Screening

Plain-language summary

Checking that the people you trust with information are who they say they are and suitable for the role — background verification before they start and on an ongoing basis afterwards, proportionate to what they will access and the risk, and done lawfully.

What the clause is really asking

This control makes trust rest on verification rather than a good interview. It asks you to verify candidates' backgrounds before they join and to carry on verifying during employment — the control says on an ongoing basis — with checks scaled to the role: the information they will handle, the access they will hold and the business risk. Typical checks are identity, right to work, references, qualifications and, only where the role justifies them, criminal record or credit checks. Contractors and agency staff count too, checked by you or by the agency under contract. The common misunderstanding is that one blanket set of checks for everyone is safer; in South Africa it is often unlawful. Screening is processing of personal information, so candidates must be told and give consent under POPIA; criminal-record information is special personal information (section 26); the Employment Equity Act requires checks to be fair and linked to the inherent requirements of the job; and the National Credit Act rules limit employment credit checks to roles handling cash or finances. Decide in advance what happens if a check is incomplete on day one.

What auditors look for

Auditors ask for the screening procedure and the matrix that says which checks apply to which roles, then sample recent starters — including a contractor and someone in a privileged IT or finance role — and ask for evidence each check was done before access was granted. They compare check dates with start dates and with the date the first user account was created. They ask what happens when a check comes back adverse or late, and who decides. They look for the candidate's consent and the privacy notice, and ask where reports are stored, who can see them and when they are deleted. The hard question: show me the screening for the system administrator who joined through an agency.

Typical evidence

Screening procedure and role-based check matrix; candidate privacy notice and signed consent forms; completed check records or vendor reports per starter (identity, qualifications, references, criminal or credit where justified); agency and contractor screening clauses and confirmations; records of adverse findings and decisions; account-creation dates for comparison; retention and deletion rule for screening reports; rescreening records for moves into higher-trust roles and for periodic re-checks.

How to comply — recommendations

Write a one-page screening procedure built around a matrix: role groups down the side (general staff, finance and payroll, IT administrators, people with access to customer design data, contractors), checks across the top, and a one-line justification for each tick. Add a consent clause and privacy notice to the application form so POPIA is covered before the first check. Use a reputable screening vendor and keep their reports in a restricted HR folder with a deletion date. Put a clause in labour broker and contractor agreements requiring equivalent checks and written confirmation. Tie account creation to HR's screening sign-off so IT cannot provision a user before it exists. Rescreen when someone moves into a higher-trust role, and set a re-check cycle for high-trust roles so screening stays ongoing.

Common nonconformities

Screening completed after the person started and received system access; no defined checks by role, so either none or excessive checks applied; contractors and agency staff never screened; no candidate consent or privacy notice on file; criminal or credit checks run for every role without justification; screening reports kept indefinitely in shared folders; adverse findings with no recorded decision.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.