What it asks for. Background checks on candidates should be carried out before they join and, where appropriate, during employment. Checks must respect applicable laws, regulations and ethics, and be proportionate to the business requirements, the classification of information accessed and the perceived risks.
In practice. The organisation defines screening levels by role, so that people with privileged access or access to sensitive data receive deeper checks. Typical checks include identity, right to work, references, qualifications and, where lawful, criminal record checks. In European countries the legal limits on screening vary considerably, so HR and legal agree what is permitted in each jurisdiction. Evidence includes a screening policy, role based criteria and records showing checks were completed before access was granted.
Common gaps. Contractors and staff provided by suppliers are often not screened to the same standard, with no contractual requirement on the supplier to do so. Re-screening when someone moves into a more sensitive role is rarely done.