Making progress on criminal record employment checks

We examine recent developments in the Criminal Records Bureau's disclosure service and look ahead to further changes due to come on stream soon.

Learning points This article examines developments in criminal record checks since our 2005 research study. We find that the Criminal Records Bureau (CRB) has improved turnaround times and enhanced the disclosure service. Enhanced checks are now required for all school staff, and the CRB no longer provides a service where checks can be transferred from one job or employer to another. The Soham murders and the subsequent Bichard inquiry are leading to a shake-up in vetting practices. There is a consensus on the part of the CRB and employer and trade bodies that a CRB check should form only one element of a safe recruitment process. There is concern on the part of some interested parties that a number of employers are abusing the disclosure service by applying for illegal background checks on posts that are not eligible under the Rehabilitation of Offenders Act 1974.

Last year, IRS published what we believe to be the largest single independent piece of research that has been conducted so far into employers' experiences of using the Criminal Records Bureau (CRB)¹.

We found widespread support for the concept of a single source of criminal records data, alongside some worrying indications of lapses in the CRB's service standards. Since then, as we shall see, the CRB has improved turnaround times for applications and pushed forward work on its online services. It has also been wrestling with the challenges of implementing the Bichard inquiry's recommendations to address failings in child protection measures.

Demand soars

One of the most notable landmarks since our 2005 research, at least in numerical terms, was achieved on 4 August 2006, when the CRB issued its 10 millionth disclosure. It says that it now has the capacity to process more than 275,000 checks a month.

According to Mark Favager, head of communications at the CRB, demand for the CRB's disclosure service has risen year on year. He comments: "We forecast that we would carry out 2.9 million checks this financial year but are now on target to process 3.3 million disclosure applications."

In his view, the continuing upward trend in the demand for the CRB's service reflects an increasing awareness of the importance of its checks as part of good recruitment practice by employers to improve the protection of children and vulnerable adults. If so, this would justify the thinking behind the creation of the CRB in March 2002, which was to provide organisations with much wider access to criminal records information than was available under the previous system and, in doing so, to enable them to recruit more safely.

In a study we conducted earlier this year of organisations' practices regarding background checks on job applicants², we found that employers consider CRB disclosures to be the single most useful source of background information on candidates. However, our 2005 study into users' experience of the CRB also uncovered widespread frustration with the delays and inaccuracies that employers experienced.

An enhanced service

According to the latest annual report from the CRB³, backlogs of applications are being tackled. The report says that 99.6% of standard disclosures were processed within 14 days in 2005/06 - almost 10 percentage points better than its target of 90%. However, the enhanced disclosure performance target had not been met "due to backlogs in a small number of larger police forces who are responsible for a high volume of disclosures". The CRB issued 84.3% of enhanced disclosures within 28 days, against a target of 90%. (See "Level of disclosure" below for an explanation of "standard" and "enhanced" disclosures.)

According to Favager, the CRB's 2005 customer satisfaction survey showed that approval of the CRB was "at an all-time high", with 82% of respondents being satisfied or very satisfied with the standard of service. One-third of users indicated that they were "very satisfied", compared with just one in 10 who expressed this view when the CRB was first launched in 2002.

This sense of significant improvement taking place is reinforced by Siân Thomas, deputy director of the health service employers' body NHS Employers. She comments: "Disclosure is critical to the NHS where there are so many vulnerable people using the services provided by trusts. In the early days, there were undoubtedly a number of challenges for the CRB, such as the ability to cope with the volume of disclosure applications and backlogs. But the CRB now runs a very slick operation and there are few delays in processing checks."

NHS Employers enjoys a "strong partnership" with the CRB, Thomas explains, and recently participated in a workshop that the CRB organised for around 60 NHS trusts. "Discussions like these provide a very useful forum to discuss good practice and serve to strengthen the relationship between the CRB and user organisations such as NHS trusts," she says.

Level of disclosure

One potential area of confusion in carrying out background checks involves the level of disclosure that organisations should apply for - or, indeed, whether they are legally justified in applying for any type of disclosure for certain posts.

The main legal framework comes from the Rehabilitation of Offenders Act 1974 (ROA), which enables criminal convictions to become "spent" or ignored after a specified rehabilitation period. A person with a spent conviction is not normally required to divulge it when applying for a job, although there are important exceptions under the ROA when applicants will always be required to disclose previous conviction, whether they are spent or not.

The CRB processes two types of disclosure: a standard disclosure for posts that are exceptions under the ROA, such as employees who have regular contact with children and other vulnerable groups; and an enhanced disclosure. The latter check is for jobs involving regular care of young people, or training, supervising or being in sole charge of them. An enhanced disclosure includes reference to local police records such as non-conviction information.

It should be noted that an organisation can register directly with the CRB, or via an umbrella body, only if it employs people (including volunteers) who come within the remit of the disclosure categories. Employers must therefore provide details that demonstrate they are likely to ask exempted questions, which require an individual to reveal their full criminal history, under the ROA. The various roles and professions are listed in the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975, as amended.

Calderdale & Kirklees Careers, a not-for-profit careers advice and guidance service, has taken the decision to apply for enhanced disclosures for all personal advisers as part of its strategy to ensure the integrity of its entire workforce. Derran Sewell, human resource development manager, explains: "Our 80 personal advisers sometimes work alone and unobserved with 14- to 19-year-olds in schools, and other staff work directly or indirectly with young people, so they clearly require an enhanced check. But we carry out full CRB checks in all cases, a policy that is supported by our board and trade unions."

He adds that the other element to the organisation's "catch-all" approach to disclosure is that it wishes to ensure that staff are protected from false accusations of inappropriate behaviour. Obtaining a full CRB check goes some way to meeting this goal.

Calderdale & Kirklees Careers has occasionally received a positive disclosure concerning a successful job applicant but, without exception, the individual has already disclosed the criminal record in their job application. In each case, the organisation has carried out a risk assessment, discussed the matter fully with the prospective employee and satisfied itself that it is not relevant to the post in question.

Our case study of the approach taken by homelessness charity St Mungo's to using CRB checks appears in box 1.

Respect for the law

In a recent report on the "use and misuse" of CRB disclosures⁴, crime reduction charity Nacro (formerly the National Association for the Care and Resettlement of Offenders) proposed strengthening the powers of the CRB to take action against employers that breach the CRB's code of practice⁵ by running checks on posts that are not eligible for checking.

According to Mervyn Barrett, head of Nacro's resettlement communications service, a large number of employers are applying for disclosures on posts that do not require vetting. He comments: "We know from the thousands of calls to our helpline that this is a huge problem. Some local authorities and other organisations are routinely conducting illegal background checks on posts, such as refuse collectors and office-based staff, that are not exempt from the ROA and therefore not eligible for checking."

From April 2006, tighter controls on gaining access to disclosures were introduced by the Police Act 1997 (Criminal Records) (Registration) Regulations 2006. The Regulations also give the CRB power to terminate the registration of organisations that regularly abuse its disclosure service.

At the same time, the scope of posts where an enhanced check is required has been widened in some circumstances. For example, from 12 May 2006, the Department for Education and Skills made it mandatory for all new school staff to receive a CRB check. Previously, strong guidance recommended that the higher level of disclosure be obtained for all school employees but it was obligatory only for those in sole charge of children, such as teachers (see the Bichard inquiry's recommendation 21 in box 2).

Portability changes

From 1 April 2006, "after careful consideration", the CRB withdrew from its previous role in the portability service. "Portability" refers to the re-use of a CRB check, obtained for one position in one organisation and later used for another position in another organisation. The CRB says that it "took this decision as a direct result of the inherent risks associated with the re-use of a disclosure".

However, Favager emphasises that this policy change does not mean that portability can no longer occur. "The CRB is aware that some organisations wanted to continue to re-use disclosures and so we developed a new portability framework. This provides helpful guidance that can reduce the risks associated with this practice," he says.

The CRB's portability framework states that, if an organisation decides to accept a previously issued CRB check, there are a number of factors that it must consider:

• CRB checks carry no formal period of validity;
• the information contained on a CRB check reflects the information available as of the date of its issue;
• using portability does not constitute a fresh check;
• a person's criminal record or other relevant information may have changed since the issue of the previous CRB check;
• in certain circumstances, an employer may be required by law to carry out a fresh check of the Protection of Children Act (POCA) list and/or the Protection of Vulnerable Adults (POVA) list, thereby preventing the use of portability; and
• employers should always see an original CRB check, not a photocopy, as the CRB check contains a number of security features intended to prevent tampering or forgery.

The CRB's new policy on portability has implications for employers' use of temporary staff in particular and, therefore, for employment agencies' operation. It has been suggested that, when assignments last for only a few days, it can be unrealistic to obtain a new check for every temporary worker.

"NHS Employers supports the CRB's decision to withdraw from its current role in the portability service and the bureau has issued very clear guidance on this," Thomas comments. "The CRB has stopped processing portability requests but employers can still choose to accept a previously issued disclosure if they feel that the circumstances justify such an approach. The key is that recruiting organisations understand how, why and when portability should be used. Each case has to be considered in isolation, with the trust weighing up the specific circumstances."

For example, she continues, in some cases where an individual's employment history is well known, patients could be put more at risk if a post remains vacant while waiting for a new CRB check than if portability were practised as a time-saving measure. As with any guidance, it is important to consider the practicalities and manage the risk.

Other new developments

The list outlined in box 2 shows the progress that the CRB has made in implementing the Bichard recommendations with relevance to its own operations. The Bichard inquiry, which was set up after the Soham murders, aimed to address the shortcomings of existing child protection measures.

In addition, the CRB has introduced, or is in the process of developing, a number of other service enhancements, such as:

• Registered body network: the Bichard inquiry noted that, with more than 14,000 registered bodies, it was impossible for the CRB to assure compliance with its code of practice. The inquiry's report recommended slimming down the network. Under this reform, only those organisations that submit at least 100 disclosure applications within a 12-month rolling period are eligible to be a registered body. Others must use the services of an umbrella body, which handles disclosure requests on others' behalf. This requirement will be phased in over the next 18 months.
• Umbrella body database: to complement the changes to the registered body network, the CRB has expanded its new, online umbrella body database. Under this system, an organisation already registered with the CRB can choose to act as an "administrative intermediary", or umbrella body, on behalf of other employers needing a background check on a job applicant. As well as a threefold increase in the number of umbrella bodies, the CRB has expanded the breadth and depth of information held on each umbrella body.
• Police performance tables: for enhanced disclosures, the CRB is reliant on police forces carrying out the additional checks within agreed timescales. The CRB has just published the first set of tables that show each police force's performance against these set targets.
• Electronic platform: the CRB has developed an e-platform. The first online service to be offered will be an online tracking tool whereby customers can check the progress of their applications for a CRB check. The next e-service to come on stream will be an electronic application form that will include an "e-bulk" facility whereby volume users of the disclosure service can submit multiple applications.

Another important development in the overall protection framework concerns the proposal to set up a vetting and barring scheme. When this Bichard recommendation is implemented - legislation has now been passed but not yet implemented (see box 3) - private individuals, such as parents, will be able to verify whether someone they employ is suitable to work with children or vulnerable adults.

The same statute - the Safeguarding Vulnerable Groups Act 2006 - will also make it possible for centralised checks for the jobs it covers to be continuously updated and employers notified when an individual's status changes.

Avoiding discrimination

Favager advises that the CRB's code of practice places a number of obligations on the recipients of disclosure information, notably the duty not to unfairly discriminate against the subject of that information. Employers registered with the CRB are required to have a written policy on the recruitment of ex-offenders. A written statement should also accompany all application forms sent to job candidates, to the effect that a criminal record will not necessarily be a bar to employment.

"The 2005 research [carried out for the CRB by Mori⁶] showed that around 7.5% of the disclosures the CRB issues reveal information and, of these, only 10% resulted in a withdrawn job offer," Favager points out. "This indicates that the majority of employers do have a policy on employing ex-offenders and are looking carefully at the circumstances of each case to assess the relevance of that information. If we believe that employers are not complying with equal opportunities, the CRB will undertake an assurance visit where the aim is to educate, train and improve."

Barrett says: "Home Office research shows that a quarter of the population of working age have a criminal record. That means that, logically, a quarter of disclosure applications should also reveal information relating to a criminal record, but the CRB's latest figures show that it is around one in 20. This indicates that people with a criminal record are reluctant to apply for a job for fear of discrimination and the public shame that exposure would bring. In the vast majority of cases, the conviction is wholly irrelevant and very few job applicants have records that pose a genuine risk."

There are other possible explanations, too, for the gap between the figures of 25% (convictions in the population) and 7.5% of CRB checks being positive for a criminal record. The Home Office figures are estimates and could be subject to error. They also indicate that men are around four times more likely to have a conviction than are women. Many of the jobs for which CRB checks are sought are, in contrast, those that continue to employ disproportionate numbers of women, such as nursing and teaching. Jobs for drivers, manual labourers and construction workers, all of which are traditionally male-oriented, are seldom eligible for CRB checks.

Safe recruitment

Favager is keen to emphasise the difference that the CRB makes to safe recruitment. As he comments: "Our core aim is to protect children and the vulnerable and, in 2004, independent research found that more than 20,000 unsuitable people had been prevented from gaining access to these vulnerable individuals as a direct result of CRB checks. In 2005, the figure had increased to 25,000. However, our code makes clear that a CRB check is not the only tool that employers should use to help them recruit safely."

The 2005 research by IRS, cited above, found that organisations do not generally rely on a single screening or vetting method - they typically use at least three techniques to check candidates' background details as part of their recruitment process. Nacro publishes comprehensive guidance on recruiting safely⁷ that advises on the kind of measures that employers can take to improve their recruitment and staff management practices.

It is also worth remembering that the UK has a pan-European workforce and the CRB can only access information held on the UK's databases. In April 2006, the CRB changed the way it provides information on how to access overseas criminal records. Recognising that a CRB check "may not provide a complete picture for people being recruited from overseas", and to help organisations obtain overseas criminal record information, the CRB has set up a dedicated overseas webpage providing information on 21 countries.

Room for improvement?

In Sewell's view, the CRB's most significant shortcoming is its failure to inform employers about any subsequent cautions or child-related convictions for individuals who have been employed following a successful check. As he comments: "The loop is not closed on this area and, if it was, there would be a huge improvement in the safety of organisations' employment practices. There is a real need for the CRB to update information, or a disclosure check will remain just a snapshot."

Thomas shares this view. She explains: "A disclosure check has no period of validity and is only an accurate picture on the date of issue and theoretically that could all change the next day. NHS trusts understand this context and take other safe recruitment measures. NHS Employers is continually updating the guidance we provide to trusts, and is due to issue new guidelines in a few months."

She adds that there is great potential for the disclosure service to NHS trusts to be further enhanced when the CRB launches its proposed online vetting and barring scheme (see box 3). "If the technology is compatible, we are very interested in the possibility of linking up the new online service with NHS Jobs, our e- recruitment service for the NHS in England that already has over 500 user organisations. Online service delivery could potentially speed up the process considerably."

¹Checking out the activities of the Criminal Records Bureau , IRS Employment Review 828.

²Voyages of discovery: carrying out checks on job applicants , IRS Employment Review 850.

³Annual report and accounts 2005/06, Criminal Records Bureau, 2006, www.crb.gov.uk .

⁴Getting disclosures right: a review of the use and misuse of criminal record disclosures, Nacro, 2006, www.nacro.org.uk .

⁵Code of practice and explanatory guide for registered persons and other recipients of disclosure information, Criminal Records Bureau, 2005, www.disclosure.gov.uk .

⁶CRB Mori research summary (PDF format, 160K) (on CBI website), 2006.

⁷Recruiting safely: guidance for employers and other bodies in the health and social care field on recruiting and retaining staff and volunteers with criminal records, Nacro, 2001.

Box 1: St Mungo's - recruiting people to work with vulnerable adults St Mungo's is the UK's largest homelessness charity. Based in London, the charity employs nearly 1,000 staff. The nature of the front-line work that St Mungo's employees carry out with vulnerable people means that the charity is a heavy user of the Criminal Records Bureau's (CRB) disclosure service. "Our entire client base consists of vulnerable adults," says Peter Jeffery, personnel and training director. "This means that we carry out CRB checks for 90% of the workforce." St Mungo's does not, quite rightly, undertake disclosure checks for posts that are not exempt under the Rehabilitation of Offenders Act - for example, office-based support staff such as Jeffery himself. Neither has the organ isation adopted the approach whereby every disclosure applied for is at the enhanced level, although most checks do fall into this category because most of its employees have "constant and direct contact" with vulnerable people. Applying for disclosure St Mungo's follows one of two alternative approaches for disclosure applications: either one of its recruitment agencies carries out the CRB check or, if the charity is recruiting to the post itself, it applies directly to the CRB. The charity uses agencies primarily for temporary placements. For front-line staff, St Mungo's expects the agencies to have undertaken all the necessary background checks on people. The charity has developed a rigorous approach to recruitment and agencies must agree to meet its high standards. It expects all preferred suppliers to comply with the CRB's code of practice and requirements "to the letter", and convened a meeting with its employment agencies to reinforce this stance some time ago. Given the changes to the portability policy of individuals' CRB checks (see main text) and its implications for the use of temporary workers, St Mungo's will now expect a fresh disclosure check to be undertaken for all new recruits. Good practice St Mungo's has a policy on ex-offenders and, on the one occasion when a positive check was returned on a candidate, the charity undertook a full risk assessment. "The individual had already declared the conviction on their application form so we knew in advance," Jeffery says. "But the offence was not a concern to us - it is important to look at each case on its own merit to avoid discrimination." Jeffery advises that the CRB now provides "a very good standard of service" in respect of the quality and accuracy of disclosure checks, and says that he "sleeps a lot better at night because of the ability to recruit more safely". The only area where there is room for further improvement concerns the time it takes to process an application from St Mungo's for a check, currently around six weeks.

Box 2: Progress on Bichard An independent inquiry was set up in the wake of the Soham murders committed by a school caretaker, with the aim of addressing some of the inadequacies of the existing protection measures. Sir Michael Bichard published his report in June 20041. The work to realise Bichard's 31 recommendations is ongoing. Some of the recommendations have specific relevance to the Criminal Records Bureau's (CRB) operations, and Mark Favager, head of communications at the CRB, reports that it has made the following progress: Recommendation 2: The PLX [Police Local Exchange] system, which flags that intelligence is held about someone by particular police forces, should be introduced in England and Wales by 2005. The PLX system was introduced in February 2005, so when the CRB undertakes an enhanced check on an individual - the level of disclosure that includes any local police intelligence - it can refer to this system to determine which local police forces, if any, have intelligence on that individual. Recommendation 20: HMIC should develop, with ACPO and the CRB, the standards to be observed by police forces in carrying out vetting checks. These should cover the intelligence databases to be searched, the robustness of procedures, guidance, training, supervision and audit. This quality assurance framework to aid local police forces' decision-making processes is now being rolled out across all forces and should be complete by the end of March 2007. The framework will aid consistency in the decisions that police forces make about whether or not to release the non-conviction information they hold. Recommendation 21: All posts, including those in schools, that involve working with children and vulnerable adults should be subject to the enhanced disclosure regime. Previously, posts such as teachers who are in sole charge of children could have an enhanced check, but those that did not involve sole access could have only a standard check. From 12 May 2006, new Regulations mean that every school employee - from teacher to caretaker - is required to have an enhanced check. Recommendation 22: The registered bodies' precise responsibilities for checking identities need to be clarified urgently. Early in 2006, the CRB issued new guidance for registered bodies on ID verification and the use of photographic evidence. In addition, there could be a pilot scheme with the Home Office's Identity and Passport Service to evaluate how ID services could be used as part of the CRB's disclosure process. Recommendation 25: Fingerprints should be used as a means of verifying identity. It has been acknowledged that routinely fingerprinting every applicant was a step too far, but the CRB does now make greater use of fingerprinting for "final verification" in cases where it appears that an applicant's biographical details match a criminal record. This means that the CRB is a step closer to eliminating the issue of inaccurate disclosures. Recommendation 27: Registered bodies should be required to confirm that they have checked the information on the "Police Check Form" in accordance with CRB guidance. Recommendation 28: The consents that applicants currently give on the "Police Check Forms" should be sufficiently broad to enable requisite checks to be undertaken. The CRB's guidance and the relevant application form have been amended to make registered bodies more accountable for the accuracy of the information that is provided on applicants. Recommendation 29: Incomplete or withdrawn applications should in future be returned to the registered body, and not to the applicant. This is now standard practice. Recommendation 31: The government should, as a priority, introduce legislation to enable the CRB to access the following databases for the purpose of vetting: Customs and Excise; NCIS; National Crime Squad; British Transport Police (BTP); and the Scottish and Northern Ireland equivalents of POCA and POVA. New legislation has been passed and, from 25 September 2006, the CRB can access the non-conviction information held locally by the BTP for an enhanced disclosure. Favager believes that the CRB has made good progress on taking forward the Bichard recommendations. He says: "We are proud that the CRB has either fully implemented, or is well on the way to fully implementing, every proposal under the CRB's remit, thereby further strengthening the UK's protection framework." 1. The report and consultation documents of "The Bichard inquiry: an independent inquiry arising from the Soham murders" are available at www.bichardinquiry.org.uk.

Box 3: Safeguarding vulnerable people The Safeguarding Vulnerable Groups Act 2006 takes forward several of the Bichard inquiry's key recommendations by enabling the establishment of a unified, instantly accessible source of information on individuals who are "barred" from being in close contact with children and vulnerable adults, and by defining a wide range of roles for which barring checks must be undertaken. It is estimated that between 7.5 million and 10 million jobs will be affected by the Act. Significant criminal penalties are imposed by the Act on employers, employment agencies and individual workers for non-compliance. The Act, which received royal assent on 8 November 2006, provides a basic legal framework for its public protection measures, while depending on subsequent Regulations to fill in the details and their associated implementation dates. Most of the Act's provisions apply solely to England and Wales, and are unlikely to come into force before autumn 2008. The main issues that the Act addresses include: An Independent Barring Board will be set up to be responsible for two lists of individuals who are barred from working with children or adults, replacing the existing POCA, POVA and List 99 registers. The board will also assess information about individuals passed to it by employers, local authorities, the police and others The lists are likely to take the form of continuously updated databases managed by the Criminal Records Bureau that employers can search themselves. According to the government, it is likely that employers will be contacted if an individual's status subsequently changes. Individuals who are on either of the lists, or the comparable ones covering Northern Ireland and Scotland, will not be allowed to engage in "regulated activity". The maximum penalty for infringement will be five years' imprisonment. Regulated activities include regular close contact with children or vulnerable adults in such settings as teaching, care or supervision, providing advice or guidance, and moderating chatlines, or less frequent contact in such establishments as schools and care homes. Employers will commit an offence if they allow a barred individual to engage in a regulated activity and employment agencies will do so if they supply someone for this purpose. However, barred individuals may be able to work in "controlled activities" provided that their employer observes the relevant statutory guidance. Controlled activities cover less direct or regular contact with children or vulnerable adults in such settings as health and further education - for example in catering, cleaning or administrative jobs. Employers and those using volunteers must by law conduct checks on individuals who will engage in regulated or controlled activity.