Pre-Employment Screening Guide for Australian Employers and HR Teams

Pre-employment screening helps Australian employers confirm that candidates meet the identity, work-rights, qualification, integrity and role-specific requirements relevant to their employment.

Regulated sectors and positions of trust can require additional checks. The employer remains responsible for identifying the rules that apply to the role.

The practical challenge is coordinating candidates, checks and decisions without creating unnecessary copies of sensitive information. This guide explains the main check types and a role-based process for managing them.

What is pre-employment screening?

Pre-employment screening is the process of checking information relevant to a candidate’s suitability for a role before or during employment.

Depending on the position, this may include:

• identity verification;
• a Nationally Coordinated Criminal History Check;
• an AFP Police Check;
• Australian citizenship verification;
• a VEVO visa and work-rights check;
• employment-history verification;
• professional-reference checks;
• education and qualification verification;
• professional licence or registration checks;
• address-history verification; and
• other role-specific integrity or probity checks.

Not every candidate requires every available check. Employers should select checks that are relevant, proportionate and lawful for the role. The Australian Human Rights Commission's recruitment discrimination guidance recommends reviewing selection criteria and processes for unlawful bias.

Use consistent criteria for comparable roles. Give candidates appropriate notice, obtain any required consent and check the privacy, employment and anti-discrimination rules that apply to the organisation.

Why employee background checks matter

Recruitment decisions are often based on information supplied by candidates through resumes, application forms, interviews and supporting documents.

A structured screening process can help employers:

• confirm that the candidate is the person they claim to be;
• verify claimed employment and qualifications;
• check whether the person has permission to work in Australia;
• identify inconsistencies requiring clarification;
• satisfy role-specific regulatory or contractual requirements;
• support safer hiring decisions;
• reduce fraud and identity risks; and
• maintain an auditable recruitment process.

Background screening does not replace an employer’s own assessment.

A screening result should be considered alongside the inherent requirements of the role, the circumstances of any information identified and the organisation’s documented risk-assessment process.

The challenge with fragmented screening workflows

Many recruitment teams still manage employee screening through separate providers and manual processes.

A typical workflow might require staff to:

1. Collect candidate details through an applicant-tracking or HR system;
2. Copy information into a spreadsheet;
3. Request a Nationally Coordinated Criminal History Check through a separate provider;
4. Download identity documents from the recruitment system;
5. Upload those documents to another verification service;
6. Request work-rights evidence separately;
7. Send reminder emails to candidates;
8. Manually record the status of each check; and
9. Forward results to recruitment, integrity, compliance or hiring teams.

This creates unnecessary administrative work and can make it difficult to determine which candidates have completed their requirements.

Common problems include:

• delays in moving candidates through recruitment;
• repetitive data entry;
• increased workload during peak hiring periods;
• limited visibility over pending and completed checks;
• inconsistent candidate follow-up;
• reliance on spreadsheets and shared inboxes;
• duplicate storage of identity information;
• documents being downloaded onto local devices;
• results being transferred manually between teams; and
• difficulty producing reliable audit records.

Each additional transfer or local copy of candidate information may increase privacy and security exposure.

Building an effective employment-screening process

An effective screening process should be designed around the risk and responsibilities of the role.

The process should answer five questions:

1. Which checks are relevant to this position?
2. At what point in recruitment should each check occur?
3. What information and consent must be obtained from the candidate?
4. Who is authorised to review the result?
5. How will the organisation document and apply its decision?

A mature screening workflow should also provide:

• a consistent check package for comparable roles;
• clear ownership between recruitment and risk teams;
• defined escalation procedures;
• status visibility;
• secure information handling;
• appropriate access controls;
• documented retention periods;
• candidate communication templates; and
• integration with existing recruitment systems where practical.

Common types of pre-employment checks

Choose a check for the question it answers. The table is a starting point, not a universal package for every employee.

Nationally Coordinated Criminal History Check

A Nationally Coordinated Criminal History Check is commonly used for employment, licensing, registration, volunteering and positions of trust.

The check is delivered through the ACIC service, which is operated by the Australian Criminal Intelligence Commission in partnership with Australian police agencies.

Employers can direct candidates to an ACIC-accredited body or arrange a business screening workflow through an accredited provider.

A criminal-history check is a point-in-time result. It reflects relevant police information available and disclosed at the time the result is issued. The employer or requesting organisation determines how recent a result must be for its purpose.

A check should be requested for the correct employment purpose. Results should not automatically be reused for unrelated positions or purposes without considering the applicable requirements.

AFP Police Check

An AFP Police Check is used for purposes listed by the Australian Federal Police, including specified Commonwealth, immigration, overseas and ACT matters.

It should not automatically be substituted for a Nationally Coordinated Criminal History Check. The candidate should obtain the check type and purpose required by the requesting employer, regulator or government authority.

Identity verification

Identity verification helps establish that the applicant is the person associated with the identity information and documents supplied.

This may include:

• document examination;
• Document Verification Service checks;
• verification against government issuing records;
• biometric or liveness verification where applicable;
• name-linkage evidence;
• address verification; and
• manual review where automated verification is unsuccessful.

Identity requirements depend on the selected service. A generic “100-point check” should not be assumed to satisfy every Nationally Coordinated Criminal History Check, government or organisational requirement.

Australian citizenship verification

A citizenship check can help verify evidence that a person is an Australian citizen.

This is different from a general identity check and different from a VEVO visa check.

Depending on the workflow, evidence may include an Australian passport, citizenship certificate or another accepted citizenship document.

VEVO and work-rights checks

Australian employers must ensure that a worker is legally entitled to work in Australia.

Australian citizens and permanent residents can work without visa-based restrictions. Other workers may hold visas with unrestricted, limited or no work rights.

VEVO allows visa holders, employers and authorised organisations to review current visa details and conditions.

A VEVO check may show:

• the visa currently in effect;
• the visa subclass;
• the period of stay;
• work conditions;
• study conditions; and
• other applicable visa restrictions.

VEVO provides visa information. It does not replace a criminal-history check, identity check or citizenship check.

Employers should also avoid making assumptions about work rights based only on a person’s nationality, accent or appearance.

Employment-history verification

Employment-history checks can confirm information such as:

• the employer’s name;
• the candidate’s position;
• dates of employment;
• employment type;
• responsibilities; and
• the verifier’s relationship to the candidate.

Employers should distinguish between confirmation of factual employment information and a qualitative professional reference.

Professional-reference checks

A reference check obtains feedback from a person who has worked with or supervised the candidate.

Questions may cover:

• the referee’s relationship to the applicant;
• role and employment dates;
• responsibilities;
• performance;
• conduct;
• strengths;
• development areas;
• suitability for the proposed position; and
• eligibility for re-employment.

Reference responses are opinions supplied by third parties and should be assessed in context.

Education and qualification verification

Education screening can verify qualifications claimed by a candidate, including:

• institution;
• qualification title;
• course or field of study;
• completion or award status;
• attendance dates;
• graduation date; and
• academic evidence.

International qualifications may require additional verification steps and longer processing periods.

Professional licences and registrations

Some roles require current professional registration, licensing or industry membership.

The employer may need to confirm:

• the registration number;
• issuing body;
• current status;
• conditions or restrictions;
• expiry date; and
• whether the registration covers the proposed work.

Address-history verification

Address verification can help establish a candidate’s residential history or confirm an address used in an identity-screening process.

Evidence may include:

• a driver licence;
• utility account;
• lease;
• bank or government correspondence; or
• another accepted proof-of-address document.

Credit, financial and insolvency checks

Financial or insolvency information can be sensitive and is not a routine screening requirement. Before requesting it, confirm that the check is lawful, necessary for the role and available through an authorised source. Give the candidate the required notice and obtain any required consent. This guide does not advise on access to consumer credit reporting information.

How AuthNTick streamlines employment screening

AuthNTick's public service pages describe a business workflow for candidate invitations, status tracking and organised screening records. Available checks include employment criminal history checks, AFP Police Checks, VEVO work-rights checks, work-history checks and qualification checks.

The business dashboard page describes three core functions: inviting candidates, tracking progress and managing records. It does not remove the employer's responsibility to choose appropriate checks, control access or assess results fairly.

Candidate invitations and self-service

A candidate invitation can move data entry and consent into the application workflow. This can reduce manual copying by recruitment staff, but the exact steps depend on the selected check.

Before sending an invitation, confirm the organisation name, check purpose, payment arrangement and support contact shown to the candidate. Limit staff access to people who need the information for an authorised business purpose.

Dashboard, link, bulk and API options

The integration options page describes dashboard, invitation-link, bulk upload and API pathways. Availability depends on the customer's system, account configuration, API access, security review and agreed scope.

Before approving any integrated workflow, document:

• which fields move between systems;
• the permitted purpose and consent pathway;
• authentication and access controls;
• which status or result information is returned; and
• error handling, retention and deletion responsibilities.

Reducing privacy and security risk

Pre-employment screening involves personal information and can involve sensitive information. Privacy coverage is context-specific: the OAIC explains that the Privacy Act treats public and private employee records differently. Applicant information and information used outside the employment relationship can require a separate analysis.

Depending on the check, this may include:

• legal names;
• previous names;
• date of birth;
• residential addresses;
• passport or identity-document details;
• visa information;
• identity-document images;
• employment and education information;
• criminal-history results; and
• referee information.

Map where this information goes. A manual workflow can create copies in:

• stored in spreadsheets;
• downloaded onto staff devices;
• attached to emails;
• placed in shared folders;
• uploaded repeatedly to separate providers; or
• retained after it is no longer required.

A candidate self-service workflow can reduce manual copying. Employers must still define:

• who may access screening information;
• how results are assessed;
• how information is retained;
• when records are deleted;
• whether downloads are permitted;
• how incidents are managed; and
• which integrations or subprocessors are involved.

Screening and the Protective Security Policy Framework

Australian Government entities may need to conduct personnel and information-security activities in accordance with the Protective Security Policy Framework.

The PSPF establishes protective-security requirements for Australian Government entities across areas including personnel, information, physical security and governance.

Private businesses are not automatically subject to all PSPF requirements merely because they conduct background screening. However, suppliers working with government customers may need to demonstrate controls that support the customer’s security and procurement obligations.

Organisations should conduct their own assessment rather than relying on a general marketing statement as evidence of PSPF, DISP or other security-framework compliance.

Handling sensitive information

Security classifications such as OFFICIAL: Sensitive relate to Australian Government information-handling requirements.

Any statement that a platform can process or store information at a particular classification should be supported by:

• the system’s approved security architecture;
• the applicable customer contract;
• a system risk assessment;
• information-handling procedures;
• personnel and access controls;
• hosting arrangements;
• incident-response processes; and
• any required government authorisation or assurance.

Do not treat a public product page as approval to upload government-classified or security-sensitive information. Obtain written confirmation for the specific service and customer environment first.

Verify security and data-residency claims

Security, hosting and retention claims can change with architecture and service configuration. Ask the provider for current documentation instead of relying on a generic feature list. Verify:

• where each data class is stored and processed;
• how information is protected in transit and at rest;
• identity, role and privileged-access controls;
• logging, monitoring and incident-notification arrangements;
• subprocessors and cross-border disclosures;
• backup, deletion and recovery processes; and
• which statements are contractual commitments.

The evidence should match the service configuration being purchased and the organisation's legal, contractual and data-residency requirements.

Government and third-party sources

Some checks require information to be submitted to or verified against an authorised external source.

Depending on the service, this may include:

• the Australian Criminal Intelligence Commission and Australian police agencies;
• the Australian Federal Police;
• the Department of Home Affairs;
• the Document Verification Service;
• education institutions;
• previous employers;
• referees;
• professional bodies; or
• other authorised data sources.

Information should only be shared where necessary to provide the requested check and in accordance with the applicable consent, screening-service terms and privacy arrangements.

Where information may be disclosed overseas, assess the arrangement against the OAIC's APP 8 cross-border disclosure guidance and the organisation's applicable privacy obligations.

Running screening fairly and securely

Screening timeframes

There is no single processing time that applies to every background check.

Timeframes can depend on:

• the type of check;
• whether the application is complete;
• identity-document quality;
• candidate responsiveness;
• external government or institution processing;
• whether information needs manual review;
• the complexity of international verification;
• employer or referee response times; and
• whether a criminal-history check is referred for further review.

Recruitment teams should avoid treating an extended processing period as evidence of an adverse result.

Where a result requires internal integrity or risk assessment, the organisation should have a separate documented review process.

Reviewing criminal-history information fairly

A disclosable outcome is information for assessment, not an automatic employment decision. The Australian Human Rights Commission publishes guidance on criminal-record discrimination and considering the inherent requirements of a role.

Employers should assess information in relation to:

• the inherent requirements of the role;
• the nature of the disclosed conduct;
• when it occurred;
• the candidate’s age at the time;
• relevance to the proposed duties;
• evidence of rehabilitation;
• applicable spent-conviction rules;
• regulatory requirements; and
• the candidate’s opportunity to explain or correct information.

Access to criminal-history results should be restricted to appropriately authorised decision-makers.

Data retention and customer access

Do not keep screening information indefinitely merely because it might be useful later. Under APP 11, an APP entity must take reasonable steps to protect personal information and, subject to stated exceptions, destroy or de-identify information it no longer needs. See the OAIC's APP 11 guidance, updated 3 October 2025.

Organisations should define retention periods based on:

• legal obligations;
• government or contractual requirements;
• audit needs;
• the purpose for which the information was collected;
• complaint or dispute periods;
• security requirements; and
• the organisation’s privacy policy.

Employers should download or retain results only where they are authorised to do so and should protect any copy held within their own systems.

Business continuity and service recovery

Ask how the provider handles service disruption and how urgent recruitment decisions proceed while a check is unavailable.

Request current evidence for:

• backups;
• recovery procedures;
• service monitoring;
• incident escalation;
• alternate communication channels;
• any approved manual procedure; and
• tested business-continuity plans.

Treat recovery-time statements as commitments only when they appear in the current agreement or service schedule for the purchased service.

Choosing an employee-screening provider

Employers should consider more than price when selecting a background-screening provider.

Questions to ask include:

Service coverage

Does the provider offer the checks required for your workforce, industry and risk profile?

Accreditation and authority

Is the provider authorised or accredited to deliver the relevant check?

For Nationally Coordinated Criminal History Checks, employers should use an ACIC-accredited body or another authorised pathway.

Candidate experience

Can candidates complete the process securely on mobile and desktop?

Are instructions clear, and can applicants obtain support?

Workflow management

Can recruitment teams initiate, monitor, search and report on checks without relying on separate spreadsheets?

Integration

Can the service connect with the organisation’s applicant-tracking or HR platform?

Information security

Can the provider explain its access controls, data handling, hosting, encryption, incident management and subprocessor arrangements?

Privacy and consent

Does the workflow collect clear candidate consent and provide appropriate privacy notices?

Retention and deletion

Are customer-access and record-retention periods documented?

Support and escalation

Is there a clear process for incomplete applications, identity problems, disputed information and delayed external verification?

Frequently asked questions

What is included in pre-employment screening?

Pre-employment screening may include identity, criminal-history, work-rights, citizenship, employment, reference, education, licence and other role-specific checks.

The appropriate checks depend on the role and the employer’s legal and risk requirements.

Does every employee need a Nationally Coordinated Criminal History Check?

No. Employers should determine whether a criminal-history check is relevant, proportionate or legally required for the position.

Some regulated roles may require one, while other positions may not.

How long is a Nationally Coordinated Criminal History Check valid?

There is no universal expiry period.

It is a point-in-time check, and the employer, regulator or requesting organisation determines how recent the result must be for its purpose.

Is a VEVO check the same as an identity check?

No. VEVO provides current visa details and conditions.

An identity check establishes or verifies the person’s identity. An employer may require both.

Is a citizenship check the same as a VEVO check?

No. VEVO is for visa information.

Australian citizens do not hold an Australian visa for VEVO purposes and should provide appropriate citizenship evidence where citizenship must be verified.

Can AuthNTick integrate with an HR platform?

AuthNTick publishes dashboard, link, bulk and API options. The available path depends on technical scoping, account configuration, API access, security review and the agreed data flow.

Should recruitment teams download candidate identity documents?

Downloads should be limited to cases where they are operationally and legally required.

Reducing unnecessary local copies can lower security and privacy exposure.

Does a criminal-history result decide whether someone should be hired?

No. The employer makes the employment decision.

Any disclosed information should be assessed fairly and in relation to the requirements and risks of the role.

Can screening information be stored indefinitely?

Screening records should be retained only for an authorised purpose and for the applicable legal, contractual, audit or operational period.

Organisations should document retention and secure-disposal requirements.

Next steps for an AuthNTick screening workflow

Start with a role-based check matrix and an approved information flow. Then compare the required checks with AuthNTick's workforce screening options.

For Nationally Coordinated Criminal History Checks, the ACIC's current list names DPI Consulting Pty Limited, trading as AuthNTick Identity Services, as an accredited body. Accreditation does not make AuthNTick a government agency, and it does not determine which check an employer should request.

Confirm check availability, candidate steps, access controls, retention, pricing and any integration scope in the applicable proposal or agreement before implementation.

Important notice

This article provides general information only and is not legal, employment, immigration, privacy or security advice.

Employers are responsible for determining which checks are lawful, necessary and appropriate for each role and for making their own recruitment and risk decisions.

Screening requirements, government processes and regulatory obligations may change. Organisations should review current official guidance and obtain professional advice where appropriate.