Most employers think a background check is a search. It is not. It is a regulated process with a defined sequence, and the legal exposure sits almost entirely in the steps around the search rather than in the search itself. Employers who get sued over background checks are rarely sued because the report was wrong. They are sued because of what they did before requesting it and what they failed to do after reading it.
The process, in the order the law requires
When a third party compiles a report for employment purposes, that report is a consumer report and the Fair Credit Reporting Act applies. The Federal Trade Commission’s guidance on using consumer reports sets out what an employer must do.
Before the report is requested
Disclosure. The applicant or employee must be told, in writing and in a stand-alone document, that a consumer report might be used for employment decisions. Stand-alone means exactly that. Burying the disclosure inside an application form or a block of other terms is the single most common defect, and it has generated a great deal of litigation.
Authorisation. Written permission is required. This may be combined with the disclosure.
Certification. The employer certifies to the screening company that the person was notified and authorised it, that FCRA requirements have been met, and that the information will not be used to discriminate or otherwise misused.
If the report is going to cost someone the job
This is where employers most often fail, and it is a two-stage process.
Pre-adverse action. Before rejecting an application, terminating, reassigning or denying a promotion on the basis of the report, the employer must give the person a copy of the report relied on and a copy of the Summary of Your Rights Under the Fair Credit Reporting Act. The purpose is to let the person see it and challenge anything inaccurate before the decision takes effect.
Sending both notices on the same day defeats that purpose and is treated accordingly.
Post-adverse action. After the decision, the employer gives notice — oral, written or electronic — containing the screening company’s name, address and telephone number; a statement that the company supplying the report did not make the decision and cannot explain it; and notice of the right to dispute the accuracy of the information and to obtain a free report within sixty days.
Afterwards
The report and information taken from it must be securely disposed of — burning, pulverising or shredding paper, and rendering electronic data unreadable and unreconstructable. Keeping a stack of old reports in an unlocked drawer is its own violation.
Where Arizona adds requirements
For security work specifically, Arizona sets statutory disqualifiers on top of anything an employer chooses to screen for. A.R.S. § 32-2622 requires an applicant for a security guard registration certificate to be at least eighteen, a citizen or legal resident authorised to work, and not convicted of any felony or currently under indictment for one.
It then applies a five-year window to misdemeanours of particular kinds — personal violence or threats of it, misconduct involving a deadly weapon, dishonesty or fraud, arson, theft, domestic violence, sexual misconduct, and certain other offences. An applicant may not be on parole, community supervision, work furlough, home arrest or any other release, nor named in an outstanding warrant, nor serving probation for a violence or domestic violence conviction. Registered sex offenders are excluded.
For an armed registration the statute adds more: the applicant must meet all of the above, complete the background screening and training requirements, not be a prohibited possessor under Arizona law or federal law, not have been discharged from the armed services under other than honourable conditions, and not have a domestic violence conviction.
That is a materially higher bar than a general employment screen, and it is a statutory bar rather than a matter of employer discretion.
What a background check does not tell you
Buyers routinely over-read a clean report.
- Criminal records are county-level and jurisdictionally bounded. A national database search is a pointer, not a source of truth. Records are confirmed at the court that holds them, and someone who lived in four states has four sets of counties worth checking.
- Arrests are not convictions. Using arrest records that did not lead to conviction carries meaningful legal risk.
- Sealed, expunged and set-aside records will not appear, by design.
- Nothing that never reached a court appears at all. Conduct that led to a quiet resignation, a settled civil claim or an internal finding leaves no criminal record. For senior or sensitive roles this is frequently the material that matters, and it is found through reference and reputational enquiry, not through a database.
- Identity matching is imperfect. Common names generate both false positives and false negatives. Date of birth and address history are what make a match reliable.
How to run this well
Decide in advance what is disqualifying for each role and write it down, so that the decision is applied consistently rather than case by case. Match the depth of the check to the role — a driver, a person handling money and a person entering homes have genuinely different risk profiles. Use a stand-alone disclosure. Build a real gap between pre-adverse and post-adverse notice. Give people a route to dispute and actually consider what comes back. And keep the whole process documented, because the defence to a discrimination claim is a consistent, role-based standard applied the same way to everyone.
Honeybadger Solutions conducts background checks in Arizona under the process above, and will say when a database search is not the right instrument for the question being asked. Where the concern is conduct that never produced a record, that is an investigative question — see private investigations. Where a candidate’s stated history needs testing against documents, our piece on what an asset search can actually find covers the same principle from the financial side.
This is general information, not legal advice. Screening obligations vary by role, industry and jurisdiction.
Adverse action: the step that creates the lawsuits
Most FCRA litigation against employers does not come from running the check — it comes from what happens after a report contains something unwelcome. The Fair Credit Reporting Act requires a specific two-step sequence before you can reject a candidate based on a report. First, a pre-adverse action notice: you give the applicant a copy of the report and the federal “A Summary of Your Rights Under the FCRA” document, and you wait a reasonable period — commonly treated as around five business days — so they can dispute an error before it costs them the job. Only then may you send the adverse action notice finalising the decision, with the details of the reporting agency and a statement that the agency did not make the decision. Employers who collapse those two steps into one, or who skip the copy of the report, are the ones who end up in class actions. The disclosure at the start of the process carries the same trap: it must be a clear, standalone document, not a clause buried in the job application. Getting the paperwork right is not bureaucracy — it is the difference between a defensible hiring decision and a statutory-damages claim.
Frequently asked questions
What is the FCRA?
The Fair Credit Reporting Act is the federal law that governs how “consumer reports” — including most employment background checks — are obtained and used. It sets rules for disclosure, written consent, permissible purpose, and the adverse-action process, and it is enforced by the FTC and CFPB.
Do I need written consent to run a background check?
Yes. For an FCRA-covered employment check you must provide a clear, standalone written disclosure and obtain the applicant’s written authorization before you request the report. Consent buried inside the job application does not meet the standard and is a common source of liability.
How far back can a background check go?
Federal law limits the reporting of certain non-conviction items — arrests that didn’t lead to conviction, civil judgments, and similar — to seven years, with exceptions for higher-salary roles. Convictions can generally be reported longer under federal law, though some states impose their own limits. The right lookback depends on the role and the jurisdiction.
What is the difference between a background check and a background investigation?
A background check confirms specific records against a fixed question under FCRA rules. A background investigation is broader intelligence work — interpreting public records, corporate data, and open sources to reveal affiliations and risk a records check alone would miss. For hiring you often want the first; for vetting a partner or executive, the second.
What is adverse action under the FCRA?
Adverse action is denying employment (or promotion) based wholly or partly on a consumer report. The FCRA requires a pre-adverse action notice with a copy of the report and a summary of rights, a waiting period, and then a final adverse action notice — in that order.
Run background checks that hold up
Whether you need FCRA-compliant employment screening or a deeper look at a partner, executive, or counterparty, the process has to be lawful and documented. See our background checks, open-source intelligence, and due diligence services. Honeybadger Solutions is a veteran-owned, Arizona-licensed firm — request a consultation.