A.6.1 Screening
Background-check candidates and personnel proportional to risk and classification, within the law.
20
artefacts
2
held by a system
5
at each review
hard
to go live
HR system / LMS
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Decision log linking risk level to screening method · SIEM / log platform
- Log of screening exceptions and approvals · SIEM / log platform
periodic reviewEvidence produced at each review
- Sample risk assessment worksheet · HR system / LMS
- Criminal record check certificate · Document repository
- Annual re‑screening record for existing staff · SIEM / log platform
- Record of periodic background check updates · SIEM / log platform
- Third‑party screening audit report · HR system / LMS
governing documentDocuments that govern the control
- Screening policy document · HR system / LMS
- Roles and responsibilities matrix for screening · Policy repository / GRC workspace
- Policy version approval record · HR system / LMS
- Policy distribution acknowledgment list · HR system / LMS
- Risk classification matrix for positions · HR system / LMS
- Procedure for determining screening depth · HR system / LMS
- Background check report for new hire · HR system / LMS
- Education verification report · Document repository
- Employment history verification · Document repository
- Documented remediation actions for screening findings · Policy repository / GRC workspace
- Vendor background check report · HR system / LMS
- Contractor screening questionnaire · HR system / LMS
- Compliance certificate from screening provider · HR system / LMS
First move
Mostly documents and reviews. Pull the 2 system-held artefacts from your SIEM / log platform on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- One‑size‑fits‑all screening regardless of risk
- Missing documentation of approvals for exceptions
- Screening performed without evidence of legal compliance
- Failure to retain records for required retention period
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetA.5.37 Documented operating procedures · A.6.2 Terms and conditions of employment