What BS 7858 is, and what it is not
BS 7858:2019 is the British Standard code of practice for screening people who will work in a secure environment. Its full title is Screening of individuals working in a secure environment. Code of practice. It replaced the 2012 edition on 30 September 2019, and the older edition was formally withdrawn on 31 March 2020. This guide is written against the 2019 text, which is the edition SIA Approved Contractor Scheme assessments and most client contracts reference. Check the BSI shop for any amendment before relying on a clause number.
Two things are worth fixing in your mind before anything else.
First, BS 7858 is a screening standard, not a background-check menu. It describes a process: what the candidate must disclose, which checks come before an offer, how history is verified, who signs what, and how long the file is kept. A file that contains every "check" but cannot show who verified each item, when, and against what evidence is not compliant.
Second, the standard is deliberately built on risk. Clause 5 says an organisation should employ people only where their history indicates they are suitable, and just as importantly, that a failure to verify a period is not the same as evidence of unsuitability. Screening controllers who treat every gap as a red flag are as wrong as those who wave gaps through.
Is BS 7858 a legal requirement?
No. Like every British Standard it is voluntary in law, and its recommendations are written as "should", not "must". In practice it is close to mandatory for a large part of the UK security and facilities sector for three reasons:
- SIA Approved Contractor Scheme. ACS assessment expects screening to BS 7858, and an approved contractor supplying unscreened officers puts its approval at risk.
- Client contracts. Managed security, FM, data centre, airport, utilities and retail contracts routinely state that all deployed staff are screened to BS 7858 and that files are available for audit.
- Insurance and liability. When something goes wrong, the question asked is whether the employer took reasonable steps. Screening to a recognised standard is the clearest evidence that it did.
The standard does not replace any legal duty. Right to work checks under the Immigration, Asylum and Nationality Act 2006 are a separate obligation (the standard assumes you have done them, and lists right to work evidence among the information collected). Data protection law applies to every item in the file. And criminal record disclosures remain governed by the Rehabilitation of Offenders Act and the DBS eligibility rules.
Who must be screened
The standard uses the phrase relevant employment: any role that gives access to data, property, people or assets whose misuse would be a security risk. That is much wider than "security officer". The 2019 edition removed the 2012 focus on the security industry precisely so it could be applied anywhere a secure environment exists. Typical roles:
- Security officers, door supervisors, CCTV and control room operators, key holders and mobile patrol staff
- Data centre, server room and network operations staff, including contractors with badge access
- Facilities, cleaning and maintenance staff who work in sensitive areas, often out of hours (Clause 9 covers ancillary staff explicitly)
- Cash-in-transit, ATM engineering and cash centre staff
- Anyone handling confidential personal, financial or commercial information
- Agency and subcontracted staff placed into any of the above (Clause 8)
Two groups are easy to forget. Your own screening staff must themselves be screened to the standard, must never screen themselves, and must sign a confidentiality undertaking that survives the end of their employment (Clause 6). And under Clause 10, staff who transfer to you through an acquisition or TUPE must have their existing screening reviewed; if it cannot be evidenced, they are screened afresh within the screening period counted from the acquisition date.
The three stages every file passes through
Identity, address, sanctions, public records, full disclosure form. Nothing else starts until these are complete.
Preliminary checks plus a confirmed, continuous three-year history. Only now can a conditional offer be made and the person start work.
The whole five-year period verified in writing, criminal record check obtained, no unverified period over 31 days. Employment is confirmed only when this is complete, within 12 weeks of the conditional start.
The vocabulary matters because it appears in offer letters and audit findings. Limited screening is the minimum done before a conditional offer. Conditional employment is the period between that offer and the completion of full screening. Confirmed employment is granted only after full screening succeeds. An offer letter that does not distinguish the two is itself a non-conformance.
Information the candidate must provide (Clause 7.3.2)
The disclosure form is the foundation of the file. If it is incomplete, everything verified afterwards is verified against the wrong baseline. The standard lists what must be collected:
- Full name, all previous names and any aliases. Aliases are where identity fraud hides, and public record searches must be run against every name.
- Complete address history for the screening period with from and to dates, date of birth and National Insurance number
- Evidence of right to work, and the SIA licence number and expiry if one is held
- A continuous account of education, employment, self-employment, unemployment and every gap across the whole period. The period is a minimum of five years immediately before the relevant employment, or back to the candidate's sixteenth birthday if that is more recent. Some contracts and sectors require ten years.
- All cautions and convictions, including motoring offences, and any pending prosecutions, subject to the Rehabilitation of Offenders Act
- Bankruptcy proceedings, court judgments including satisfied ones, and individual voluntary arrangements within the period
- A signed acknowledgement that misrepresentation or omission will lead to withdrawal of the offer or dismissal
- Written authority to approach current and former employers, government departments and educational establishments. Electronic confirmation is valid under the Electronic Communications Act 2000, which is why an online application with a proper electronic signature record is acceptable.
- A signed declaration that employment is subject to satisfactory screening, that the information is true, and that the candidate consents to the screening described
Preliminary checks (Clause 7.4)
These are the minimum steps for every individual before a conditional offer is even considered:
- Open a separate screening file for the person and review the disclosure form in full, recording that it is likely the screening can be completed.
- Confirm identity from original documents. Photographic evidence is preferred (passport, photocard driving licence). The originals are inspected visually, checked for tampering, compared with the person in front of you, and a copy is retained with a note of who examined it and when. The DBS Group A and B document lists apply. For SIA licence holders, see the original licence, verify it on the SIA public register, and keep a copy of the register result.
- Confirm the current address from documents, again recording who examined them.
- Run a global watchlist check including the HM Treasury consolidated financial sanctions list.
- Obtain a public record report from a credit reference agency: electoral roll or known-at-address confirmation, linked addresses over five years, CCJs and IVAs, bankruptcy orders, aliases and date of birth. This is a public record search, not a credit score, and the candidate should be told so.
Three findings at this stage trigger a formal risk decision, covered under risk sign-offs below: a CCJ or CCJs over £10,000, bankruptcy, and a current or former directorship of another organisation.
Limited screening and the conditional offer (Clause 7.5)
A conditional offer may be made only when three things are true: the risk has been evaluated and documented as acceptable, the preliminary checks are complete, and limited screening is complete. Limited screening adds one thing to the preliminary checks: confirmed, continuous history for at least the most recent three years (or back to 16). Evidence can be oral, written or documentary, but two rules are absolute:
- The identity of whoever supplies the confirmation must itself be confirmed, and telephone numbers must be obtained independently. A number the candidate wrote on the form is never used for verification. This one rule catches more fabricated references than any other.
- The file records both the screening administrator who did the work and the screening controller who reviewed it. Two signatures, two people.
The conditional offer letter must say that confirmed employment depends on full screening being completed within the allowed period, and that conditional employment ends if it is not. HR templates written before 2019 often lack this wording.
The 12-week clock (Clause 7.6)
From the day conditional employment starts, full screening must be completed within 12 weeks for a five-year period, or 16 weeks for a ten-year period. The start date must be shown prominently in the file, because everything else is counted from it.
One extension of up to four weeks is possible, but only if the file shows evidence that written verification requests were actually sent, the extension is approved by top management or a person they have authorised, and the decision is recorded where an auditor can find it. An extension granted after the deadline has passed, or without the evidence of chasing, is not an extension.
If screening is still incomplete when the time runs out, the individual should not continue in relevant employment. In practice that means the operations team must know the deadline as well as the screening team does, which is why the best-run programmes surface the days remaining on every open file rather than in a spreadsheet nobody opens.
Full verification: what "confirmed" means (Clause 7.7)
Full screening is complete when the whole screening period has been verified with no unverified period longer than 31 days, and a criminal record check has been obtained. Verification means direct written confirmation from the employer, institution or agency concerned, not a photocopied reference the candidate brought with them. Where a reference arrives by email or text, the contact details are verified by direct contact and the file records how.
| Period type | Acceptable evidence |
|---|---|
| Previous employment | Written confirmation from the employer of the dates held. A completed BS 7858 file acquired from a previous employer may confirm all or part of the period. |
| Current employment | Only with the candidate's written permission. Until then, documentary evidence: NI records, or two or more of payslips, P60s for each year, a P45, a contract, bank statements showing wages, a company ID, employer correspondence. |
| Education | Confirmation from the institution of the leaving date, where it falls in the period. |
| Unemployment | Confirmation from the DWP or the relevant agency. "Records unavailable" is treated as an unverified period, not as verified unemployment. |
| Self-employment | HMRC, bank, accountant or solicitor confirmation, or trade and client references. |
| Career break | The reason established, with documentary evidence that supports the explanation given. |
| Living abroad | Overseas employers, passport dates, work permits. |
| Travel over 31 days | Tickets, bookings, visa or passport stamps, card and bank transactions, currency exchange, phone bills, references from people met while away. |
Every entry in that table produces evidence that must sit in the file with a record of who obtained it and when. The verification progress sheet (the standard's Form 2, or an equivalent) is the index that ties it together, one row per period, showing the first request, the second request, the confirmation received and the audit initials.
Gaps, travel and the 31-day rule
The 31-day rule is misunderstood in both directions. It does not say that any gap under 31 days can be ignored on the disclosure form: the candidate must account for the whole period. It says that once verification is complete, no unverified stretch may exceed 31 days. A three-week gap between jobs that the candidate explains as job hunting needs no third-party confirmation. A six-week gap does, and "I was looking for work" is an explanation, not evidence.
Good practice for gaps is to ask for the evidence that would exist if the explanation were true. Someone caring for a relative may have correspondence from a hospital or local authority. Someone travelling has bank transactions in the country concerned. Someone between jobs was usually claiming a benefit, which the DWP can confirm. The standard's list under Clause 7.7 is a list of places to look, not a list of hurdles.
Criminal record checks (Clause 7.7 j)
Full screening requires at least one of the following: a valid SIA licence for the sector concerned; an NPCC Appendix C police check (England, Wales and Northern Ireland); or a disclosure from the DBS, Disclosure Scotland or AccessNI. A basic disclosure is available for any role. Standard and enhanced disclosures are limited to roles that are eligible in law, and roles involving children or vulnerable adults may need a higher level than BS 7858 alone would require.
Two points are often missed. An SIA licence is accepted because the SIA has already run a criminality check, so the licence must be current and verified on the register, not simply photocopied. And a disclosure that shows something is the start of a decision, not the end of one: the organisation's written criteria, the relevance of the offence to the role, its age and the candidate's explanation are all weighed, and the reasoning is recorded.
Risk sign-offs: who accepts what
The standard puts the risk where it belongs, with top management. Certain findings cannot be cleared by a screening administrator or even the controller alone. Each requires a named senior person to review the documentation and sign that the organisation accepts the risk (the standard's Form 5):
- A single CCJ, or CCJs in total, over £10,000, whether satisfied or not
- Bankruptcy
- Being, or having been, a director of another organisation
- A statutory declaration used in place of verification (see below), which needs prior approval
- An extension to the 12 or 16-week period
The signature is the evidence. An auditor who finds a CCJ on the public record report and no signed acceptance on file has found a non-conformance even if the candidate turned out to be entirely suitable.
Statutory declarations: the last resort (Clause 7.7 i)
When a period genuinely cannot be verified, the candidate may swear a statutory declaration before a solicitor, commissioner for oaths, notary or justice of the peace under the Statutory Declarations Act 1835. The standard limits this tightly. Within the most recent five years it may cover one unverified period of up to six months. For earlier years in a ten-year screening, it may cover unverified periods totalling no more than six months per five-year block. Use of a declaration needs documented top-management approval in advance, and the file must show that the normal process was tried and demonstrably could not complete.
A programme that reaches for statutory declarations routinely, or uses them to cover two or three separate gaps, is not screening to the standard.
Records and retention (Clause 11)
- Candidates who fail at the preliminary stage: keep the file for at least 12 months, then dispose of it securely.
- During employment: keep the complete file.
- After employment ends: keep the core of the file for seven years. The standard lists what must survive: the written information provided, the signed misrepresentation statement, proof of identity, the confirmation of continuous career record, the verification progress sheet, the employment verifications, any statutory declaration, and any acceptance of risk.
Files must be kept separately per individual, conditionally employed staff must be identifiable separately from confirmed staff, and the information is confidential and secured to a recognised information security framework (the standard points to ISO 27001 and ISO 27002). Under UK GDPR your retention schedule must say all of this in writing, and candidates must be told at the point of collection.
2012 to 2019: what actually changed
| Area | BS 7858:2012 | BS 7858:2019 |
|---|---|---|
| Scope | Security industry focus | Any secure environment, any sector |
| Approach | Prescriptive checklist | Risk assessment throughout; top management owns the risk |
| Character references | Required | Removed as too easy to abuse |
| Social media and open-source checks | Not addressed | Not a screening provision; may only be additional information, with a discrimination warning |
| Outsourced screening | Largely silent | Organisation retains full responsibility and must review the completed file itself |
| Automation and e-signatures | Paper assumed | Electronic processes and confirmations recognised |
| Annex A forms | Fixed | Informative and customisable |
The outsourcing change is the one that bites. If you use a screening provider, the provider does the work, but you remain responsible for the file and are expected to review it when complete. A provider that returns a "pass" with no file behind it has not discharged your obligation.
Where files fail audit
From reviewing screening files across security, FM and care providers, the same findings come up again and again. None of them involve a candidate being unsuitable; all of them involve the file being unable to prove what was done.
- The reference was obtained on the candidate's phone number. Clause 7.5.2 is explicit that numbers are independently ascertained. A referee reached on a number from the application form is evidence of nothing.
- No conditional start date on the file. Without it the 12-week clock cannot be shown to have been met.
- One signature where two are required. The administrator who did the work also "reviewed" it. Controller and administrator must be different people.
- A CCJ, bankruptcy or directorship on the public record report with no signed risk acceptance.
- Unemployment "verified" by the candidate's word. DWP confirmation was never requested, so the period is unverified and may exceed 31 days.
- Identity documents copied but not examined. No note of who saw the original, or a copy that was emailed in by the candidate.
- A statutory declaration used for convenience, covering multiple gaps or obtained without prior approval.
- The offer letter promises unconditional employment, or omits the statement that conditional employment ends if screening is not completed in time.
- Previous names and aliases not asked for, so public record and criminal checks were run against one name only.
- Outsourced screening never reviewed. The provider's summary sits on file; the underlying verifications do not.
A worked 12-week timeline
This is what a well-run five-year screening looks like for a security officer who starts conditionally on day one. Exact days vary; the sequence does not.
The screening controller's checklist
Ten questions to ask of any file before you sign it off. If the answer to any of them is "I think so", the file is not ready.
- Does the disclosure form cover the whole period, with previous names and aliases, and is it signed?
- Was the candidate interviewed before the offer?
- Who examined the original identity and address documents, and on what date?
- Were the sanctions check and public record report run against every name, and are the reports on file?
- Is the conditional start date shown prominently, and does the offer letter carry the 12-week condition?
- Was every telephone reference taken on a number we sourced ourselves?
- Is there written confirmation for every period, with no unverified stretch over 31 days?
- Has every CCJ over £10,000, bankruptcy, directorship, statutory declaration or extension been signed off by top management?
- Is the criminal record check, SIA register result or police check on file and current?
- Are the administrator and the controller two different named people, both signed?
Screening Portal builds the file the way the standard describes it.
Online application with electronic signature record, sanctions and SIA register checks run from the form, referee links that record consent and evidence codes, the 12-week clock on every open file, Form 4 and Form 5 sign-offs built in, and a seven-year retention report. Your controller reviews and countersigns; the system keeps the audit trail.
Frequently asked questions
Can someone start work before screening is finished?
Yes, on a conditional basis, once the preliminary checks and limited screening (three years confirmed) are complete and the risk has been documented as acceptable. Full screening must then finish within 12 weeks, and the offer letter must say that conditional employment ends if it does not.
Does BS 7858 replace a right to work check?
No. Right to work is a separate legal duty on every employer. The standard assumes it has been done and lists right to work evidence among the information collected, but a BS 7858 file is not a statutory excuse.
Is a credit check part of BS 7858?
No. The standard requires a public record search through a credit reference agency (electoral roll, linked addresses, CCJs, IVAs, bankruptcies, aliases). It is not a credit score and does not assess creditworthiness. Candidates should be told the difference.
How far back does screening go?
A minimum of five years immediately before the relevant employment, or back to the candidate's sixteenth birthday if that is more recent. Some contracts require ten years, in which case the completion period is 16 weeks rather than 12.
Can a candidate fail?
The standard talks about suitability rather than pass and fail. A candidate can be found unsuitable on the evidence, or the organisation can decline to accept a risk that needs a senior sign-off. A period that could not be verified is not by itself evidence of unsuitability, and the candidate should be given the chance to provide evidence before a decision is made.
Do we need to re-screen existing staff?
The standard does not set a re-screening interval. Many clients and the SIA ACS expect periodic review, and a common contractual position is a refreshed criminal record check and public record search every three years, with full re-screening after a break in employment.
What about agency and subcontracted staff?
Clause 8: before engaging them you either hold evidence that the supplier screens to BS 7858 (UKAS-accredited certification with BS 7858 in scope, or SIA approved contractor status, plus a written statement that the individuals supplied were screened), or you obtain the completed file, or you screen them yourself.
Can we check a candidate's social media?
The 2019 edition is clear that social media and open-source checks are not a screening provision. They may only ever be additional information, and the standard warns of the discrimination risk in using them. They never substitute for a verification the standard requires.
This guide is a plain-English explanation of BS 7858:2019 written by Screening Portal's screening controllers. It is not a substitute for the standard itself, which is available from BSI, or for legal advice on employment, immigration or data protection law. Clause references are to the 2019 edition.