The Gap Between Policy and Practice

Why background screening programs can quietly drift from their written standards

Most organizations can produce a screening policy on request. Far fewer can prove the program actually runs the way the policy says it does.

‍Ask most employers for their background screening policy and you will get a document. It will be reasonably thorough. It will name the roles that require screening, the categories of checks that apply, the adjudication standards, and the process for handling adverse information.

Ask the same employer to demonstrate that the program runs the way the document describes, and the conversation changes.

The policy is not the program. The policy is a description of the program. And over time, those two things drift apart — not because anyone decided to ignore the policy, but because the policy is written in prose and the program is executed in configuration.

The Policy Is Prose. The Program Is Settings.

A screening policy says that safety-sensitive roles require a motor vehicle record check and the criminal history searches established for that role and jurisdiction.

The screening program says whatever the package — the bundle of checks assigned to that role — says. And that package was built at some point by someone, mapped to a job code, and has been running ever since.

Nobody rereads the policy before launching a search. They select a package. If the package was built correctly and the job code was mapped correctly, practice matches policy. If it was not — or if the role changed, or a new position was created and mapped to the nearest available code — practice quietly diverges, and the policy document keeps saying what it always said.

This is the core of the gap. Policy is reviewed by people. Practice is executed by systems. The two are almost never audited against each other.

The Exception Becomes the Default

The second source of drift is the accommodation nobody wrote down.

A hire is urgent. Someone approves running a reduced package to get the candidate started, with the balance to follow. The candidate starts. The balance does not follow.

A result comes back with a record that is not clearly covered by the adjudication matrix. Someone makes a reasonable judgment call. That call is not documented, and the next similar case is decided by a different person on different reasoning.

None of these decisions is unreasonable in the moment. Each one is a small, defensible departure. But departures accumulate, and they accumulate in the direction of speed, because that is the pressure the screening process is under. Over enough cycles, the exception stops being an exception. It becomes how the process actually runs — while the policy document continues to describe how it was designed to run.

The Gap Only Becomes Visible Under Pressure

An organization can live inside this gap for years without incident.

It becomes visible at a specific moment: when someone external asks two questions in sequence. What is your policy? And then: show me the records.

That is a client audit. It is a regulator. It is opposing counsel in a negligent hiring claim. It is a customer's procurement team reviewing vendor controls before a contract renewal.

In each case, the first question is easy. The document exists. The second question is where the exposure sits — because the records reflect what the system actually did, not what the policy said it would do. A written policy does not erase contradictory records. In an audit, dispute, or client review, the inconsistency can raise difficult questions about whether the organization followed its own standard.

Consider a common scenario. An organization reviewing its screening program may find that several newer job codes were mapped to the closest existing package rather than the package required by policy. Nothing looks unusual during routine hiring. The difference only surfaces when the organization compares its written standards with the checks that were actually ordered.

Closing the Gap Is a Reconciliation, Not a Rewrite

The instinct, when a gap like this surfaces, is to rewrite the policy. That is the wrong move. The policy is usually fine. It is the reconciliation that is missing.

The exercise is straightforward, and most organizations have never run it. Pull the written policy. Pull the actual package configurations and job-code mappings from the screening system. Put them side by side. For every role category the policy names, confirm the package assigned to it delivers exactly what the policy promises — no more, no less. Then pull a sample of completed screens and confirm the packages that actually ran are the ones that were supposed to.

Where the two disagree, one of them is wrong. Sometimes the configuration needs to change. Sometimes the policy was written for an organization that no longer exists and needs to be updated to reflect a defensible current standard. Either resolution is fine. What is not fine is leaving them unreconciled and assuming the document is the truth.

Just as important, assign an owner. Someone should be responsible for confirming that policy changes reach the system, and that configuration changes are reflected in the policy.

Reconcile the two at least annually, and again whenever roles, jurisdictions, systems, or screening requirements materially change. That keeps the gap from widening unnoticed.

‍

If it is time to confirm that your screening program runs the way your policy says it does, Liberty Screening Services can help you reconcile the two before someone else does it for you.
‍

Related reading: Where Compliance Breaks Down Across Locations

‍