No. SOC 2 does not give every employer one universal background-check package to buy. Your screening approach needs to fit the work and the laws that apply.
That does not mean screening can be ignored. The AICPA criteria address competent personnel. A supporting point of focus calls for considering people’s backgrounds. Your own policies and customer contracts may create more specific commitments.
Decide what the check is meant to establish
Verifying a professional qualification answers a different question from checking employment history. A criminal-record search answers another. Do not treat them as interchangeable because a vendor bundles them into one product.
Work with HR to identify the checks relevant to the role. Ask qualified legal counsel to review restrictions where the person will work. A process that is permitted in one location may not be appropriate elsewhere.
Write a process people can actually follow
- Which roles and worker groups does the policy cover?
- Which checks are required for each?
- When must they be completed?
- Who reviews incomplete or disputed results?
- Who may approve an exception, and what limits apply?
Use consistent rules for comparable situations. Do not let managers choose different checks based on personal assumptions about applicants.
If a check is delayed, record what happened. Have the responsible team decide how to handle the start date or access under the approved process. Do not mark the check complete just to close an onboarding task.
Employment law still applies
In the United States, obtaining an employment background report from a reporting company brings Fair Credit Reporting Act requirements. These include disclosure and permission steps. Using a report to make an adverse employment decision involves further procedures.
Federal nondiscrimination rules also apply. State and local rules may add restrictions. Use the FTC and EEOC guidance as a starting point with HR and counsel, not as permission to order every available check.
Keep audit evidence separate from sensitive findings
Agree with the auditor what evidence is needed to test the control. A completion record and review trail may answer part of the request without putting full reports in a widely accessible audit folder. Further inspection may still be needed.
Keep detailed screening records restricted to authorized people. A SOC 2 evidence request is not a reason to circulate someone’s personal history unnecessarily.
Sources
- AICPA Trust Services Criteria: CC1.4 and its background-related point of focus.
- FTC and EEOC: Background Checks, What Employers Need to Know.