Background Check Policy HR Guide: Build It From Scratch
Every HR manager knows background checks matter — but having a background check policy that is documented, consistent, and actually followed across the organization is a different thing entirely. Many companies screen candidates informally, with no written standard for what gets checked, when, or how results are handled. That inconsistency is a risk in itself.
This guide walks you through exactly how to build a background check policy from scratch — practical, clear, and built for the realities of hiring in the Philippines.
Why a Written Policy Matters
Before diving into the components, it's worth understanding why a formal policy is worth the effort.
Without one, background checks become a judgment call — different hiring managers run different checks, some roles get screened thoroughly while others slip through with minimal verification, and when something goes wrong, there's no documented process to point to.
A written policy creates:
- Consistency — every candidate for a given role type is treated the same way
- Legal protection — you can demonstrate due diligence if a hiring decision is ever challenged
- Accountability — HR, hiring managers, and leadership all operate from the same standard
- Candidate trust — a clear, communicated policy is fairer to candidates than an ad hoc process
It doesn't need to be lengthy. It needs to be clear, complete, and followed.
Step 1: Define the Scope of Your Policy
Start by answering: who does this policy apply to?
For most organizations, that includes:
- All full-time permanent employees
- Contractual and project-based hires (especially those with access to sensitive data or client-facing responsibilities)
- Third-party contractors and agency workers embedded in your operations
- Rehires — even former employees should be re-screened after a gap
Be explicit about who is included and who, if anyone, is excluded — and document the reasoning. A policy that only covers some of your workforce creates blind spots.
Step 2: Create Role Tiers Based on Risk
Not every role carries the same risk profile, and your screening depth should reflect that. A tiered approach is the most practical way to scale your policy.
- Tier 1 — Standard Roles Entry-level or non-sensitive positions with limited access to data, assets, or vulnerable populations.
Recommended checks: Identity verification, basic employment history, education verification
- Tier 2 — Mid-Level or Access Roles Roles that involve access to financial systems, client data, or team management responsibilities.
Recommended checks: All Tier 1 checks, plus civil and criminal background check, extended employment history verification
- Tier 3 — Senior, Executive, or High-Trust Roles C-suite, senior management, finance, legal, or roles with significant fiduciary responsibility.
Recommended checks: All Tier 2 checks, plus PEP screening, negative media check, professional license verification
Document which roles fall into which tier — and make sure hiring managers understand the structure before they start a search.
Step 3: Set the Timing
Your policy should specify exactly when background checks are initiated. The two most common approaches are:
- Post-shortlist, pre-offer: Background checks run after a candidate clears final interviews but before a formal offer is extended. This gives HR the full picture before committing.
- Post-offer, pre-start: The offer is extended conditionally, with background check clearance as a stated requirement before the start date is confirmed.
Both approaches are valid — but your policy should commit to one and apply it consistently. The worst outcome is a policy that leaves timing up to individual hiring managers, which leads to checks being initiated (or skipped) at different points depending on who's running the hire.
Step 4: Define What Gets Checked and By Whom
Your policy should list the specific checks run at each tier and name the platform or process used to conduct them. Vague policies ("conduct appropriate background verification") are difficult to enforce and easy to shortcut.
Be specific:
- Identity verification via government-issued ID cross-check
- Employment history confirmed directly with previous employers or through a verified platform
- Education confirmed with issuing institutions or through an accredited verification process
- Criminal and civil records checked through appropriate government platforms and registries
- PEP and negative media screening for Tier 3 roles
Using a dedicated platform like Smile Checks removes ambiguity — the checks are standardized, documented, and run consistently regardless of which HR team member is managing the hire.
Step 5: Address Data Privacy
In the Philippines, the Data Privacy Act requires that personal data collected during recruitment — including background check information — is handled responsibly. Your policy should include:
- Consent — candidates must be informed that a background check will be conducted and must provide written consent before the process begins
- Data minimization — only collect information that is relevant and necessary for the role
- Access control — background check results should be accessible only to those who need them (HR lead, hiring manager, relevant compliance officer)
- Retention limits — define how long screening records are kept and when they are securely disposed of
- Security — results should be stored in a secure, access-controlled system — not in shared drives or email inboxes
This section of your policy protects both the candidate and the organization.
Step 6: Create a Results Handling Protocol
What happens when a background check comes back with a flag? Your policy needs a clear answer before that situation arises — not during it.
A results handling protocol should cover:
- Clean results: Straightforward — document the clearance, confirm the start date, file the record.
- Minor discrepancies: A date that doesn't match, a job title that differs slightly. Give the candidate an opportunity to explain. Document the explanation and your decision.
- Significant findings: A material misrepresentation, an undisclosed criminal record relevant to the role, a falsified credential. Define who makes the final call (HR lead, legal counsel, senior management), what the decision criteria are, and how the outcome is communicated to the candidate.
Consistency in how you handle results is just as important as consistency in running the checks. An ad hoc approach to adverse findings creates legal and ethical exposure.
Step 7: Get Leadership Buy-In and Communicate the Policy
A background check policy only works if it's actually used. That means:
- Getting formal sign-off from HR leadership and, where applicable, legal and compliance
- Briefing hiring managers on the policy before they start a new search
- Including the policy in your HR operations manual and onboarding documentation for new HR team members
- Communicating clearly to candidates — at the point of application or offer — that background verification is a standard part of your hiring process
Transparency with candidates isn't just good practice. It's a requirement under data privacy regulations.
The Platform That Makes Your Policy Operational
A well-written policy is only as good as the process behind it. Smile Checks gives HR teams the infrastructure to run background checks consistently, document results securely, and demonstrate compliance — all without the manual burden of chasing records across multiple channels.
Your policy sets the standard. Smile Checks makes sure it's followed, every time. Start building your process at getsmilechecks.com.