The Gap Between Access and Verification

Most companies scrutinize access rights closely — who can open which system, who holds which permission. The person behind the login often gets far less scrutiny. That gap is exactly what leads companies in Germany to ask which background checks make sense before hiring, and it's a question Validato, a background screening and human risk management provider working across more than 200 countries, answers every day.


A company can run tight technical security and still onboard someone whose core claims about themselves were never checked, before that person reaches sensitive data, infrastructure, or intellectual property. Background checks close part of that gap.

Screening by Risk, Not by Default

A good screening process isn't about collecting as much information as possible — it's closer to the opposite. It should verify only what's actually relevant to the role in question. Someone without sensitive access might need a light check; an administrator with privileged access, a Chief Financial Officer (CFO), a developer with source code access, or a leadership role in a security-critical business warrants something more thorough. What belongs in that check depends on the country, the function, and the legal basis, but typically includes:


• Identity verification: confirms candidates are exactly who they claim to be, closing a gap that's only grown with remote interviews and fully digital onboarding

• Employment verification: checks that past roles actually hold up, so hiring decisions rest on fact rather than a polished CV

• Education and qualifications: verifies degrees and certifications are genuine, protecting roles where expertise really matters

• Criminal record checks: carried out where legally required and permitted, adding assurance for sensitive or regulated positions

• Publicly available integrity information: gathered with defined sources, relevance, and privacy safeguards, giving a fuller picture without overreaching

What Screening Can — and Can't — Do

Background checks can surface inconsistencies, confirm identity, catch false or unconfirmable claims, and give decision-makers more to work with for a structured risk assessment. What they can't do is predict whether someone will become an insider threat down the line. That's why Validato treats background screening as one part of a broader human risk management framework, not a standalone fix.


This isn't just a vendor's talking point, either — Germany's Federal Office for the Protection of the Constitution explicitly names pre-employment screening as a possible safeguard against insider risk, alongside awareness training, information protection, and an established security culture.

Verification, Not Surveillance

Reducing risk isn't the same as collecting unlimited data. A professional process should account for purpose limitation, data minimization, defined retention periods, transparent candidate communication, proper consent or legal grounds, risk-based screening levels, and documented decisions. A software developer with access to critical source code and someone in an administrative role simply don't need the same check.


In Validato's view, the better question isn't whether every candidate gets screened the same way — it's which roles carry the most risk, and how much verification actually reduces it. That turns background screening into part of risk management, not just a hiring step, focused on the person, their role, and the access they're given. Validato brings that approach to companies worldwide, wherever hiring decisions really matter for security.