Lorem ipsum dolor sit amet, consectetur adipiscing elit. Vivamus convallis sem tellus, vitae egestas felis vestibule ut.

Error message details.

Reuse Permissions

Request permission to republish or redistribute SHRM content and materials.

Double-Check Criminal Background Checks

Employers need to make sure their background screening procedures meet legal requirements.

A clipboard with a piece of paper and a pencil.

When conducting criminal background checks, employers must weigh two sometimes-conflicting factors. First, the formerly incarcerated may be a source of much-needed talent—second-chance initiatives benefit employers as well as employees. Second, some convictions could mean taking on unacceptable safety or other risks in hiring a candidate into a particular position.

These business issues correspond with legal risks: On the one hand, to avoid a claim of unlawful refusal to hire, employers need to understand the protections that the formerly incarcerated have. On the other hand, employers need to consider whether hiring a candidate would expose them to a negligent-hiring claim in light of a prospective hire’s criminal record and the job for which he or she has applied.

Employers must consider a plethora of federal, state and local laws in balancing these competing considerations. 

How does an employer weave the laws into a practical protocol? Let’s enter the legal maze.

Scope of the Background Check

In most cases, the background check will be conducted by a third party rather than by the employer itself. The third party is considered a “consumer reporting agency” (CRA) for purposes of the primary federal law in this area, the Fair Credit and Reporting Act (FCRA).

As part of contracting with a CRA, the employer should make clear what the CRA should and should not disclose to it. As a general rule, an employer should not receive information that it lawfully cannot consider. 

For example, many states, such as California and Massachusetts, restrict an employer’s consideration of certain misdemeanors. So the CRA should be instructed not to report such misdemeanor convictions. 

‘Ban-the-Box’ Laws 

After an employer contracts with a CRA, it should decide when to conduct background checks and whether to limit them to certain positions. Requiring them of only certain individuals is inadvisable; if an employer checks backgrounds based on people rather than positions, it invites claims of explicit or implicit bias, which very well may exist. 

Then there’s a question of timing. An increasing number of state and local laws prevent employers from asking about criminal history—or conducting a background check—until after a conditional offer is made. Even if an employer is not subject to “ban-the-box” laws (referring to a check box on an application that asks about criminal records), it ordinarily makes sense not to conduct a background check until after a conditional offer is extended. 

By waiting until then, an employer is less likely to have a viscerally negative reaction to the existence of any conviction, because the employer has already decided that it wants to hire the applicant. The formerly incarcerated are a source of talent that employers should not categorically ignore, independent of the law.

The Process

The background-check process that an employer will follow is set forth in the FCRA. In general, there are three main steps: 

  1. Authorization by the applicant. 
  2. Pre-adverse action notice.
  3. Adverse action notice.

Each of these elements is addressed below. 


All applicants must sign a background-check authorization that’s compliant with federal law. The authorization would not be compliant, for example, if the applicant waives any claims that he or she may have with regard to the background check.

Some states, such as California, require a separate authorization. Any form required by a state should be a separate form and not combined with the FCRA authorization, or it may not comply with the FCRA. 

After the employer receives information from the CRA about an applicant, HR will need to determine preliminarily whether any conviction disqualifies the applicant from employment.

In 2012, the Equal Employment Opportunity Commission (EEOC) published guidance effectively requiring that employers, in most cases, make an individualized assessment rather than apply blanket rules such as “We do not hire felons for any position.” 

As part of the individualized assessment, the EEOC guidance calls for employers to consider:

  • The nature and gravity of the offense or conduct.

  • The time that has passed since the offense, conduct and/or completion of any sentence.

  • The nature of the job the candidate is seeking.

While the EEOC guidance is subject to challenge, its principles minimize an employer’s exposure to adverse impact claims. Moreover, an increasing number of state and local jurisdictions are requiring a holistic approach to conducting background checks. 

For example, New York state requires that an employer consider eight enumerated factors. New York City goes further and requires that the employer provide rejected applicants with its analysis of how it applied the eight factors.

Of course, there are exceptions to individualized assessments. For example, securities laws bar applicants with certain convictions from performing certain jobs. Also, most, if not all, states have laws to protect children from sexual and other forms of abuse. These laws generally prevent employers from hiring applicants with certain convictions to perform jobs in which they may have unsupervised interaction with children.

Pre-Adverse Action Notice

If the employer has concluded that a conviction disqualifies an applicant from a particular job, that decision must be preliminary and not final. 

The next step under the FCRA is to provide the applicant with a pre-adverse action notice.

Under the FCRA, the applicant must be given the opportunity to dispute the veracity of any report used to disqualify him or her. Employers are well-advised to go one step further and ask the applicant if there’s any other information that he or she thinks the employer should consider, even if the report is accurate. 

This helps demonstrate that an individualized assessment was conducted as set forth in the EEOC guidance. It’s also consistent with the individualized assessment process required by many state and local laws.

Employers must attach to the pre-adverse action notice a summary of the applicant’s rights under federal law. Some states, such as New Jersey, have an additional notice, and there are special rules that apply in California. 

Just as the employer should document its preliminary determination, the employer should document the reasoning underlying its decision with regard to any information that the applicant provides. 

Adverse Action 

The final step is to issue an adverse action letter under the FCRA, which generally requires the employer to do the following:

  • State that the decision to reject was based on a report by the CRA.
  • Make clear that the CRA did not make the employment decision.
  • Provide the applicant with information about contacting the CRA.

Don’t forget to check state or local laws, because they may require additional language—such as telling applicants that they can appeal to the state—in the adverse action letter.  

Jonathan A. Segal is a partner at Duane Morris in Philadelphia and a SHRM columnist. Follow him on Twitter @Jonathan_HR_Law.

Illustration by Adam Niklewicz.


​An organization run by AI is not a futuristic concept. Such technology is already a part of many workplaces and will continue to shape the labor market and HR. Here's how employers and employees can successfully manage generative AI and other AI-powered systems.