ASASO™ step 8 of 10: Background check

Verify before you decide

You have analysed the role, advertised it, actively searched for candidates, screened applicants, used relevant digital tools, conducted interviews and perhaps also run an assessment centre. By now, you have gathered a significant amount of information about the candidate. You may even be fairly certain who you want to hire. This is precisely where it becomes easy to make a mistake: you stop investigating and start confirming what you already believe.

Step 8 of ASASO™ is the background check. This does not mean looking for something wrong with the candidate. It means verifying key information, investigating discrepancies, obtaining relevant new information and reducing uncertainty before making a decision that both the organisation and the candidate may have to live with for years.

It may sound obvious. Yet organisations spend significant amounts of money and countless working hours on recruitment, only to offer someone a job without verifying whether important information is actually correct. When you stop and think about it, that is difficult to justify. The greater the responsibility, access and potential impact of the role, the harder it becomes to defend.

A background check can never guarantee that you have selected the right person. But it may be the step that uncovers information you should have known before the employment contract was signed.

A background check is about more than verifying a CV

Within ASASO™, we use background check as a broad term. Reference checking is part of this step rather than a separate activity alongside it. Other organisations and methodologies may define the terminology differently, but within ASASO™ the background check covers the part of the selection process where we verify important information already obtained and, where relevant, seek additional information that may affect our assessment.

The starting point is simple: Is the information provided by the candidate accurate? Are there discrepancies between different sources? Is there anything we should investigate further? Can former managers, colleagues or other relevant references tell us something about actual performance and events that we have not been able to establish through interviews or other methods? Is there documentation, information from public sources or other evidence that strengthens or challenges the assessment we have already made?

A good background check can produce both positive and negative findings. Perhaps the candidate actually held greater responsibility than they managed to communicate during the interview. Perhaps a former manager describes achievements that make the candidate even more attractive. Perhaps education, licences, certifications and employment history are confirmed exactly as stated. That is also valuable information. The purpose is not to catch someone out. The purpose is to know more before you decide.

This is also why there is no single standard background check that should be conducted in exactly the same way for every candidate. You cannot investigate everything about a person, and you should not try to. You have to prioritise.

Start with the role, not the candidate

The first question should therefore not be: “What can we find out about this person?” It should be: “What do we actually need to know in order to assess the risk of hiring this person into this particular role?”

This brings us back to the analysis in Step 1. What will the person actually do? What assets will they have access to? What authority comes with the position? Can they transfer money, enter into contracts, access business-critical systems, employee data, technical solutions, customer information or other sensitive data? Will they manage others? Represent the organisation externally? Work alone? Have access to restricted areas? Does the role require specific licences, certifications, formal approvals or security clearance?

The answers should determine the depth of the background check.

An employee with no financial authority and limited access to sensitive information will not normally require the same level of checking as a CFO, security director or senior executive. Someone working with critical infrastructure, technology, children, healthcare, substantial financial assets or highly sensitive information may require a considerably more extensive process.

This risk-based principle is widely applicable across industries and jurisdictions. The higher the level of responsibility, access and potential consequence, the stronger the case for more extensive verification. A relatively low-risk role may require confirmation of key qualifications and recent employment history. A senior or highly sensitive role may justify verification of a longer employment history, qualifications, business interests, public information and other relevant factors, where this is lawful.

The point is not that every organisation should use the same checklist. The scope should follow the risk.

What can a background check include?

Depending on the role, it may be relevant to verify identity, education, employment history, job titles, dates of employment, certificates, professional licences, formal approvals, directorships and business interests. References will normally form part of the process. For certain positions, open-source information, media searches, financial information or legally permitted criminal-record checks may also be relevant. International employment and education may require additional document verification or assistance from organisations specialising in cross-border background checks.

TEAM NORSO normally focuses first and foremost on factors that are relevant to the candidate’s ability to perform the role. Where a more extensive verification of documents, employment history or other information is required, we agree the scope with the hiring organisation and may use specialist external providers that conduct background checks as a dedicated service.

The important question is therefore not how much information you are able to collect. It is whether you are collecting the right information.

Data-protection principles are built around the same idea. Personal information should have a clear and legitimate purpose, and the information collected should be relevant and limited to what is necessary. Candidates should also receive appropriate information about how their personal data is processed, their rights must be respected, and information should not be retained longer than there is a lawful reason to keep it. In Europe, these principles are embedded in the GDPR, while other jurisdictions have their own privacy and employment legislation.

The fact that information is publicly available on the internet does not automatically mean that an employer needs to collect it, store it or use it when assessing a candidate.

Open sources are part of the reality

Some people become uncomfortable as soon as open sources and internet searches are mentioned. There is no reason to avoid them altogether, but they should be used with respect for both the method and the candidate’s privacy.

The internet, public registers, media archives, professional networks and other open sources may contain relevant information. Using open sources can be entirely appropriate when there is a legitimate and role-related reason for doing so. The problem begins when searching becomes random, unlimited and disconnected from a defined purpose.

Our backgrounds in policing, security and investigative work have influenced how we at TEAM NORSO approach this. A finding is not automatically a conclusion. Information must be assessed, compared with other information and, when necessary, verified.

Imagine finding an old newspaper article, a social-media post or an entry in a public register that initially appears serious. The wrong response is to react immediately and allow that first impression to determine the candidate’s future. Who produced the information? When was it published? What was the context? Have you identified the correct person? Is there more recent information? Could the information be inaccurate? And, importantly, what does the candidate say?

Investigate. Do not prejudge.

A discrepancy is not the same as a lie

This distinction matters.

People make mistakes. A month may be wrong on a CV. A job title may have been translated or simplified. A candidate may remember a year incorrectly or use a description of their responsibilities that does not perfectly match the formal title used in a previous employer’s HR system. That does not automatically mean they intended to mislead you.

It is very different when information has deliberately been fabricated, concealed or altered in order to create an impression the candidate knows is false.

The intention behind the discrepancy and its significance are what matter.

If a candidate describes themselves as a “Sales Manager”, while their formal title turns out to have been “Senior Sales Executive”, you should investigate what they actually did. Perhaps they led the sales function without having formal line-management responsibility. Perhaps the organisation used informal titles. There may be a perfectly reasonable explanation. But if the candidate deliberately invented leadership experience that never existed in order to satisfy a mandatory requirement for the role, that is something else entirely.

The same applies to education. There is a significant difference between entering the wrong completion month for a degree and claiming to hold a qualification that was never completed.

Technology has also made document falsification easier. Fraudulent qualifications, fabricated certificates and manipulated employment documentation are not hypothetical problems. They occur across countries and industries.

That is why a professional-looking PDF should never automatically be treated as verification.

When the documents matter, verify them

For some roles, document verification matters far more than for others. If a position requires a specific professional licence, certification, security clearance or regulatory approval, that requirement should be treated as exactly that: a requirement. It should not be assumed to be in order simply because the candidate says so.

This is particularly important in regulated professions. Healthcare, aviation, financial services, security, engineering and other industries may require specific licences or approvals before an individual can legally or safely perform certain duties. Relevant regulators and professional registers should be used where appropriate and permitted.

The same principle applies across industries. If a qualification, approval, certification or licence is essential to the candidate’s ability to perform the job lawfully or safely, do not guess.

Verify it.

References are witnesses to previous performance

Reference checking is a central part of the background check within ASASO™. A good reference has observed the candidate working over time. They may have seen results, behaviour, collaboration, responses to adversity, decision-making, mistakes, development and performance in a way that you can never fully reproduce during a few hours of interviews.

Yet many reference conversations are still conducted as though they were merely a formality.

“Were you happy with her?”

Yes.

“Would you hire him again?”

Yes.

“Is there anything we should know?”

No.

You often get exactly the answers those questions deserve.

The reference check should be based on the role analysis and the information already gathered. If a candidate says she turned around a team that had serious collaboration problems, you can explore that specific claim with someone who was actually there. What was the situation before she took responsibility? What did she actually do? What changed? What was her contribution, and what was the result of other factors? If a candidate says he performs particularly well under significant pressure, ask the reference to describe a specific period when the pressure was genuinely high.

That moves the conversation from general descriptions to observable events.

A reference is not an objective truth either. References have their own experiences, preferences, relationships, hidden agendas and limitations. But used properly, a reference is a witness who can add information to the overall decision-making process.

Do not turn the background check into a random search for information

One of the most common weaknesses we see is not necessarily that organisations do too little. Sometimes they do quite a lot, but without a plan.

One manager Googles the candidate. Another calls someone they happen to know who once worked at the same company. HR looks at LinkedIn. Someone discovers an old Facebook post. One reference is asked a completely different set of questions from another. Nobody has decided in advance what they are actually trying to establish.

Randomness quickly becomes a selection method, and it is a poor one.

The background check should therefore be planned in the same way as the rest of the recruitment process. What are we trying to verify? Why is it relevant to the role? Which sources can provide credible information? What will we do if we identify a discrepancy? Who will assess the information?

This requires competence. Collecting information is often easy. Knowing which information matters, how it should be verified and how much weight it should carry is much more difficult.

The candidate must be given the opportunity to explain

If the background check identifies something that may affect the hiring decision, the candidate should be given an opportunity to explain it.

That is not only fair. It improves the quality of the decision.

Imagine a candidate who says she left a previous employer voluntarily. During a reference conversation, you gain the impression that her departure was far more contentious. That is relevant information, but you still only know one version of events. Perhaps the reference is correct. Perhaps the candidate has left out something important. But perhaps the conflict was much more complicated than the reference suggests, or documentation exists that changes your understanding of what happened.

You do not know until you investigate.

This is a fundamental principle of good investigative work: alternative explanations should be tested. You are not trying to prove the first theory presented to you. You are trying to establish which explanation is best supported by the available information.

That is also why a proper background check requires more than curiosity and some spare time.

Security must be part of recruitment

Background checks are not only an HR issue. They are also about security and organisational resilience.

Every organisation has assets that can be damaged. For some, the potential consequences are moderate. For others, a poor hiring decision may provide someone with access to substantial financial assets, personal data, trade secrets, technical systems, production facilities, critical infrastructure or information that could be used against the organisation.

Insider risk is not limited to defence, law enforcement or intelligence organisations. An insider may copy information, disclose customer data, abuse access privileges, interfere with systems, commit financial crime or otherwise damage the organisation. The level of risk varies dramatically between roles and organisations, but the underlying principle is broadly applicable: when you hire someone, you also give that person trust and access.

Security should therefore already be part of the job analysis. What will this person gain access to if we hire them? What could go wrong? How serious could the consequences be? And are there relevant factors that we can reasonably and lawfully verify before that access is granted?

The greater the potential consequence, the stronger the argument for a thorough background check.

International backgrounds require their own risk assessment

International candidates are essential to many organisations, and having an international background is not in itself a risk factor. However, geopolitical exposure, sanctions, regulatory requirements or links to particular jurisdictions may be relevant for certain sensitive roles. More generally, verification itself can become more difficult when education, employment history, documents and references span multiple countries and systems.

Educational institutions may be difficult to contact. Document standards vary. Companies may have ceased trading. References may be difficult to identify. Differences in language, naming conventions and public registers can make verification more challenging. The reliability and accessibility of records also varies considerably between countries.

The answer is not to jump to conclusions. The answer is to assess the verification risk and, when necessary, seek support from specialists who understand the relevant countries, sources and methods better than you do.

A good background check is therefore as much about understanding the limitations of your own investigation as it is about finding information.

Criminal-record checks cannot simply become a standard requirement

Criminal-record checks are a good example of why background checking requires both professional judgement and an understanding of the applicable law.

Rules vary significantly between countries and jurisdictions. In many places, employers cannot simply require every candidate to provide a criminal-record certificate because they consider it useful. The check may need to be specifically permitted by law, justified by the nature of the role, or conducted under defined regulatory conditions.

For positions where legislation requires or permits criminal-record screening, it should of course be incorporated properly into the recruitment process.

The principle remains the same: relevance and legal basis first, collection of information second.

Credit checks are not a standard control either

Personal finances can be highly sensitive, and credit checks should not be treated as a routine part of every recruitment process.

Depending on the jurisdiction, a credit check may be lawful and relevant for certain senior positions involving significant financial authority, access to company funds or similar responsibilities. In many jurisdictions, its use is restricted and must be closely connected to the requirements and risks of the specific position.

A CFO with extensive financial authority and an employee with no financial responsibility simply do not represent the same risk profile.

Background checks should be targeted, not as extensive as possible.

Why is this done so late in the process?

There is a reason background checking is Step 8 of 10 in ASASO™.

A thorough background check can be intrusive. It may involve contacting other people, verifying documents and processing personal information. You should therefore not normally conduct extensive background checks on a large number of people simply because they applied for a position.

The check should be limited to as few candidates as reasonably possible.

The exact timing and scope must be assessed from one recruitment process to another. Certain qualifications or absolute requirements should naturally be verified earlier because there is little value in taking a candidate through a long selection process if they lack a mandatory requirement. Other checks are more appropriately carried out when you are left with one or a small number of final candidates.

Good selection is not about obtaining as much information as possible. It is also about treating candidates properly.

Transparency and privacy must be balanced against the purpose of the check

Candidates should know that their personal information is being processed and receive appropriate information about how the background check is being conducted. In Europe, this follows from core GDPR principles of transparency and data protection, and comparable obligations exist in many other jurisdictions.

At the same time, the process should not be structured in a way that allows the candidate to control every source or influence the verification process so extensively that it loses its value. This requires planning. What checks the organisation may legally perform, what information may be collected and what legal basis applies must be considered in the relevant jurisdiction.

There may also be circumstances where an organisation conducts checks beyond documents and references supplied directly by the candidate. Depending on the jurisdiction and the nature of the information, this may for example rely on legitimate interests or another lawful basis under applicable data-protection legislation.

This illustrates why organisations need a deliberate system for background checking rather than leaving individual managers to improvise.

Privacy and security are not opposites. Both require control over information.

An example: The information that did not quite fit

Imagine an organisation recruiting a leader who will be responsible for employees, finances and access to sensitive information. The candidate performs extremely well in the interview. Their assessment-centre results are strong. Their CV is impressive, and both the leadership team and the recruitment adviser have formed a positive impression.

During the background check, previous roles and references are reviewed.

Two references confirm much of the picture presented by the candidate. But one piece of information does not quite fit. The candidate has described having significant responsibility for business results in a previous position, while a former manager describes that responsibility as much more limited.

It would be easy to conclude that the candidate had exaggerated their CV.

Instead, the discrepancy is investigated.

The candidate explains that their responsibilities expanded considerably during the role without the formal job title being changed. Another person from the same organisation confirms this and can describe the authority the candidate actually held. Documentation from the period supports the explanation.

The discrepancy was real. But so was the explanation.

Now imagine that the investigation had instead shown that the responsibility never existed, that the candidate had repeatedly made the same false representation, and that this experience was precisely what made the candidate appear qualified for the new leadership role.

The finding would have a very different significance.

That is what good background work is about. Not merely identifying discrepancies, but understanding them.

A background check is never a guarantee

You can conduct an extremely thorough background check and still hire the wrong person.

You can speak to five references without anyone mentioning the problem that emerges a year later. You can verify every educational certificate without learning anything about how the candidate will handle a difficult employee. You can check financial information, employment history, licences and public sources without being able to predict every future action.

No findings does not mean no risk.

The background check is one part of the overall decision-making process. Its value lies in reducing uncertainty and identifying factors that other methods may not capture.

That is exactly how ASASO™ is designed. No single method and no single step should carry the entire hiring decision.

Someone is still responsible

Background checks can be outsourced to specialist providers. There are organisations that conduct these checks every day, using established tools, relevant sources and specialised expertise. In many cases, they can perform certain checks both faster and more effectively than an organisation that only does this occasionally.

You can outsource tasks. You cannot outsource responsibility.

HR can organise the process. The recruitment adviser can conduct interviews and reference checks. An external provider can verify documents. A security adviser can assess risk. Several people may contribute their professional judgement.

Ultimately, however, there is still a leader responsible for the decision.

If it later turns out that the organisation hired someone into a critical position without verifying an obvious requirement, saying that you thought someone else had checked it is not much of a defence.

That is why organisations need a process.

Background checking is simply good recruitment practice

We rarely uncover serious problems during background checks. That is not an argument for skipping them.

Hopefully, the fire alarm in your office never goes off. That does not make it unnecessary.

The greater the potential consequence of getting the decision wrong, the more valuable verification becomes. For some roles, this may mainly involve confirming employment history and conducting thorough reference conversations. For others, it may require document verification, professional licences, open-source research, security assessments and specialist external assistance.

The essential point is that the check is planned, relevant and proportionate.

Next step: Contract

Once the background check has been completed, discrepancies have been investigated, necessary qualifications and information have been verified, and the candidate is still the person you want to hire, the basis for the decision is becoming complete.

ASASO™ then moves on to Step 9 of 10: Contract.

Only when you have done what can reasonably be expected to understand who you are about to hire is it time to formalise the decision.

English editorial adaptation of the Norwegian original.