Recruitment risk has moved upstream: why pre-employment checks are now a governance issue

Recruitment has quietly become a governance problem. Many organisations still treat pre-employment checks as a familiar HR process: references, right-to-work, qualifications, DBS where required and, sometimes, a quick online search.

Higher-trust roles demand a stronger question. Leaders need to know whether the process behind an appointment would withstand scrutiny if a serious concern emerged later.

The Employment Rights Act 2025 (the ERA) adds to the pressure. As worker protections and procedural expectations expand, inconsistent hiring decisions, thin documentation or informal screening practices will become harder to defend. The point of hire is becoming a critical control point.

A lot of “online checks” are not really checks at all. They are informal searches, carried out by different people in different ways, with little consistency and limited record-keeping. They may expose decision-makers to information they should not be considering, while still missing the kinds of risk that matter most in higher-trust roles.

01 / The governance challenge

Education is where the issue is clearest

Keeping Children Safe in Education 2026 (KCSIE), which came into force on 1 September 2026, says schools and colleges should consider an online search as part of due diligence on shortlisted candidates. The purpose is to help identify incidents or issues that have happened, and are publicly available online, which the school or college may want to explore with the applicant at interview.

The word ‘should’ matters. KCSIE uses it for advice that should be followed unless there is good reason not to. Schools therefore need a considered, documented position, rather than an improvised search or a blanket approach.

Most surface-web searches are often better at finding reputation rather than safeguarding risk. They may identify press coverage, public social media posts, controversial comments or historic online activity. Much of it may not be relevant to the role. Identity errors, manipulated content and missing context add further risk.

The more serious signals are different. In safeguarding and high-trust environments, the concern is not whether a candidate has an awkward social media footprint. It is whether there are role-relevant indicators of serious safeguarding risk, extremist activity, hate-based conduct, association with harmful networks or other material digital risk.

Some of those signals may not appear in ordinary search results. They may sit in non-indexed environments, archived material, forums or dark-web locations. That does not mean employers should search more broadly without controls. It means they should stop treating light-touch Googling as meaningful due diligence.

Why the point of hire carries more weight

Once a person is inside an organisation, the position changes. They may already have access to pupils, vulnerable people, staff, systems, data and the organisation’s reputation. If a concern emerges, leaders must manage the live issue while reconstructing the original recruitment decision. Thin records make both tasks harder.

This is where operational, safeguarding, HR and governance responsibilities meet. Warning signs are often lost at those seams: one team gathers information, another assesses relevance and somebody else makes the decision. Defined handovers and ownership matter more than another layer of informal checking.

02 / The legal shift

The legal shift: why inconsistency is getting more expensive

Among other provisions, the ERA introduces reforms around unfair dismissal protections, limitation periods for tribunal claims, and further protections connected to sexual harassment and workplace conduct. Schools are increasingly seeking advice on how the heightened risks associated with several of these reforms will directly affect the management of recruitment and early-stage employment.

The operational point is that weak processes and thin evidence will become more expensive as procedural duties and worker protections increase.

A reduced qualifying period for unfair dismissal protection

One of the most significant reforms under the ERA is the reduction of the qualifying period for unfair dismissal protection. For over a decade, schools have relied on a two-year period to assess whether a new recruit is the right fit. During this time, they could observe suitability, provide feedback and manage an exit before unfair dismissal protection is afforded to the employee and whilst the risks of termination are typically reduced.

From January 2027, employees will gain unfair dismissal protection after six months of employment. During the first six months, ordinary unfair dismissal risk will generally remain lower, but employers will still need to consider discrimination, whistleblowing, automatically unfair dismissal and other day-one protections.

After six months, schools will need a permitted fair reason to dismiss—misconduct, performance, redundancy, statutory illegality or some other substantial reason—and must follow a fair process. This fundamentally shifts the balance of risk in the recruitment process, as the point of hire now carries more weight than ever. The removal of the statutory cap on unfair dismissal compensation, also from January 2027, further increases financial exposure, particularly for senior or higher-paid roles.

Schools should focus on two key areas:

Stringent recruitment processes

Schools should tighten recruitment practices through more rigorous candidate vetting at the pre-hire stage, including thorough online and social media searches where lawful and proportionate and conducted through a structured process. The cost of a weak recruitment decision is rising, and the most effective mitigation is to reduce the likelihood of making one in the first place.

Strategic use of probationary periods

Schools should implement robust probation reviews. Many are adopting three-month probationary periods with scope to extend where concerns arise. A well-structured probationary period with regular review points sets clear expectations, provides a framework for assessment well within the six-month threshold, and gives the school a documented basis on which to act if the individual is not a suitable fit.

03 / Exposure and process gaps

Limitation periods for tribunal claims

The ERA extends the limitation period for bringing most statutory Employment Tribunal claims from three months to six months, with effect from 1 October 2026. Employees will have twice as long to issue proceedings, including for unfair dismissal and discrimination. Historically, the three-month window provided some natural attrition, as not every aggrieved former employee acts quickly enough and some claims simply expire.

A six-month window gives former employees more time to take advice, gather evidence and bring claims. For schools, this means risk exposure from a poorly managed recruitment decision or mishandled probationary exit continues for six months after the event. Decisions made at the point of hire and in the early months of employment need to be reasonable, consistent and, above all, evidenced.

The cumulative effect of these reforms is clear: as rights and procedural duties increase in breadth and specificity, poor management of recruitment and probationary periods becomes more expensive, and weak documentation becomes harder to defend.

Where problems typically start (and why “we did checks” is not enough)

Most disputes and higher-impact incidents originate in recruitment-stage gaps. The common pattern is not that no checks were done; it is that checks existed but were inconsistent, informal and poorly evidenced.

Common failure points

1. Undefined thresholds and exceptions
2. Organisations often have recruitment policies but lack clear minimum standards by role type, governed exceptions and decision ownership when concerns surface.
3. Weak verification and referencing
4. Referencing can become box-ticking: incomplete requests, shallow verification, inconsistent follow-up when anomalies appear and limited capture of what was checked and why.
5. Unstructured online checks
6. This is probably the biggest gap. A hiring manager searches a candidate late at night, takes screenshots and forwards them to HR with “thoughts?”. The information sits in an inbox. Nobody is quite sure what was reviewed, what was relevant, whether the reviewer saw information they should not have seen or whether another candidate would have been treated the same way.
7. Social media checks are a common example: they are often subjective, ambiguous and partial, especially where profiles are curated, locked or split across multiple accounts.
8. Documentation gaps
9. Even when a decision is reasonable, many organisations cannot evidence what was reviewed, what was concluded, who decided and why the outcome was proportionate.

04 / Structured due diligence

What “good” looks like in practice

The aim is not to remove judgement. It is to make judgement fair, consistent and explainable.

Digital Risk Screening (DRS): where it fits

DRS provides a structured due-diligence input for roles where a defined safeguarding or trust risk justifies it. The employer retains responsibility for the appointment, its policies, legal obligations and proportionality assessment.

Safehire is designed to make the online stage more controlled. It examines publicly accessible material against defined risk categories across the surface to dark web, verifies identity and context, and subjects potential findings to human review. The output should state what was checked, what was found factually and why it may be relevant. It should never create an automatic rejection decision.

Potential indicators may relate to Child Sexual Abuse concerns, Radicalisation (UK PREVENT), hate-based conduct, or links to harmful or proscribed organisations. A finding remains a signal. The employer must assess accuracy, relevance, proportionality, candidate context and the wider evidence before reaching a decision.

Scope is as important as capability. Wider material should not be searched merely because it is technically accessible. Any activity beyond an ordinary search-engine check needs a defined purpose, a clear legal basis and controls proportionate to the role. The objective is disciplined risk visibility within a governed process.

This distinction also points to a wider people-security issue. The risk attached to trusted access can sit between HR, safeguarding, cyber and governance. DRS gives those functions a shared, evidence-led input while leaving the accountable decision with the organisation.

05 / Controls and evidence

Keeping the process lawful and defensible

The legal and data protection controls need to be built in from the start. Schools have specific obligations as data controllers under the UK GDPR, Data Protection Act 2018 and Data (Use and Access) Act 2025 when processing candidate personal data during recruitment.

Employers should be clear on the lawful basis, purpose, scope, candidate notice, access controls, retention period and decision process before checks are used. They should also define what information is in scope, what is out of scope, when candidate context will be sought and how subject access requests or complaints will be handled.

Candidates should be told that online searches may be carried out, what the purpose of those searches is, the kinds of information that may be considered, and how relevant findings will be handled. This notice should be given in the school’s privacy notice for job applicants and reiterated at the point of invitation to interview and shortlisting.

Where special category data or criminal offence data may be surfaced, employers should assess the lawful basis and applicable Data Protection Act 2018 condition before screening begins. In higher-risk use cases, this is likely to require a data protection impact assessment, an appropriate policy document, clear retention rules, access controls and a process for giving candidates an opportunity to comment on relevant findings before a final decision is made. All of this should be in place before any candidate screening happens.

The person conducting the online search should not usually be the person making the recruitment decision. Separating collection, assessment and decision-making helps reduce the risk that irrelevant protected-characteristic information, political views, family status or other non-job-related material influences the outcome.

The key point is simple: online due diligence should be designed, not improvised.

The one-page decision record

A short decision record can make a significant difference. A practical template captures:

1. The role and why it was treated as higher trust.
2. What checks were carried out.
3. What sources were in scope.
4. What material signals were found, if any.
5. Why those signals were relevant.
6. Whether candidate context was sought.
7. Who reviewed the information.
8. The decision and rationale.
9. Retention and access arrangements.
10. The date and approver.

This does not need to slow recruitment down. It simply means the organisation can explain itself if challenged.

06 / Taking action

What leaders should do now

A simple starting point is to map the current recruitment process against three questions:

• Where are we relying on individual discretion?
• Where would we struggle to evidence the decision?
• Where are we pretending a casual search is a control?

Those are usually the risk points.

Conclusion

Recruitment decisions in higher-trust settings sit within the organisation’s safeguarding, governance, legal and reputational risk framework.

The strongest organisations under scrutiny will not be those that searched the most. They will be able to explain what they checked, why it was relevant, who reviewed it, what was excluded and why the final decision was fair.

Anything less is hope with a screenshot.