Industry Accreditation

The Professional Background Screening Association (PBSA), formerly the National Association of Professional Background Screeners, operates an accreditation program for background screening organizations in the United States.

The program is administered by the Background Screening Credentialing Council. Formerly known as the Background Screening Agency Accreditation Program (BSAAP), it is now called the Background Screening Organization Accreditation Program (BSOAP). CRAs may still encounter the former name in published materials.

• Understand what the standard covers. The US employment screening standard is organized into six areas: information security, legal and compliance, client education, researcher and data standards, verification services standards, and business practices.
• Work from the current version of the standard. PBSA publishes the standard and its audit criteria, and both are revised periodically. A CRA preparing for audit should confirm which version applies to its review rather than working from an earlier copy.
• Expect an independent audit. Conformity is assessed by a third-party auditor through documentation review and interviews rather than by a self-certification.
• Understand the accreditation cycle. PBSA accreditation currently operates on a 5 year cycle. CRAs should confirm the current renewal and interim review requirements that apply to their accreditation.
• Check which program applies. PBSA maintains a separate general standard for organizations delivering screening services outside the United States. An organization operating in both may consider accreditation under each.

Accreditation may be one part of a CRA’s broader compliance and information security program. Other certifications, audits, licenses, and provider requirements may apply depending on the services the CRA provides.

• Information security. Accreditation standards may include requirements for protecting personally identifiable information and demonstrating that appropriate security controls are in place. CRAs should confirm the current security documentation or independent assessment required by the applicable standard.
• SOC 2. A SOC 2 Type II report evaluates specified controls over a period of time and may be requested by clients evaluating a CRA’s information security and operational controls.
• ISO 27001. This certification evaluates an information security management system against an international standard and may be relevant to CRAs with enterprise clients or international operations.
• State licensing. A small number of states require a private investigator license or similar registration for some background screening activity. Licensing is a legal requirement where it applies, unlike accreditation.
• Data provider credentialing. Credit bureaus and other data sources maintain their own credentialing and inspection requirements, which operate independently of any accreditation.

Successful accreditation preparation begins well before the formal audit.

• Read the standard clause by clause. Each clause states a specific requirement, and the audit criteria describe what the auditor will accept as evidence of conformity.
• Assess the organization against each clause. Identify where the CRA conforms, where it conforms but lacks documentation to demonstrate it, and where it does not yet conform.
• Assign each gap an owner and a date. Remediation that is not assigned tends not to be completed before the audit window.
• Begin with the clauses that take longest to complete. Security assessments, new policies and procedures, training programs, and other requirements that need a history of implementation should be addressed early in the preparation process.
• Involve the people who perform the work. Auditors may interview staff to confirm how procedures are actually performed. Employees should understand the procedures that apply to their responsibilities and be able to explain how they follow them.
• Allow time between remediation and audit. Newly implemented procedures should have time to operate so the CRA can demonstrate that they are being followed and produce supporting records.

Accreditation requires a CRA to demonstrate that its established practices are actually being followed. Policies describe what should happen, while completed records help show what occurred in practice.

Documentation typically requested includes:

• Written policies and procedures covering the areas the standard addresses
• Client agreements and permissible purpose certifications
• Client credentialing files and site inspection records
• Vendor agreements, due diligence, and oversight records
• Information security policy and current certification or audit evidence
• Training materials and completion records
• Quality control procedures and results
• Dispute handling procedures and completed dispute files
• Records retention schedule and disposal procedures
• Insurance certificates

When preparing documentation for the audit:

• Map each document to the applicable requirements. An evidence index can identify which policy, record, or sample supports each requirement and make documentation easier to review.
• Provide samples that show the procedure operating. Completed files demonstrate conformity in a way that a policy document cannot.
• Confirm the documents are current. An expired certificate or a policy dated three years ago raises a question the auditor will pursue.

Accreditation requires ongoing attention after the initial audit. Policies, procedures, documentation, and other program requirements should continue to be maintained throughout the accreditation term.

• Track renewal and review dates. Maintain accreditation renewal dates and any required interim reviews on the same compliance calendar used for other audits, inspections, and recertifications.
• Keep documentation current throughout the term. Maintaining records as the program operates makes renewal preparation easier and provides ongoing evidence that established procedures are being followed.
• Reassess when the standard is revised. A revised standard may add clauses the CRA has never been assessed against.
• Reassess after a significant change. New services, an acquisition, a platform migration, or a change in data providers can affect conformity in areas that were settled at the last review.
• Follow the program’s rules on displaying the mark. Accreditation programs set conditions on how the credential may be used in marketing, and those conditions apply for as long as the CRA displays it.
• Report changes the program requires. Ownership changes and other material events may need to be reported during the term rather than at renewal.

Accreditation records document the review itself, separately from the operational records the review examined.

Maintain, as applicable:

• The version of the standard the CRA was assessed against, with its effective date
• Self-assessment results and the gaps identified
• Remediation plans, owners, and completion dates
• The evidence index mapping documents to clauses
• Correspondence with the accrediting body
• Auditor reports and findings
• Responses to findings and evidence of remediation
• The accreditation certificate and its term dates
• Interim review results, where the program includes one
• Current information security certification or audit report

Retain records from prior accreditation cycles. They establish how long the CRA has held the credential and what was examined in each review.