Most organisations have some form of pre-employment screening. Far fewer apply the same thinking to the contractors, vendors and agency staff who work on their premises or in their systems. Yet these groups often have wide access, work outside normal hours and are supervised less closely than employees.
Who is usually missed
- Cleaning and maintenance crews, who may have keys or access cards to every floor, often at night
- IT and systems vendors, with remote or administrator access to networks and data
- Agency and temporary staff, placed at short notice
- Construction and fit-out contractors, whose workforce can change daily
- Security officers themselves, supplied by a guard company whose screening you have never checked
Whose job is it?
In most cases the contractor employs the workers and should screen them. But the risk sits with you. If a contractor's employee steals from your site or misuses your data, your organisation bears the loss and, potentially, the regulatory consequences.
Building vetting into contracts
The most practical approach is to set screening requirements in the contract: what checks the contractor must carry out for workers assigned to your site, how they will evidence them, and how quickly they will notify you of changes. Under the Data Protection Act 2020, the contract should also cover how any personal data you share, or that they collect, is handled.
What this means in practice
- List every contractor and vendor with physical or system access.
- Set screening requirements by level of access, not by type of contractor.
- Write those requirements into contracts and renewals.
- Ask for evidence, and spot-check it.
- Remove access promptly when assignments end.
Talk to us about contractor screening requirements. → Background checks
