Keep a Background Check Consent Log That Can Survive an Audit

Define the scope before collection

Write the check types in scope, the roles they apply to, the information sources that may be contacted, and the decision the check supports. Include the countries or jurisdictions involved and the person who approves an exception. Scope should be narrow enough that a candidate can understand what will happen and what will not.

Have qualified Philippine counsel review the disclosure and the consent process for the jurisdictions in play. The support lane can maintain the record and route questions, but it should not draft a legal permission or decide whether a check is lawful. Record the approved text and the approval date as the controlled source.

Version the disclosure text

Give each disclosure version an identifier, a publication date, a summary of changes, and an effective date. When the text changes, keep the old version available so an earlier consent can still be matched to the words the candidate actually saw. Do not update the text in place.

Link every consent event to the exact version. A log that says consent was given without a version cannot show what was agreed to after the disclosure changes. This is the most common weakness in a consent record and the hardest one to repair later.

Keep a small index that maps each version to the consent events that used it. The index makes a later audit possible without opening every candidate file, and it shows quickly whether an old version is still being presented after its retirement date.

Capture consent as an event

Record the candidate key, the disclosure version, the scope, the timestamp, the channel, the language, and the evidence location. If the consent is electronic, preserve the audit trail from the system. If it is on paper, store a scanned copy in the restricted location and record the original location.

Do not record consent as a yes or no field on a spreadsheet without the evidence behind it. The event record should let a reviewer reconstruct who saw what, when, and how. If a candidate later asks for proof, the log should answer without a search through email.

Record withdrawal and its consequence

A withdrawal is a new event, not an edit to the original consent. Record the date, the channel, the scope withdrawn, the evidence, and the person who received it. Notify the owner who can stop the check or the use of the result, and record the action taken.

The consequence depends on the applicable rule and the stage of the process. Do not decide that consequence inside the support lane. Route it to the authorized owner and qualified counsel, and keep the question and answer with the record. The log should show that the withdrawal was received and acted on, not that it was quietly noted.

Restrict access to the smallest group

Consent records contain identity and sometimes sensitive details. Give access only to the roles that need it for the defined purpose. Use named accounts, role based permissions, and an access review. Do not share a single recruiting inbox as the identity for the log.

Record access grants and removals with a date and approver. If a vendor performs the check, confirm the data sharing terms and the vendor access list. A vendor portal can become an uncontrolled copy, so the contract and the access review should cover it explicitly.

Review the access list after a role change or a vendor change, not only on a calendar date. A person who moves to a new team may keep old permissions for months if the review is annual and no one checks the transfer. Record the removal as well as the grant.

Separate administrative facts from adjudication

The consent log can show that a check was authorized and completed. It should not contain the recruiter's opinion about the result or the final employment decision. Keep the result in a restricted file and the adjudication with the authorized decision owner.

This separation protects the candidate and the reviewer. A support team member who can see the result may be pressured to interpret it. A clear boundary lets the lane maintain the permission record and the status while the qualified owner handles the judgment.

Set retention and deletion evidence

Decide how long each record is kept, what triggers deletion, and who performs it. Base the period on the approved policy and applicable law, not on storage convenience. Record the retention rule beside the record so a later reviewer does not have to guess.

Deletion should produce evidence: the date, the record identifiers, the method, and the person who confirmed it. A note that says deleted is weak. A deletion log that can be matched to the record inventory is stronger and also shows that old consent records are not accumulating indefinitely.

Rehearse a subject request

Run a tabletop exercise for a candidate who asks what was collected, who saw it, and how to withdraw. Walk through the search, the identity check, the response owner, the deadline, and the redaction rules. Fix any gap before a real request arrives.

The exercise should include a request that spans the consent log, the vendor, and the result file. Most failures appear at the boundary between systems. Record the exercise date, the participants, the gaps found, and the repairs, then repeat after a material change in vendor or process.

Keep the exercise notes with the process documentation and assign the repairs. A rehearsal that produces a list but no owner is a discussion, not a control.