BS 7858 screening: what an assessor actually asks to see

BS 7858 is the British Standard covering the screening of individuals working in a security environment. Most contractors screen properly. What separates a comfortable assessment from an uncomfortable one is usually whether the resulting file can be produced, complete, on request.

The standard is revised periodically, and the detail of what is required changes with it — treat the current published version as the authority rather than anything written here.

The gap between doing it and evidencing it

A screening process typically involves several parties: the applicant, referees, previous employers, and whoever carries out the checks. Each produces a document at a different moment, and those documents rarely arrive in one place.

• –References chased by email and confirmed verbally, with nothing written down
• –Gaps in employment history explained in an interview, but not recorded against the file
• –Documents held in a personnel folder that is separate from the operational record
• –A screening completed by a previous employer, accepted informally, never re-evidenced

None of these mean the officer was not screened. They mean you cannot show it — which, in an assessment, amounts to the same finding.

Building the file as you go

The practical approach is to treat the screening file as the deliverable, rather than a by-product of a process that happens mostly in inboxes.

• –One record per officer, holding every screening document together
• –Employment history gaps recorded with the explanation attached, not remembered
• –Reference outcomes written down at the point they are received
• –Screening status visible operationally, so an unscreened officer is not deployed

Retention

Screening records are normally retained for a defined period after an officer leaves, and client contracts frequently impose their own requirements on top. Because the periods differ between the standard, your contracts and your own data protection position, they are worth confirming rather than assuming — check the current standard and your contracts.

Completeness is not the same as traceability

A screening file can contain every required element and still fail scrutiny, because what an assessor tends to test is not presence but traceability: who obtained this, when, from what source, and how was it verified. A reference in the file proves a reference exists. A reference with no record of who requested it, from whom, and what was done to confirm the referee was genuine proves considerably less.

This is why files assembled retrospectively rarely survive. The elements can be gathered after the fact; the contemporaneous record of how they were gathered cannot.

The file that was complete on day one

The other common finding is a file that was complete at the point of screening and has not moved since, on an officer employed for four years. Screening establishes a position at a moment in time, and a file with no subsequent entries on a long-serving officer invites the question of what has happened since — which is a reasonable question and an awkward one if the answer is nothing.

Common mistakes

• –Holding the elements without recording who obtained them and when
• –No record of how a referee's authenticity was confirmed
• –Assembling files retrospectively when a client audit is announced
• –Files complete at screening with nothing recorded since
• –Inconsistent practice between branches with no agreed standard
• –Relying on a third party having screened without holding the evidence

One more thing: know where your own exceptions are

Most screening operations have a handful of files with something unusual in them — a gap that was accepted, a reference that could not be obtained, an officer started before completion. None of those are necessarily problems. Not knowing which files they are, when an assessor asks, is.

• –Keep a list of files where an exception was made, and who approved it
• –Record the reasoning at the time rather than reconstructing it
• –Review the list periodically to see whether exceptions are becoming routine

One practical test: read three files as an assessor would

Pick three officers screened by different people, at different times, and read their files looking only for traceability: who obtained each element, when, from what source, and how it was verified.

Completeness is usually fine. What varies is whether the file shows a process or just a result — and three files handled three different ways is a worse finding than one missing document, because it means nothing can be inferred about the files an assessor did not open.

• –Record who obtained each element, when, and how it was verified
• –Sample your own files before a client does
• –Look for consistency across recruiters and branches, not just completeness
• –Keep a list of files where an exception was made
• –Do not tidy files once an audit is announced — it shows