The Fair Credit Reporting Act: time to mind the details

Internal Auditor, Dec, 2001 by Joyce A. Ostrosky, Linda M. Leinicke, W. Max Rexroad, Jim Baker

If, based in whole or in part on the consumer report, an organization anticipates not hiring or promoting an individual, it must provide that individual with a preadverse action notice. Basically, this means the organization must inform the individual of its anticipated adverse decision and furnish a copy of his or her consumer report as well as a copy of his or her rights under the FCRA. Again, timing is critical. The individual must receive all these items before the actual adverse decision is made. If the decision is made before the individual is notified about the items, the organization is in violation of the FCRA.

The intent of the law is to provide individuals with time to correct inaccuracies in consumer reports before any adverse action. The FCRA does not specify the length of time between the preadverse action notice and the final adverse decision. However, in a typical situation, five business days is an adequate amount of time.

The consumer reporting agency must provide the employer with a copy of the individual's rights under the FCRA to give to the affected individual. The Federal Trade Commission, charged with administering the FCRA, has drafted and made public a summary of these rights, which may be found online at www.ftc.gov.

If an adverse decision is made, the company must provide an adverse action notice to the individual. This notice should contain the following four elements:

* Oral, written, or electronic notification of the adverse action.

* Name, address, and a toll-free telephone number of the consumer reporting agency.

* A statement that the consumer reporting agency did not make the adverse action decision and, therefore, is unable to provide specific reasons as to why the decision was made.

* Oral, written, or electronic notification of the individual's rights under the FCRA, including the right to obtain a free copy of his or her consumer report within 6o days.

GETTING PERSONAL

In addition to consumer reports, the FCRA covers investigative consumer reports. According to the FCRA, an investigative consumer report is "a consumer report or portion thereof in which information on a consumer's character, general reputation, personal characteristics, or mode of living is obtained through personal interviews with neighbors, friends, or associates of the consumer reported on or with others with whom he is acquainted or who may have knowledge concerning any such items of information."

An investigative consumer report may be appropriate when investigating suspected employee wrongdoing such as misappropriation of assets, worker's compensation claims, sexual harassment, drug abuse, and other similar situations. An investigative consumer report may also be appropriate when deciding whether or not to promote an employee to a highly sensitive position.

Internal auditors should determine if policies and procedures are in place to comply with the FCRA's requirements regarding investigative consumer reports. If an outside investigator is to be used, the affected individual must be notified in writing of this fact no later than three days after the date on which the report was first requested. This notification must include a statement informing the individual of his or her right to request additional information about the investigative report.