Verified First Client Audit: Frequently Asked Questions (FAQ)

This FAQ document is designed to answer common questions about our client audit process for Disclosure and Authorization (D&A) forms and related compliance topics. Our goal is to help you understand these requirements and maintain compliant hiring practices.

1. Do we need to keep Disclosure & Authorization (D&A) forms even if we don’t hire the applicant?

Yes. It is crucial to retain signed D&A forms for all applicants on whom a background check was conducted, regardless of the hiring outcome. The D&A form provides proof that you had the applicant's consent before obtaining a background report.

While specific retention periods can vary based on federal and state laws and your internal policies, the Fair Credit Reporting Act (FCRA) has requirements, especially if any adverse action is taken based on the report. It's a best practice to maintain these forms for a reasonable period (many businesses opt for several years) to demonstrate compliance in case of any future inquiries or disputes. We recommend consulting with your legal counsel to establish a definitive retention policy that aligns with all applicable regulations.

2. Do our D&A forms need to have Verified First’s contact information?

It depends on who is conducting the background check covered by that specific D&A form:

• If Verified First is conducting the background check for the applicant: Yes, the D&A form should clearly identify Verified First as the Consumer Reporting Agency (CRA) performing the check. For applicants located in California, it is a specific requirement that our contact information is included on the forms.
• If another CRA is conducting the background check: If you are using a different background screening company for a particular applicant, then that company's information should be on the D&A form related to their check.

The principle is transparency: the applicant must be clearly informed which company will be conducting the background check and how to contact them if needed. If you are using Verified First, ensure our details are present, especially for California candidates.

3. Is it okay if we provide a D&A form that was signed/dated after the background check was ordered (the file date)?

No, this is not acceptable and would still be considered a failed audit item.

The Disclosure and Authorization form must be signed by the applicant on or before the date the background screen is ordered. Obtaining consent after the check has already been initiated does not meet legal requirements. Backdating forms is also not permissible. The purpose of the D&A form is to obtain prior consent, so the timing is critical. If a form is provided that is dated after the background check order date, we will need to educate your team on this requirement.

4. What is Verified First's Audit Process if issues are found?

Our audit process is designed to identify compliance gaps and work with you to correct them. If an audit reveals issues with your D&A forms, here’s what you can expect:

• Initial Failed Audit: If we find missing forms, forms signed after the order date, or (for California) missing Verified First contact information, we will log this as a failed audit item.
  • Missing Forms: If forms are missing, we will first reach out to request them. If this request goes unanswered within a designated timeframe, it will be logged as a fail.
  • Education & Re-audit: Our Client Management team will contact you to educate your team on the importance of the D&A requirements and help you understand any necessary changes. Your account will be scheduled for a re-audit the following month.
• Second Consecutive Failed Audit: If the audit fails again the next month, we will provide further education and advise that a third consecutive failure will lead to stricter measures, including potential portal closure for ordering. Your account will be re-audited the following month and may be subject to daily monitoring for the next three months.
• Third Consecutive Failed Audit: If an audit fails for a third consecutive month, your portal will be shut down until your Account Manager (AM) is able to discuss the critical importance and legal obligation of obtaining and providing compliant Disclosure and Authorization forms. Once your portal is reopened, your direct ordering ability will be shut down and all future orders will need to be placed using our email invitation method.  This will ensure the forms are presented and signed by the candidates electronically.  

Our goal is to help you achieve compliance. We see the audit process as an opportunity for education and improvement, ideally avoiding the escalation steps by resolving issues promptly.

5. Can we redact personal information (like SSN, DOB) when sending D&A forms to Verified First for an audit?

Yes. We understand your concern about transmitting sensitive personal information. When providing D&A forms to us for audit purposes, it is generally acceptable to redact highly sensitive information such as the applicant's Social Security Number (SSN) or full Date of Birth (DOB).

However, please ensure that the following key pieces of information remain clearly visible and legible:

• Applicant's full name
• Applicant's signature
• Date of signature
• Any other information necessary to confirm compliance with the specific audit points (e.g., Verified First's contact information if applicable for CA candidates).

The primary purpose of our audit is to verify that a compliant disclosure was made and proper authorization was obtained in a timely manner.

6. Is it okay for us to use our own company's Disclosure & Authorization forms?

Yes, you can generally use your own D&A forms, provided they are fully compliant with all applicable laws. This includes the federal Fair Credit Reporting Act (FCRA) and any relevant state or local laws (e.g., specific requirements for California, New York, etc.).

If you choose to use your own forms, they should, at a minimum:

• Clearly state that a background check (consumer report and/or investigative consumer report) may be obtained for employment purposes.
• Be a standalone document, separate from the employment application (this is an FCRA requirement).
• Identify the types of information that may be collected.
• Include a clear and conspicuous authorization from the applicant for you to obtain the report.
• If Verified First is conducting the check, our name (and contact information for CA applicants) should be included.
• Include any specific notices or checkboxes required by state or local laws where your applicants reside or work.

Why forms might "fail" an audit:

• Missing applicant signature or date.
• Signature date is after the background check order date.
• Disclosure is not a standalone document.
• Required state-specific language or checkboxes are missing.
• Verified First's information is missing (when we are the CRA, especially for CA).

We strongly recommend having your company's D&A forms reviewed by your legal counsel to ensure they meet all current legal standards. While we can provide guidance on common requirements during an audit, we cannot provide legal advice or definitively approve client-created forms outside of an audit context.

7. What is the difference between "Disclosure" and "Authorization" in the context of D&A forms?

Understanding the distinction between these two terms is key to compliance:

• Disclosure: This refers to the act of informing the applicant, clearly and conspicuously in a written document (that consists solely of the disclosure), that you intend to obtain a background check (consumer report) on them for employment purposes. The disclosure document must tell the applicant what a background check entails and that the information gathered can be used in hiring decisions.
• Authorization: This refers to the applicant's consent or permission, given in writing, allowing you to procure the background check. By signing the authorization, the applicant confirms they have received the disclosure, understand it, and agree to the background check being performed.

In practice, the "Disclosure" and "Authorization" are often part of the same D&A form, but the FCRA has specific requirements for how the disclosure is presented (e.g., as a standalone document). Both elements are mandatory before you can order a background check through Verified First or any other CRA.

We hope this FAQ has been helpful. If you have further questions, please don't hesitate to reach out to your Client Service representative.