As South African businesses prepare for 2027, reviewing employee screening policies should be an essential part of their year-end risk management and corporate governance planning.

The end of the year is traditionally a time for businesses to review budgets, evaluate performance, assess operational risks and establish priorities for the months ahead. Yet one important area of corporate governance is frequently overlooked: the effectiveness of the organisation’s employee screening policy.

For many employers, background screening remains primarily a recruitment activity. Employers select a candidate, conduct a series of checks, and once the individual joins the organisation, consider the screening process complete. But is that approach still sufficient? Employees change roles, responsibilities increase, financial circumstances evolve, professional registrations expire, and new risks emerge. At the same time, businesses face challenges involving qualification fraud, identity misrepresentation, insider threats, and regulatory compliance.

An employee screening policy that was appropriate several years ago may no longer provide the level of protection an organisation requires. As 2027 approaches, employers should be asking a straightforward question: does our screening policy adequately protect our people, customers, information, assets and reputation?

Never treat a screening policy as a static document. As organisations expand, introduce new technology, appoint remote employees or enter new markets, their exposure to risk changes. A business that has introduced new financial systems, expanded its procurement department, or allowed employees to access sensitive customer information remotely may face risks that were not contemplated when it originally developed its screening policy.

A comprehensive review should determine whether existing checks remain appropriate for each employee category. A finance manager, security officer, delivery driver, and administrative employee do not necessarily require identical screening procedures. The objective should be to establish a risk-based approach in which the depth of screening is determined by the responsibilities, access privileges, and potential risks associated with a position. Employers should consider whether their current policy reflects the business they operate today, rather than the business they operated when the policy was written.

Qualification fraud and employment history misrepresentation remain important recruitment risks. A professionally presented CV, a convincing interview, and an apparently authentic certificate do not necessarily establish that a candidate possesses the qualifications or experience claimed. Employers should consider whether their screening policies require independent verification of relevant qualifications, professional registrations, previous employment and references.

It is equally important to ensure checks are conducted consistently and that discrepancies are appropriately investigated before appointment decisions are finalised. A policy that requires qualification verification but permits exceptions without documented approval may offer considerably less protection than management assumes. Employers should also review procedures for candidates presenting international qualifications, claiming professional memberships or providing references that cannot readily be authenticated. Base important employment decisions on verified information rather than assumptions.

One of the most common weaknesses in employee screening programmes is focusing too much on new appointments. Once an employee passes an initial screening process, organisations may assume the original results remain sufficient throughout the employment relationship. However, an employee may move into a position with greater financial responsibility, gain access to confidential information, become responsible for procurement decisions, or take on duties requiring professional accreditation. These developments may justify additional checks that were unnecessary when the individual first joined the organisation.

Continuous vetting does not mean subjecting every employee to every available check each year. Instead, it involves establishing clear, lawful and proportionate triggers for reassessment. These may include promotions into sensitive positions, material changes in responsibilities, renewal of professional credentials or identified risks that justify further verification. An effective screening policy should explain when reassessment is appropriate, who authorises it and how the resulting information will be evaluated.

South African employers must balance legitimate business risk management with employees’ rights to privacy, dignity and fair treatment. Assess criminal record information in context, considering the nature of the position, the relevance and seriousness of the offence, the time elapsed, and any applicable legal requirements. A criminal record should not automatically result in exclusion from employment, particularly where the information has no meaningful bearing on the position’s responsibilities.

Credit checks also require particular attention. South African credit legislation restricts access to consumer credit information for employment-related purposes, including positions involving the handling of cash or finances. Employers should not assume that a candidate’s general financial circumstances justify unrestricted access to their credit profile. Before entering 2027, organisations should review whether their screening procedures are legally justified, properly authorised, relevant to the position concerned and applied without unfair discrimination.

Employee screening necessarily involves collecting and processing personal information. The Protection of Personal Information Act (POPIA) establishes conditions for lawful processing, including accountability, purpose limitation, transparency, information quality and security safeguards. Employers should ensure that candidates and employees receive appropriate information about the checks being conducted, why those checks are necessary, and how their personal information will be handled.

Where consent is relied upon, it must meet the requirements of the legislation. However, consent is not the only lawful basis for processing under POPIA, and employers should establish the appropriate legal justification for each screening activity. Particular care is required when dealing with criminal behaviour information and other categories of special personal information, which are subject to additional restrictions and exceptions.

A year-end policy review should consider whether screening reports are securely stored, access is restricted to authorised personnel, information is retained only for an appropriate and lawful period, and external screening providers operate under suitable contractual and security arrangements. Compliance is not simply about obtaining a signature on a consent form. It requires an accountable and documented approach to the entire screening process.

Are contractors, temporary workers and remote employees included?

Traditional screening policies often focus on permanent employees while overlooking individuals engaged through alternative employment arrangements. Contractors, consultants, temporary workers and outsourced service providers may have access to the same facilities, systems, customers and confidential information as permanent staff. In some circumstances, they may present comparable or even greater operational risks.

Organisations should consider whether their policies establish appropriate screening standards for third-party personnel and whether responsibility for conducting those checks is clearly allocated. Remote and internationally based workers introduce additional considerations, including cross-border verification, differences in available records and the lawful transfer of personal information. Screening requirements should be determined by an individual’s access and responsibilities rather than simply their employment classification.

Some industries face additional regulatory requirements relating to employee suitability, professional competence and integrity. In the financial services sector, for example, the Financial Advisory and Intermediary Services (FAIS) regulatory framework establishes fit and proper requirements for relevant financial services providers, key individuals and representatives. These include requirements relating to honesty, integrity, good standing and competence.

Other regulated occupations and sectors may require professional registration, specific licences, statutory suitability checks or continuing compliance with industry standards. Employers should review whether their screening policies accurately identify the requirements applicable to their particular industry and the positions within their organisation. It is also important to distinguish between mandatory statutory checks and additional screening measures adopted as part of an organisation’s own risk management framework.

A screening programme is only as effective as the decisions made when concerns are identified. Employers should have a documented procedure for dealing with qualifications that cannot be verified, conflicting employment dates, undisclosed relevant criminal convictions or questionable references. Candidates should be given an appropriate opportunity to explain discrepancies, while responsibility for determining whether a concern is material to the position should be clearly assigned.

An unexplained discrepancy does not automatically establish dishonesty. Administrative errors, outdated records and misunderstandings can also produce inconsistent results. A sound screening policy should therefore provide for fair assessment, appropriate escalation and documented decision-making. Employers should avoid both ignoring material concerns and automatically excluding individuals without considering the circumstances.

Having a comprehensive screening policy is one thing. Demonstrating consistent implementation is another. Management should be able to establish whether required checks were completed, whether exceptions were authorised and whether outstanding verifications were resolved. Where employees commence work before all required checks have been finalised, the organisation should have a documented process for managing the associated risk.

Regular reporting can help identify weaknesses such as inconsistent screening between departments, delayed verification, excessive exceptions or gaps in recordkeeping. Screening should form part of the organisation’s broader governance and risk management framework, with clear accountability between human resources, compliance, security and operational management. A policy that exists only on paper provides limited protection against actual business risks.

Ten questions every employer should ask before 2027

A practical year-end screening policy audit should establish whether an organisation can confidently answer the following questions:

1. When was our employee screening policy last formally reviewed, and does it reflect our current operational risks?

2. Are screening requirements linked to the responsibilities and risk profile of each position?

3. Do we independently verify relevant qualifications, employment history and professional registrations?

4. Are criminal record and credit checks conducted only where lawful, justified and appropriate?

5. Does our policy provide for ongoing screening when employee responsibilities or risks change?

6. Are contractors, temporary employees and remote workers appropriately covered?

7. Do our screening procedures comply with POPIA and applicable employment legislation?

8. Are industry-specific regulatory requirements clearly identified and addressed?

9. Do we have a fair and documented process for investigating screening discrepancies?

10. Can the C-Suite of your organisation confidently demonstrate that screening requirements are consistently implemented and exceptions properly controlled?

If the answers to several of these questions are uncertain, the organisation may benefit from a formal review of its screening policy. Identifying gaps before they result in a costly incident is far more effective than addressing weaknesses after fraud, misconduct, or regulatory non-compliance has occurred.

Employee screening should not be viewed merely as an administrative requirement that delays recruitment. When properly designed and implemented, it is an important component of corporate governance, fraud prevention, regulatory compliance and organisational resilience. The consequences of inadequate screening can extend far beyond the initial appointment, potentially exposing an organisation to financial loss, operational disruption, regulatory consequences and reputational damage.

Conversely, a fair, consistent and risk-based screening programme can help employers make better-informed decisions while demonstrating a commitment to responsible employment practices. As businesses finalise their plans for 2027, employee screening deserves a place alongside financial planning, cybersecurity, compliance and operational risk management.

At iFacts, we understand that every organisation has different operational requirements and risk exposures. Our employee screening and verification services help South African businesses make informed decisions about prospective and existing employees. From identity, qualification, and employment history verification to criminal record checks and appropriate ongoing screening, iFacts supports organisations seeking to strengthen their employee risk management practices.

As you prepare for 2027, now is a great time to evaluate whether your existing screening policy provides the protection your business needs.

Contact iFacts to discuss your current employee screening requirements and identify opportunities to strengthen your screening programme. Start the new year with greater confidence in the people behind your business.