The most important tool a hiring manager can use to identify and deliver the best employees is a background check. Such a check may include information from multiple sources, including credit reports, employment verifications and criminal record searches. Most employers use a vendor to access this information, but there are some who engage in these searches and verifications themselves.

When an employer uses these third-party vendors to obtain and provide the information, the entire process — including access to non-credit information — is subject to the federal Fair Credit Reporting Act (FCRA). Those vendors are generally known as consumer reporting agencies. It is critical that an employer use a reputable organization and verify for itself that both its company and its chosen consumer reporting agency are in compliance with the FCRA.

Attacks on multiple fronts

While the rules that govern a potential employer’s access to a candidate’s background through these resources are not new and have always been strict and specific, recent attacks on multiple fronts have left the business community confused and concerned about its ability to gather the information necessary to make sound hiring decisions.

The Equal Employment Opportunity Commission (EEOC) and other governmental agencies sharpened their focus principally on an employer’s access to an applicant’s criminal background, and whether it is appropriate to use criminal history to make a decision about future conduct.

Class action lawyers, on the other hand, usually attack the process and attempt to catch employers in compliance failures, which are often inadvertent and harmless, but can have costly consequences. Thus, it is more critical than ever for employers to know the rules and how to navigate them.

The FCRA adverse action process

As a reminder, the FCRA requires an employer that intends to use a background check in a hiring decision (or any employment-related decision) to follow specific steps. The failure to comply risks exposure to monetary penalties in private lawsuits that can include punitive damages.

Related: Employee retention in ashes on burnout for 2017

Most employers are aware that the FCRA requires disclosure to anyone for whom a background check is sought, and requires that employers obtain authorization from that applicant before the report is acquired. But many fail to provide the notices and authorization in a form that the FCRA approves. These often harmless failures can lead to class actions when they are systemic and built into the hiring process. Thus, all employers should audit their forms regularly to ensure they are in compliance.

More often, employers fall victim to the FCRA’s adverse action process. The FCRA requires two separate steps before an employer can refuse to hire an applicant (or take any other adverse action against an existing employee if the background check was sought for a promotion decision or some other purpose).

The first requires the employer to provide a pre-adverse action notice stating that the FCRA will provide the candidate an opportunity to learn that something uncovered in the background check may impact his or her application for employment. This notice must include a copy of the report and Summary of Rights under the FCRA. A failure to provide the pre-adverse action notice and attached documents can lead to exposure in a lawsuit even if the reason for the decision not to hire based on the background check is perfectly sound.

The second step in the adverse action process requires an employer to provide notice of the adverse action once the decision has been made. This two-step process should illustrate that the FCRA is designed so that employers will not make a snap decision on the information received but will, instead, provide the information to the employee and then make a subsequent decision after the information has been discussed.

Obviously, this structure is not always practical or even possible. But it is nevertheless critical that an employer carefully apply the two-step approach (even where the ultimate decision is obvious from the moment the background check is first reviewed) to avoid technical compliance failures that can lead to expensive litigation.

This is particularly true because strict compliance with FCRA obligations can also shield an employer from exposure to state law defamation, privacy and negligence claims based on the reporting of the information sought in a background check, which could become important in the not-so-rare situations when a background check contains errors.

Obtaining the consumer report

But whether and how an employer may use a consumer report is a different issue from the process by which it may be obtained. An employer that properly adheres to the disclosure and authorization requirements and that complies with the two-step adverse action process has only cleared the threshold hurdles. The next step is to determine the extent to which the information can be used, and for what purpose.

Related: Stagnation drives out employees

It is in this context where the challenges begin to mount for a hiring manager. For most, the principal reason to conduct the background check in the first place is to ensure that the applicant has a character consistent with the culture in the workplace. Secondary reasons are really just subsets of the main purpose.

Because hiring to retain is so important to long-term organizational success, hiring an applicant often depends on factors that have nothing to do with the specific tasks required to perform the job.

Instead, smart hiring managers know that a skill set can be taught, but whether the applicant will work well with co-workers, will show up to work every day and on time, and is trustworthy and responsible are considerably more important in the long term than whether he or she is a talented welder. But these character questions are often a subjective decision and are, thus, more complicated.

A hiring manager knows that his or her job might be on the line for a mistake. Consider the applicant who has sexually harassed employees at a prior job or had an accident while driving drunk.

Plaintiffs’ lawyers are not afraid to argue, on one hand, that an employer violated the FCRA in gathering information to conduct a background check on an applicant — while simultaneously arguing, on the other hand, that the failure to conduct a background check was negligent when the same applicant engages in sexual harassment against a co-worker.

And while the EEOC guidelines suggest that criminal history cannot be used to reject an applicant unless the offense is specific to a job requirement (e.g., felony theft is a reasonable reason to reject a bookkeeper), the decision to hire an employee with a criminal record may have implications that go beyond the isolated hiring question and expose the employer to potential lawsuits and issues with insurers.

The good news is the FCRA does not dictate whether an employer can hire an employee based on information in the background check. As long as the information is used for a permissible purpose (like hiring) and the employer properly complies with the process for obtaining the information and disclosing the reason for the decision, the FCRA permits employers to use the information to make any decision they choose.

Related: Can hiring former prisoners be rewarding?

The EEOC guidelines and Title VII prohibit the use of the information for a discriminatory purpose. So, a hiring manager who complies with the FCRA and fairly considers each background check on its own merits based on the specific job and the unique work environment to which the applicant would be assigned should feel comfortable in every hiring decision.

More importantly, the hiring manager will have confidence that the decision was made with the most information available and put the company in the best possible position to retain the employee in the long term.

Best practices

A few best practices for hiring in a complicated world include:

• Make sure you treat everyone the same; if you conduct background checks (and you should), do it for everybody.

• Keep medical information separate and do not ask questions about it or obtain any information on it until after a conditional offer has been made.

• Provide notice about a background check; get an authorization.

• When making an employment decision, apply the same standards to everyone; in other words, do not reject an applicant of one race or ethnicity with a negative criminal history but hire an applicant of a different race or ethnicity who has the same criminal history.

• Follow the FCRA’s two-step adverse action process with a religious zeal.

• Limit knowledge about the information obtained to only those with a specific need to know. That limitation is especially imperative if negative information is discovered but the decision is made to hire the applicant anyway.

This article was excerpted from Law Journal Newsletters, offering 17 monthly newsletters that provide analysis of the latest trends in all major practice areas. Learn more.