SOC 2 Background Check Requirements: What Auditors Actually Expect

Ask a room of compliance leaders whether SOC 2 requires background checks and you will likely get several different answers. Some will say yes, absolutely. Others will say no, it is optional. The truth sits in between, and understanding the difference between formal SOC 2 criteria and the controls your organization designs to meet them is essential to passing an audit without overbuilding your program.

It also matters beyond the audit. Background screening is one of the first lines of defense against personnel-related risk. When treated as an dismissive administrative exercise without any teeth, background checks add cost without reducing much risk. But when employed as part of a deliberate personnel security strategy, it helps ensure that the people trusted with sensitive data and critical systems deserve that trust.

What SOC 2 Actually Requires

SOC 2 reports are based on the American Institute of Certified Public Accountants’ (AICPA) Trust Services Criteria (TSC). The criteria describe outcomes, not specific procedures, and none of them explicitly require organizations to perform background checks. Instead, the following criteria create the expectation that an organization will deliberately evaluate the people it hires:

• CC1.1: The entity demonstrates a commitment to integrity and ethical values, which auditors often link to how candidates are vetted before joining.
• CC1.4: The entity demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives. This is where hiring practices, including screening, are most often evaluated.
• CC6.2: New users are registered and authorized before system access is granted, which raises the question of whether screening is completed before access begins.

This is the key distinction. The formal criteria set an expectation that your organization designs the controls that meet the standard. If your system description and policies say that all employees with access to customer data must complete a background check before their start date, that becomes a control your auditor will test. Background checks are not required by name, but once you commit to them, you must perform them consistently.

The Risks Background Checks Help Address

Taking steps that minimize the danger of harmful actions taken by malicious insider risk is important, because that threat is expensive and growing. The Ponemon Institute’s 2025 Cost of Insider Risks Global Report found that organizations spend an average of $17.4 million a year on insider-related incidents, up from $15.4 million in 2022. Malicious or criminal insiders accounted for 25% of security incidents and cost an average of $3.7 million per event.

Background screening cannot stop every insider threat, and it does little to prevent negligence, which drives most incidents. But it helps reduce specific, foreseeable risks, such as:

• Misrepresented Credentials: Verifying identity, employment history, education, and professional licenses confirms that candidates are who they say they are and qualified for the role.
• Relevant Criminal History: Where legally permitted and job-related, criminal record checks can identify past fraud, theft, or similar offenses relevant to roles with financial or data access.
• Fraudulent or Proxy Hires: Identity verification helps detect impostors and remote candidates using stolen or fabricated identities to gain access.
• Customer and Contractual Expectations: Many enterprise customers and regulators expect screening for personnel who handle their data.

How SOC 2 Background Checks Complement Personnel Security

A typical background check process follows a consistent path:

• Set the Policy: Define screening requirements by role in a written policy.
• Obtain Consent: Extend a conditional offer and obtain the candidate’s written authorization.
• Run the Checks: Use a reputable, compliant screening provider.
• Review Results: Evaluate findings against documented criteria and follow required adverse action procedures.
• Grant Access and Retain Records: Complete screening before granting access to sensitive systems, then store results securely.

Screening is only one control in the employee lifecycle. Auditors look at how it connects to the rest of your personnel security program:

• Hiring Controls: Job descriptions, interviews, signed confidentiality agreements, and acknowledgment of the code of conduct and security policies.
• Access Management: Role-based access provisioned only after onboarding steps are complete, with periodic access reviews and prompt removal at termination.
• Workforce Risk Controls: Security awareness training, performance management, disciplinary processes, and monitoring for unusual activity.

As we note in our SOC 2 compliance checklist, inconsistent background checks, undocumented onboarding, and informal offboarding are among the most common gaps uncovered during readiness assessments.

When Background Screening Is Appropriate

How individual organizations constitute their background screening process depends on several factors. The right approach depends on your risk assessment, the data you handle, and the laws where you hire. Screening is generally appropriate in these situations:

• New Hires with System Access: Employees who will access production systems, customer data, or financial systems should typically be screened before their first day of access.
• Privileged and High-Trust Roles: Administrators, engineers with production access, finance staff, and executives may warrant more extensive checks.
• Contractors and Third Parties: Contractors with comparable access should meet comparable standards, either through your own checks or contractual requirements for their employer.
• Role Changes: Employees moving into more sensitive roles may need additional screening.
• Periodic Rescreening: Some organizations rescreen high-risk roles on a set schedule, particularly in regulated industries.

Legal requirements shape every program. In the U.S., the Fair Credit Reporting Act governs consent and adverse action, and many states and cities restrict when and how criminal history can be considered. International hiring adds further limits, so involve legal counsel when designing your policy.

What Evidence Auditors Expect

In a Type II audit, auditors typically select a sample of people hired during the review period and trace each one through your process. Be prepared to provide:

• A Written Policy: A screening policy that defines who is checked, what checks are performed, and when they must be completed.
• Completion Records: Evidence for each sampled hire showing the check was performed, the provider, and the completion date.
• Consent Documentation: Signed authorizations demonstrating legally compliant collection.
• Access Timing: Records showing that system access was granted only after screening was complete, or documented approval for any exceptions.
• Exception Handling: A log of exceptions, such as delayed results or international hires, with risk-based approvals and compensating controls.
• Contractor Evidence: Contractual clauses or attestations confirming that third-party personnel meet your screening standards.

Auditors are not judging whether your checks are the most thorough possible. They are testing whether your controls are designed to address risk and whether you follow them consistently.

Striking the Right Balance with an Experienced Partner

Personnel security controls require balance. Screening too little leaves gaps that insiders and impostors can exploit. Screening too aggressively, or applying rules your team cannot follow consistently, slows hiring, creates legal exposure, and produces audit exceptions. The goal is a policy that matches your risk profile and operates reliably every time.

A qualified SOC 2 auditor can help you strike that balance. Experienced auditors understand how the AICPA’s TSC are interpreted in practice, which controls customers and auditors expect for your industry, and how to document personnel controls so they hold up under testing.

IS Partners brings more than 20 years of experience and hundreds of completed audits to the job. Our senior-level, U.S.-based teams guide organizations from readiness assessment through SOC 2 Type I and Type II reporting. Learn more about IS Partners’ SOC 2 audit services.

Ready to build personnel security controls that satisfy auditors without slowing your business? Schedule a free 30-minute consultation with an IS Partners SOC 2 expert.