Hiring process·Updated September 2026

How to vet a candidate

This is an employer's guide to vetting someone you are about to hire for a frontline hourly job — a caregiver, a CNA, a driver, a technician, a warehouse associate. It is not about political candidates and it is not the federal suitability process, both of which crowd the search results for this phrase.

The useful thing to say about vetting is not what the checks are. Everyone knows the list: application, phone screen, references, background check, drug test, I-9. The useful thing is the order, because several of those steps are illegal in the wrong sequence, one of them is illegal before you have made an offer, and one of the most widely repeated rules about the sequence is not law at all.

The order, in one table

Read the right-hand column first. It is the part that gets employers into trouble.

Citations are to the federal rule. State and local law adds to every row — most heavily to criminal history, drug testing and pay history.

Step 1 — screen in the ad, where it is free

The cheapest screen is the one that happens before you pay for the click. A disqualifier question on the application form costs nothing per candidate; a recruiter reading forms costs about twenty minutes a day.

The test for a screening question is narrow: if the answer is the wrong one, is this person definitely not hireable? An active license the role legally requires, a CDL class, a minimum age the job actually carries — those qualify. Years of experience, shift preference, salary expectation and "why do you want to work here" do not; they are preferences, and they cost you volume without removing anyone you could not have hired.

There is a price attached to getting this wrong in either direction. In 891 campaigns we ran in 2026, campaigns where fewer than one in ten clickers finished the form cost $23.13 to $53.77 per completed application; campaigns above a 20% completion rate cost $1.61 to $4.41. Long screening forms are the most common cause of the first group. Screening is a budget with a price, not a free filter — and the questions you keep should be the ones that actually disqualify. This is the step we sell, through AI screening that scores the answers already collected rather than waiting for someone to read them.

Step 2 — the phone screen, with one legal constraint

Ten minutes, ideally the same day. Confirm the schedule, confirm the pay expectation matches the posted range, confirm the commute is real, and ask the one or two role-specific questions that separate someone who has done the job from someone who has read about it.

The constraint is criminal history. Ban-the-box laws restrict when you can ask. According to the National Employment Law Project's tracker, 37 states, the District of Columbia and more than 150 cities and counties have adopted a fair-chance policy, 15 states extend theirs to private employers — California, Colorado, Connecticut, Hawaii, Illinois, Maine, Maryland, Massachusetts, Minnesota, New Jersey, New Mexico, Oregon, Rhode Island, Vermont and Washington — and roughly four-fifths of the US population now lives under one. Those figures are from NELP's August 2025 update, the most recent authoritative count we could find.

You can also ask, at any stage, whether someone is legally authorized to work in the United States and whether they will need visa sponsorship. What you cannot do is ask to see documents. The Justice Department's Immigrant and Employee Rights Section notes that unsuccessful applicants asked these questions may reasonably believe the decision turned on citizenship status, and advises avoiding the questions as a matter of practice. Our page on work authorization goes through this in detail.

Step 3 — background checks: what the FCRA actually requires

Three obligations, in a fixed order, and they are the most litigated part of hiring.

Before you order the report. A clear and conspicuous written disclosure that a consumer report may be obtained for employment purposes, 15 U.S.C. 1681b(b)(2)(A)(i) — and the statute is specific about the document: it must be "a document that consists solely of the disclosure." Not the application. Not a page with a liability waiver on it. Not stapled to your state-law notices. That single clause generates most FCRA class actions against employers, and it is the easiest thing on this page to fix this week. The candidate must then authorize the report in writing, 1681b(b)(2)(A)(ii), and that authorization may sit on the same document.

Before you act on it. If you are going to decide against someone based in whole or in part on the report, you must first give them a copy of the report and a written description of their rights — the Summary of Rights prescribed by the CFPB. 15 U.S.C. 1681b(b)(3)(A)(i) and (ii).

After you act. The adverse action notice is governed by a different section — 15 U.S.C. 1681m(a), not 1681b — and requires notice of the action, the consumer reporting agency's name, address and phone number, a statement that the agency did not make the decision and cannot give the reasons for it, and notice of the right to a free copy of the report within 60 days and to dispute its accuracy.

The transportation exception almost nobody writes about

If you hire CDL drivers, there is a carve-out in the FCRA that changes the sequence entirely, and we have not seen it covered in a general hiring guide.

15 U.S.C. 1681b(b)(3)(B) applies to applicants for positions over which the Secretary of Transportation has power to set qualifications and hours of service, or which are subject to state transportation safety regulation, where the only contact between employer and applicant was by mail, telephone, computer or similar means. For those roles, the employer may skip the pre-adverse notice altogether and instead, within three business days of taking the adverse action, provide oral, written or electronic notification of the action, the reporting agency's contact details, and notice of the right to a free copy of the report and to dispute it.

Two practical notes. The remote-contact condition is real — if the driver came to your office, the ordinary sequence applies. And this is the one place in the FCRA where the timing genuinely is three business days, which is probably where some of the confusion with the non-existent five-day rule comes from.

Step 4 — criminal history, and what changed in 2026

The framework is still the EEOC's 2012 Enforcement Guidance on the consideration of arrest and conviction records, No. 915.002. It asks whether an exclusion is job related and consistent with business necessity, using the three factors from Green v. Missouri Pacific Railroad:

• The nature and gravity of the offense or conduct
• The time that has passed since the offense, conduct and/or completion of the sentence
• The nature of the job held or sought

Paired with an individualized assessment: tell the person they were screened out, give them a chance to explain, and actually consider the explanation.

Now the 2026 part, which most compliance summaries have not yet caught up with. The guidance has not been rescinded — it is still posted, still carries its 2012 issue date and the standard "will remain in effect until rescinded or superseded" line. But the enforcement theory underneath it has been abandoned. Executive Order 14281, signed 23 April 2025, directs agencies to deprioritize enforcement of statutes to the extent they include disparate-impact liability. And on 4 June 2026 the EEOC issued Directives Transmittal 600.001, replacing its Strategic Enforcement Plan with a National Enforcement Plan stating the Commission will prioritize disparate treatment theories, eliminate disparate impact in investigations "to the maximum degree possible," and not commence or continue litigation advancing disparate impact claims.

Neither document mentions criminal history. What they change is the federal enforcement risk, which is materially lower in 2026 than it was in 2024. What they do not change is anything else: private Title VII disparate-impact claims are untouched, and state and local fair-chance laws are untouched. For a multi-state frontline employer, that is where the exposure now sits — and the Green factors remain the best available description of a defensible screen, whoever is enforcing it. Our pages on what a background check covers and ban the box go further into each.

Step 5 — drug testing, and the cannabis split

This is now two different rules depending on whether the role is DOT-regulated, and getting it backwards is expensive in both directions.

For most frontline roles, at least nine of the twenty-four adult-use states protect off-duty cannabis use or bar action based on a test detecting non-psychoactive metabolites. Three worth knowing precisely:

Nevada's exceptions are instructive because they map onto frontline work: firefighters, emergency medical technicians, positions requiring the employee to operate a motor vehicle where federal or state law requires testing, and any position that, in the employer's determination, could adversely affect the safety of others. Washington, RCW 49.44.240, makes it unlawful to discriminate in initial hiring based on off-duty cannabis use or a non-psychoactive-metabolite test, in force since 1 January 2024, with exemptions for first responders, corrections, airline and aerospace positions and safety-sensitive roles. California, Government Code 12954, operative 1 January 2024, prohibits the same and additionally bars asking applicants about prior cannabis use, with exemptions for the building and construction trades and roles requiring a federal background investigation. New York's Labor Law 201-d(2)(c) protects legal recreational activities including cannabis outside work hours, off premises and without the employer's equipment.

For CDL drivers, none of that applies. Federal rules override every state protection above. 49 CFR 382.301(a): "Prior to the first time a driver performs safety-sensitive functions for an employer, the driver shall undergo testing for controlled substances as a condition prior to being used." And the Medical Review Officer is bound by 49 CFR 40.151(e) — must not verify a test negative based on a physician's recommendation to use a Schedule I drug — and 40.151(f), must not accept an assertion of hemp or other non-prescription marijuana-related product use as a basis for verifying a marijuana test negative. A state medical card is not a defense. A CBD explanation is not a defense, and drivers offer it often.

Step 6 — references, and what they are actually worth

Most states give employers qualified immunity for providing truthful references, which is why the "we only confirm dates of employment" policy is more cautious than the law requires. The structure is consistent — a rebuttable presumption of good faith, defeasible only by clear and convincing evidence of knowing falsity or malice. Maine's is a clean example:

Florida's Statute 768.095 works the same way. We could not find a reliable current count of how many states have such a statute — the only counted list we could locate dates from 1997 and is certainly out of date — so treat this as "most states, check yours" rather than a number.

On what reference checks find: the best-sourced figures are old and should be labeled as such. SHRM's 2004 research on reference checking, with 345 HR professionals, found 96% of organizations conducted some form of background or reference check, and that up to 55% sometimes found inconsistencies in dates of previous employment — though only 3% found them always.

What you cannot verify, and why the statistics are worse than they look

Somewhere in almost every article on this subject is a number for how many resumes contain lies. We are not going to give you one, because we could not find a credible one.

The figure most widely cited in 2026 comes from a survey commissioned by a company that sells resume services, run on an opt-in online panel of 2,000 US adults who had ever applied for a job, with no margin of error published. It measures lifetime self-reported lying, which is a different quantity from the share of resumes in your applicant pool that contain a material falsehood. The screening-vendor alternative — "X% of checks find a discrepancy" — comes from companies selling verification and conflates a mistyped end date with deliberate fraud.

The honest position: verification routinely catches date and title mismatches, most of which are memory rather than malice, and there is no published figure worth quoting for how often a candidate is lying. Verify because it is cheap and occasionally decisive, not because a statistic told you to be afraid.

Step 7 — the I-9, and why it cannot come first

The I-9 process does not begin until an offer has been extended and accepted. USCIS's Handbook for Employers, M-274, is explicit: employees may complete Section 1 before the time of hire, "but not before the employer extends the job offer and the employee accepts it."

After that: the employee completes Section 1 at the time of hire, 8 CFR 274a.2(b)(1)(i)(A), and the employer physically examines the documents and completes Section 2 within three business days of the hire, 8 CFR 274a.2(b)(1)(ii). Where employment is for less than three business days, both must be done at the time of hire.

The commonest and most costly mistake here is not lateness — it is over-asking. Under 8 U.S.C. 1324b(a)(6) an employer may not request more or different documents than are required, reject documents that reasonably appear genuine, or specify which documents to present. The worker chooses what to present from the List of Acceptable Documents. Telling a new hire to "bring your green card" is a documentary practice claim waiting to happen. See Form I-9 requirements for the detail.

CDL drivers: the extra file, and the query you cannot skip

Hiring a driver adds obligations that have nothing to do with the steps above and cannot be satisfied by a standard background check package.

The Clearinghouse query. 49 CFR 382.701(a)(1): employers must not employ a driver to perform a safety-sensitive function "without first conducting a pre-employment query of the Clearinghouse." It must be a full query, 382.701(a)(2), which "requires that the individual driver give specific consent" — registered in the Clearinghouse itself. That is the step that catches employers out: the driver has to register and consent electronically before you can complete the query, so start it early. A limited query is not sufficient pre-employment. Annually thereafter, 382.701(b)(1), a query is required for every covered driver; if a limited annual query shows information exists, a full query must follow within 24 hours.

The investigation. 49 CFR 391.23 requires an inquiry to each licensing authority for the driver's three-year motor vehicle record within 30 days of employment beginning, and an investigation of the driver's safety performance history with DOT-regulated employers over the preceding three years. Previous employers have 30 days to respond.

The file. 49 CFR 391.51 requires a driver qualification file containing the employment application, the MVR from each licensing authority, the road test certificate or accepted equivalent, the annual MVR and the note of the annual review, the medical examiner's certificate or CDLIS record with medical certification status, and the medical examiner verification. It must be kept for as long as the driver is employed and three years afterwards. Our page on the driver qualification file works through each item.

Build the sequence for your role

Pick the role type and this gives you the steps in legal order, with what fixes each one's position and the citation to check.

This lists the federal sequence and the citation for each step. It does not cover your state's additions, which are substantial for criminal history, drug testing and pay history, and it is not legal advice.

Where this sits beside our other pages

This page is the sequence. Pre-screening questions covers what to ask on the phone, what is a background check covers one step in depth, and hiring process steps is the whole process from requisition to first day. If the problem is that too few people are reaching the phone screen at all, that is a different page: recruiting strategies.

Frequently asked questions

Sources