Your company just hit 200 employees. An enterprise client asks during a vendor assessment: “Can you share your background verification policy?” You look at your HR head. Your HR head looks at you. Neither of you has one. You have a practice \u2014 “we usually run checks through SpringVerify before people join” \u2014 but you don’t have a policy. And that gap just cost you a deal worth Rs. 2 crores annually.<\/p>\n\n\n\n
A practice is what you do when you remember. A policy is what you’ve committed to doing, documented, approved by leadership, and can be audited against. When Deloitte or Accenture sends a vendor compliance questionnaire, they don’t ask about your practices. They ask for your policy document \u2014 signed, dated, and comprehensive.<\/p>\n\n\n\n
Define exactly who gets screened. All employees? Contractors? Interns? Board advisors? Gig workers?<\/p>\n\n\n\n
A strong scope statement: “All individuals engaged by [Company Name] in any capacity \u2014 including full-time employees, fixed-term contractors, interns, consultants, and board advisors \u2014 shall undergo background verification appropriate to their role and access level prior to or within 15 business days of commencement.”<\/em><\/p>\n\n\n\n Not every hire at your Bangalore office needs the same checks as your Mumbai CFO. Define 3-4 tiers:<\/p>\n\n\n\n Tier 1 \u2014 Standard (all hires):<\/strong> Identity (Aadhaar\/PAN) + Criminal database + Address verification. Cost: Rs. 300-500.<\/p>\n\n\n\n Tier 2 \u2014 Professional (white-collar):<\/strong> Tier 1 + Education + Employment (last 2 via EPFO + HR outreach). Cost: Rs. 800-1,200.<\/p>\n\n\n\n Tier 3 \u2014 Sensitive (finance, data, client-facing):<\/strong> Tier 2 + Credit check + Reference checks + Extended employment (last 3-5 employers). Cost: Rs. 1,200-1,800.<\/p>\n\n\n\n Tier 4 \u2014 Executive (CXO, board):<\/strong> Tier 3 + MCA directorship search + Litigation screening + Media screening + Global sanctions. Cost: Rs. 3,000-5,000.<\/p>\n\n\n\n Map every role in your organization to a tier. A Keka or Darwinbox role master can tag the BGV tier to each job code.<\/p>\n\n\n\n Document: how consent is obtained (digital via WhatsApp\/portal, with vernacular options for blue-collar candidates), what specific data is collected and for what purpose (DPDPA Section 4), retention period (recommend 3 years for standard roles, 8 years for BFSI per RBI guidelines), deletion process after retention period expires, and how candidates exercise correction and deletion rights under DPDPA Sections 12-13.<\/p>\n\n\n\n When a check returns a discrepancy: who gets notified (HRBP + hiring manager + Legal for red flags), severity classification (critical\/major\/minor \u2014 predefine which discrepancies fall in each), candidate notification within 2 business days with specific findings, candidate response window of 5-7 business days, decision authority (HRBP for minor, VP HR for major, VP HR + Legal for critical), and documentation requirements at each step.<\/p>\n\n\n\n Mistake 1:<\/strong> Making exceptions for “urgent hires” and never going back to complete the check. Fix: no exceptions without VP-level written approval and a 15-day completion deadline.<\/p>\n\n\n\n Mistake 2:<\/strong> Running the same checks on every hire regardless of role. Fix: tiered packages save 30-40% in BGV costs.<\/p>\n\n\n\n Mistake 3:<\/strong> No annual policy review. Fix: calendar a review every January. Regulations change (DPDPA rules are still evolving), and your policy must keep up.<\/p>\n\n\n\n Mistake 4:<\/strong> Not defining what happens with amber cases. Fix: include maximum hold periods (10 days standard, 15 days sensitive, 20 days executive).<\/p>\n\n\n\n Mistake 5:<\/strong> Keeping the policy in a Google Doc nobody reads. Fix: embed it in your HRMS onboarding workflow. Make it a mandatory acknowledgment for every hiring manager.<\/p>\n\n\n\n Name your BGV vendor. Specify SLAs (TAT by check type, amber rate caps, breach notification timelines). Require SOC 2 Type II and ISO 27001 certifications. Define annual vendor reviews with specific metrics. Include escalation contacts.<\/p>\n\n\n\n Annual policy review by VP HR + Legal. BGV completion records retained for defined period. All documentation producible within 48 hours for client or regulatory audits. Quarterly vendor performance reviews.<\/p>\n\n\n\n Print it on company letterhead. Have the CEO sign it. Date it. This document serves triple duty: investors ask about governance (show this), enterprise clients audit your processes (share this), DPDPA regulators check compliance (produce this). A signed BGV policy is worth more than ten vendor certifications.<\/p>\n\n\n\n SpringVerify’s platform supports all four verification tiers with configurable check packages, DPDPA-compliant WhatsApp-based consent collection, and audit-ready reporting \u2014 making it easy to operationalize the policy you’ve just built.<\/p>\n\n\n\n Key Takeaways:<\/strong><\/p>\n\n\n\n \u2022A BGV practice is not a BGV policy \u2014 enterprise clients and DPDPA regulators can tell the difference<\/p>\n\n\n\n \u2022Define 3-4 check tiers mapped to role categories to balance cost (Rs. 300-5,000 range) and thoroughness<\/p>\n\n\n\n \u2022The top 5 policy mistakes all have simple fixes \u2014 embed them before they become audit findings<\/p>\n\n\n\n \u2022Include adverse action procedures with specific timelines, decision authorities, and documentation requirements<\/p>\n\n\n\n \u2022Have the CEO sign it and date it \u2014 this signals governance maturity to investors, clients, and regulators<\/p>\n","protected":false},"excerpt":{"rendered":" Your company just hit 200 employees. An enterprise client asks during a vendor assessment: “Can you share your background verification policy?” You look at your HR head. Your HR head looks at you. Neither of you has one. You have a practice \u2014 “we usually run checks through SpringVerify before people join” \u2014 but you<\/p>\n","protected":false},"author":1026,"featured_media":512382,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[102665,102674],"tags":[14,69,131],"class_list":["post-512381","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-background-check","category-sv-in-customers","tag-background-checks","tag-hr","tag-springverify-india","disable-dropcap","disable-2-columns"],"yoast_head":"\n2. Check Packages by Role Tier<\/h3>\n\n\n\n
3. Consent and Data Handling (DPDPA-Compliant)<\/h3>\n\n\n\n
4. Adverse Action Process<\/h3>\n\n\n\n
5. Top 5 Mistakes Companies Make<\/h3>\n\n\n\n
6. Vendor Management<\/h3>\n\n\n\n
7. Audit and Review<\/h3>\n\n\n\n
Making It Board-Ready<\/h2>\n\n\n\n