Employers will Start Looking at Due Diligence Post-Hire to Protect against Insider Threats in 2015

Written By Attorney Lester Rosen, Founder & CEO of Employment Screening Resources (ESR)

Employers will increasingly look at due diligence post-hire to protect against insider threats to organizations in 2015. The exposure of government secrets by Edward Snowden and the Naval Yard shootings in Washington D.C. have put increased emphasis on post-hire insider threats. There are numerous types of post-hire insider threats ranging from embezzlement, fraud, and theft to child molesters and active shooters and everything in between. These inside threats come from anyone with access to workplaces including employees, contractors, temporary workers, and even ex-spouses. This trend is number 5 on the Employment Screening Resources (ESR) 8th Annual ‘ESR Top Ten Background Check Trends for 2015.’ For a list of background check trends, visit https://www.esrcheck.com/ESR-Top-Ten-Background-Check-Trends.

Identification and prevention of insider threats requires an inter-disciplinary approach that can include: mental health assessments; psychological testing; physical security; identification of risk factors; supervisor and co-worker training to recognize danger signals; internal controls and continuous evaluation; sharing and analyzing information between agencies/sources; and a culture of safety, reporting, and integrity.

Although post-hiring screening techniques cannot eliminate the problem, employers are looking at screening tools as another avenue to prevent harm.  Screening tools for insider threats can include: ongoing “continuous evaluation” (CE); re-enactment (post-mortem) screenings; credit report checks; asset searches; social media checks; vendor checks; and screening current, newly acquired, contingent, and temporary workers. In the event an employer has to deal with an insider event, another valuable employer tool is to conduct a post –mortem check to determine if better or increased pre-employment or post-employment screening would have raised a “red flag” that could have potentially avoided the problem.  A firm can perform a “re-enactment” background check to see if screening would have revealed anything useful to the hiring decision.

Background screening is a critical risk management tool when it comes to insider threats. Employees are typically a firm’s greatest investment and largest cost. Each hire also represents a large potential risk. Every employer has the obligation to exercise “due diligence” in hiring. Employers, especially in industries with higher risk, need to be able to vouch for the integrity and honesty of employees. An employer that hires someone it either knew or should have known was dangerous, unfit, or unqualified for the work can be sued for negligent hiring.

Although every organization has a goal of only hiring honest, qualified, and ethical people fit for the job, this goal may not be the emphasis in the real business world. Due diligence requires spending money and the cost of background checks can be seen as a drag on the bottom line. When selecting background screening vendor, cost is often the primary criteria, which often does not translate into a level of due diligence required for the job.   In addition, hiring managers, recruiters, and Human Resources professionals are motivated in the short term to fill positions and face tremendous pressure to get new people on-boarded. As a result, filling positions in a timely manner can become more critical than a long term concern that maybe someone will be a “bad hire.”

After the hire, the potential for insider threats increases. After a new employee gets in the front door, a business may still be concerned about: persons with substantial authority (C-level executives and above); persons with access to IT or sensitive financial/proprietary information; persons with access to cash; persons in sensitive positions with access to sensitive information such customer lists, operations information, financial information; persons who can make financial decisions (extreme example: the “rogue trader”); and any current or former employee/contractor with a grievance and a gun.

The inherent challenge is in predicting future behavior from employees. Due to numerous factors, it is hard to measure how a person will react in the future to various situations, such as need for money or ability to act in an ethical fashion when under orders to do something less than ethical. Generally speaking, a person with past history of honesty is much more likely to be honest in the future. Conversely, studies show that if a person is dishonest in how they obtained a job, they much more likely to be dishonest once they are in the job. The key is initial screening, ongoing screening, and an environment of control and physical safety.

Employee problems also can arise during employment. There are predictable risks such as when an employee may have access to cash or assets and the need for internal controls well known. There are unpredictable risks such as when an employee develops financial issues, undergoes life stresses, gambles, or uses alcohol or drugs. Or supervisors may suggest, encourage, imply, or order employees to perform acts of questionable honesty. There are also secret risks such as when a person with a political agenda obtains job secretly to advance a goal detrimental to the employer’s interest.

In addition, an employer may discover post-employment that critical information was missed during the hiring process. For example, an employer may discover post-hire that a person is a registered sex offender or that a credential is faked. To prevent surprises caused by missed information during pre-employment screening, employers should have in place policies, practices, and procedures to carefully select employees in the first place. They should have a well thought out pre-employment screening program commensurate with the risk involved. They should ensure application forms make it clear that any material falsehood or omission can result in termination NO MATTER WHEN DISCOVERED and have language in the employee manual that deals with discovered falsehoods or omissions post-hire. They should ensure background check releases have an “Evergreen” clause to allow future screening if needed (although there are limits to that). Some firms include a policy that employees must self-report any arrest since that can impact their ability to perform jobs.

However, there are legal implications of using information about employees acquired after hiring them. It is important to not have a knee jerk reaction and to carefully review all the facts and circumstances and give the employee an opportunity to be heard. If an employee suspended as a result of a “consumer report” under the federal Fair Credit Reporting Act (FCRA), employers must remember that pre-adverse and post-adverse notice are needed under the FCRA. The FCRA has a process to screen where there is possible workplace misconduct or wrongdoing. It is especially important to carefully document actions – especially if employee has pending claim – and be careful of allegations of retaliation. In addition, the use of social media carries its own inherent set of problems and limitations. See the Employment Screening Resources® (ESR) whitepaper ‘Ten Potential Dangers When Using Social Media Background Checks’ available at https://www.esrcheck.com/Stay-Updated/Download/.

It is important to realize internal investigations can invoke the FCRA. There is a misconception among some employers that any in-house investigation is non-FCRA. This is only true if everything is done in-house and no commercial databases are used. If an employer uses a court runner, that can invoke FCRA. If an employer uses commercial databases, that can invoke FCRA (but not public databases such as a courthouse). Under the Fair and Accurate Credit Transactions Act of 2003 (FACT Act or FACTA), the FCRA was amended to allow internal investigation without notice or authorization if there is suspicion of wrongdoing or misconduct, provided adverse action rules are followed.

The bottom line is that employers are now concerned about ongoing or continuous due diligence even after the person is hired. Employers can no longer assume that passing a background check means there will never be issues with insider threats down the line.  An employer must engage in continuous evaluation of its workfare and other potential risks and insider threats, and screening tools will be called upon to help provide that type of risk monitoring.

ESR TOP TEN BACKGROUND CHECK TRENDS FOR 2015 WEBINAR

Employment Screening Resources® (ESR) will present a complimentary webinar hosted by ESR Founder and CEO Attorney Lester Rosen titled ‘ESR Top Ten Background Check Trends for 2015’ on Wednesday, January 21, 2015 from 11:00 AM to 12:00 PM Noon Pacific Time. To register for this webinar, please visit the registration link at https://attendee.gotowebinar.com/register/3656006267617568513.