The Fair Credit Reporting Act: time to mind the details

Internal Auditor, Dec, 2001 by Joyce A. Ostrosky, Linda M. Leinicke, W. Max Rexroad, Jim Baker

Internal auditors and senior management who take the time to understand the far reaching implications of the Fair Credit Reporting Act may save their companies from federal and civil penalties as well as negative publicity.

FOLLOWING WIDESPREAD CONSUMER COMPLAINTS about inaccuracies in consumer credit reports, the U.S. Congress enacted amendments to the Fair Credit Reporting Act (FCRA), which went into effect in September 1997. Whether or not Congress intended it, these amendments are affecting business activities far beyond credit reporting, including a company's hiring practices, promotion procedures, and investigations of suspected employee wrongdoing. Internal auditors and senior management need to understand the numerous requirements imposed by the FCRA to help their organizations avoid penalties and negative publicity.

BEYOND THE CREDIT REPORT

To fully understand the far-reaching implications of the FCRA, internal auditors need to know two key definitions from the act:

* Consumer report -- "any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for ... employment purposes."

* Consumer reporting agency -- "any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports."

The definition of consumer report covers more than just credit information, as indicated by the phrase "any information." Reports regarding driving records, criminal history, educational background, professional certifications, and similar matters also are considered consumer reports. And, the definition of a consumer reporting agency includes more than credit reporting agencies. Private investigators and persons and agencies that perform employee background checks qualify as well.

USING CONSUMER REPORTS

The FCRA targets external providers of credit and investigative information. Thus, if an organization procures its own credit information on employees and applicants and conducts its own employee investigations, the FCRA requirements do not apply. However, if these reports are requested from consumer reporting agencies, internal auditing, in its audit of the human resources department, needs to determine if FCRA disclosure and consent requirements are being met.

An organization planning to use a consumer report to make a hiring or promotion decision must provide written notification of that intent to the affected individual. This written notification must be on a separate document that contains only information about the organization's intent to use a consumer report in the hiring or promotion decision. For example, on this same document, the organization cannot solicit information regarding the individual's driving record, past employment, or intent to comply with the organization's code of conduct.

Perhaps most importantly, this written notification may not be part of the organization's standard employment application form. For example, many U.S. organizations routinely request authorization to obtain criminal history information -- a consumer report -- on employment applications. They then rely on that authorization to obtain criminal histories from third-party providers. What many human resources professionals, and even corporate counsel, do not realize is that this common practice violates the FCRA, because the written notification is not on a separate document.

Once an applicant has been notified of the organization's intent to use a consumer report, written authorization must be obtained from that individual. Only then should a consumer report be requested.

If the organization first requests the consumer report and later receives written authorization from the individual, it has violated the FCRA. Furthermore, the organization must provide the individual's written authorization to the consumer reporting agency when requesting the report.

It is good business practice to word the authorization so that the prospective employee is granting permission for the consumer report to be obtained now and at any time during employment for legitimate business purposes. Written authorization regarding permission to obtain a consumer report should also be requested from current employees. These "blanket authorizations" allow a company to obtain consumer reports at appropriate times during an employee's career without asking for authorization each time a report is needed.

As internal auditors review use of these procedures, they should be sensitive to possible discriminatory uses of consumer reports. For example, if there are six applicants for a job opening, and the organization only requests authorization to obtain a consumer report from one applicant, the organization may be exposing itself to a discrimination lawsuit. Additionally, it is important not to act in a discriminatory way based upon a consumer report. One way to help avoid this problem is to adopt a written policy outlining the type of information that will disqualify applicants from being hired or promoted.