ISO27001:2022 – A6.1 – Screening

What does ISO 27001 – A6.1 require?

There are a few points to highlight here.

Before they join

Background checks can include;

• Right to work in your country

• Disclosure and Barring Service (DBS) checks for criminal records, which will show unspent convictions and other details depending on the level of check

• Professional references and certifications for professions such as law, medical and teaching

• Personal references which are more traditional requests for comment from previous employers

• Credit checks for those people working in finance roles, e.g. Finance directors or accounts

• Media, including Social Media, to discover if there are any negative aspects that surface online or in the press

Dependent upon your industry, some or all of the above will be relevant. But you may also have additional background checks that you need to carry out.

If you’re wondering if it’s ok to include social media background checks in this list, then the answer is yes you should.  After all, you wouldn’t bring in a Consultant without checking out some reviews online, so why should it be any different when hiring someone?

Now they are in the team

One aspect of this ISO27001 control which many people miss, is that background checks should be carried out on an ongoing basis.  This can be onerous, so keep in mind that all checks should be proportionate to the business requirements, the classification of the information to be accessed and the perceived risks.  Therefore you may decide that these kinds of checks don’t need to be conducted on everyone, but you might carry out checks on those in key roles (such as financial controllers or directors).  

For professions where professional qualifications must be maintained, such as the legal sector, then annual review of professional qualifications is a must and is more than acceptable. 

Again, the topic of social media and reviewing online activities of your team may feel invasive, but its standard practice for most organisations.. 

Why is this required?

Hiring people is expensive, and you want to make sure you’re hiring the right person for the role. But you need to make sure the claims they’re making on their CV are accurate.  Unfortunately people aren’t always honest, and they may tell you a few ‘white lies’, or all-out-whoppers on their CV. What you need to check is that the person is suitable for the role you’re hiring for, and find out before they start. 

At the basic, foundational level you need to know that the person you’re hiring is eligible to work in your country, as that is a legal requirement. For example, you can’t hire underage people, and this is especially relevant for the hospitality industry where they might be handling alcohol. 

 

Hiring the wrong kind of people because you didn’t perform background checks can land you in court, and see your business closed down. The worse case scenario, it could see you in prison! 

We have come across far too many cases where a client has hired someone, who then went on to become a ‘bad actor’ and insider threat. Yet some basic background checks on their references would have raised a few red flags that would have prevented the client hiring them, or would have raised additional questions. 

Examples of employees (including directors and shareholders) ‘going rogue’ are too numerous to list here, but to illustrate the point, we would ask you a simple question; Would you open your house up to a complete stranger, and leave them to live there without first checking their background first? We hope the answer to this is no, and if that’s the case, then why would you do the same with your business? 

What the auditor is looking for

The auditor isn’t specifically looking for a documented process, but if you have a checklist of background checks that will be performed then this is great evidence.

In the absence of any documented process, you should be able to present the following to the auditor; 

• Policies which outline the kind of screening and background checks conducted.

• Contracts of employment.

• Contractor agreements.

• References sent, received and actioned.

• Evidence that screening takes place. This could include evidence of DBS or credit checks. It could also include copies of ID and visas for eligibility of working in the country.

• Copies of qualifications and certificates.

• HR systems and files which include details of background, competency and qualifications

• 1-2-1 meetings

• Evidence of periodic reviews of background checks

What do you need to do?

Speak to your HR function and ask them about what background checks are carried out.  Hopefully they do perform some form of checks. Is there a checklist that they follow? If not, then help them create one.

Gather evidence of the background checks being done and identify any gaps in the process. For example, are requests for references followed up? If not, then why not?  Keep in mind that this needs to be proportionate, so think about the organisation and the different levels of checks that you should put in place. 

With the help of your HR function or specialist, develop a policy which outlines what background checks are carried out and ensure all staff are aware. This is important so that they know that social media may be used for periodic reviews and ongoing checks, and for those sectors that need it, up to date certificates and evidence of qualifications will be required.  This isn’t a policy you need to write alone, so make sure you engage with your HR specialist or function

.