionals who are able to formulate and implement an overall strategy.
Background checks - a critical part of the risk-management toolkit
Employees are not only a significant investment and large cost, but each hire also represents a large potential risk. Every employer has the obligation to exercise “due diligence” when hiring. Employers, especially in industries with higher risk, need to be able to vouch for the integrity and honesty of their employees. Generally speaking, people with a past history of honesty are much more likely to be honest in the future. Conversely, there is evidence to suggest that if applicants are dishonest in how they obtained a job, they may be dishonest once they have the job. But it is difficult to identify potential “bad hires” just by interviews since some applicants lie so often they come across naturally as if they believe their own story.
Background screening provides a valuable and objective risk-management tool that gives employers additional protection against a bad hire. Employers utilise background checks to minimise the risks associated with workplace violence, lost customers, negligent hiring lawsuits, identity theft and fraud, embezzlement, data breaches, and high turnover. It has been estimated, for example, that the cost of a single bad hire can run from $10,000 to $100,000 given time wasted to recruit, hire, and train and then having to replace the bad hire.
 |
| It has been estimated that the cost of a single bad hire can run from $10,000 to $100,000 given time wasted to recruit, hire, and train and then having to replace the bad hire |
Background screening - Types of inquiry
A pre-employment background check is conducted under a federal law called the Fair Credit Reporting Act (FCRA) that sets out specific steps, such as the need for a written disclosure and consent as well as steps necessary to ensure accuracy and to allow a consumer to ask for a re-investigation of a report. Background checks broadly cover two types of inquiry. First, a background check may verify information an applicant provides about their credentials, such as past employment and education. Secondly, a check may involve searching relevant public or private records, such as driving records, criminal matters, exclusion or sanction databases, or credit reports. A competent screening firm will have a number of tools that can help an employer depending on the nature and risk of the hire and the industry involved.
Criminal record checks in particular are often a key element of a background check since past criminal conduct can raise concerns about the propensity to repeat criminal behaviour. However, employers need to be mindful of their obligations under Equal Employment Opportunity (EEO) laws and other laws such as Ban the Box rules that prohibit asking about a criminal record on an application form, to ensure that the use of criminal records is both relevant and fair and complies with an employer’s legal obligations.
Since background checks can impact employment, it is increasingly subject to more litigation, regulation and legislation. Class action lawsuits against employers have dramatically risen for example. For that reason, background screening has become a highly regulated professional endeavour that requires legal compliance expertise and the ability to provide highly accurate information while maintaining the highest level of data security and protection.
Do background checks eliminate future risks?
Part of the problem for employers is that even if a person passes a background check, it is hard for employers to measure with any accuracy how an employee will react in the future to various situations, such as a need for money, a substance abuse or other personal problem, or ability to act in an ethical fashion when under orders to do something that is less than ethical by a superior. Many organisations have found that the key is to supplement pre-employment background checks with ongoing or continuous screening, and an environment of control and physical safety.
Risk types - predictable, unpredictable and secret
Even with “good hires,” the potential for insider threats always exists. After getting applicants in the front door, a business must be concerned about employees with substantial authority (C-level and above), access to Information Technology (IT) or proprietary information, access to cash and accounting or access to sensitive information such customer lists and operations information. In fact, a new hire is full of risk. “Predictable risks” include employees with access to cash or assets and little internal controls. “Unpredictable risks” occur when employees develop financial issues, gamble, use drugs, or are encouraged or ordered by supervisors to perform acts of questionable honesty. “Secret risks” involve people with political agendas who use jobs to advance goals detrimental to employers.
There are also potential surprises employers can face post-hire. First, employers may obtain newly discovered information concerning an applicant such as discovering a new employee is a registered sex offender or faked an academic or professional credential. The good news is that employers can take steps to minimise surprises by a well thought out pre-employment screening programme. The first step is to have in place policies, practices, and procedures to carefully select your employees in the first place through a well thought out pre-employment screening programme commensurate with the risk involved.
 |
| Experts recommend employers consider “continuous” evaluation that occurs periodically after hiring to deter employees from committing crimes after being hired |
Formulating a wise pre-employment screening programme
Employers should also ensure their application forms make it clear that any material falsehood or omission can result in termination NO MATTER WHEN DISCOVERED and have language in employee manuals that deals with discovered falsehoods or omissions post-hire. Background check releases can have an “Evergreen” clause to allow future screening if needed (although there are limits to what can be done). Employers need to keep in mind that any screening programme for new or existing employees should pay careful attention to the requirements of the FCRA as well as numerous applicable state laws.
There are several screening tools for detecting “insider threats”: Ongoing “continuous” evaluation (CE); Re-enactment (post-mortem) screenings; Credit Reports and asset searches; Social Media Background Checks; and Screening current workers or newly acquired workforce. It is also important for employers to know that internal “in-house” investigations can invoke the FCRA.
Employee screening after hiring
Some experts recommend employers consider “continuous” evaluation that occurs periodically after hiring. The argument in favour of such screening is that employees may commit a crime after being hired. It can also be a deterrence of sorts. Employers may also need to screen newly acquired employees if a merger or acquisition occurs. In addition, certain contracts may also require only screened employees.
According to the 2012 Association of Certified Fraud Examiners (ACFE) Report to the Nations, most occupational fraudsters are first-time offenders with clean employment and criminal histories |
However, there are legal implications of using information acquired after hiring. Employers should not have a knee jerk reaction and carefully review all the facts and circumstances to give the employee an opportunity to be heard. It is especially important for employers to carefully document actions – especially if employee has pending employment related claim – and be careful of allegations of retaliation. In addition, many of these tools have drawbacks. For example, the use of social media sites to track threats is hampered by the fact that there is so much information online; it can be challenging to locate, identify, and utilise actionable data about a particular person, especially since a person may hide their activities behind privacy protection or use an anonymous online persona.
Screening without proper internal controls is insufficient
According to the 2012 Association of Certified Fraud Examiners (ACFE) Report to the Nations, most occupational fraudsters are first-time offenders with clean employment and criminal histories. The walkaway point is that although pre-employment screening is critical to detect and deter fraud and threats, it is inadequate as a sole line of defence in the absence of proper internal controls that prevent surprises.
Bottom line: Employers must conduct due diligence before AND after hiring an employee. While this requires spending money, and the cost of background checks can be seen as a drag on the bottom line, the average cost of a screening usually equals the salary paid to employees for their first day of work. To paraphrase a well-known 1970’s marketing slogan: “You can pay (a little) now, or pay (a lot) later.”
