Candidate verification for employers: what to check at each stage, from shortlist to offer
Candidate verification for employers works best as a planned sequence, not a scramble before the offer. Decide which claims the job really depends on, check each one at the stage where it matters, tell the candidate what you are checking and why, and keep only what you need once the decision is made. This guide sets out that process for small and mid-size businesses in Australia and New Zealand, from the shortlist to the signed offer.
What candidate verification covers, and where it stops
Verification tests facts: where and how long the person worked, the qualification or licence they hold, who they are and whether they can legally work here.
It is different from judging fit. Keep the two apart in your notes: a confirmed date is a fact, a referee's view of someone's attitude is an opinion. The OAIC says a referee's comments about an applicant's career, performance, attitudes and aptitude can be personal information about the applicant, and may also be about the referee.
If you already suspect a claim is padded, our guide to warning signs of fake work experience on a CV covers what to question first.
Start from the job, not the person
Before anyone applies, write down the claims the hiring decision rests on: for a site supervisor, perhaps years of supervision and a current licence.
The OAIC's APP 3 guidelines say an organisation may collect personal information that is "reasonably necessary" for its activities, and that it is not enough for it to be merely helpful, desirable or convenient. Employment New Zealand says pre-employment checks must be relevant to the safe and proper performance of the job and must not be used to discriminate unlawfully.
Business.gov.au says employers must not discriminate against applicants because of attributes such as race, national extraction, sex, age or religion. Use the same checks for everyone who reaches the same stage, so no candidate is singled out because of where they come from.
The candidate verification process, stage by stage
| Hiring stage | What to verify | What to tell or ask the candidate |
|---|---|---|
| Application | Nothing yet beyond the CV and answers | Which checks you will run later, and at which stage |
| Shortlist | Licences and registrations on public registers; work rights for visa holders | Permission for VEVO or VisaView; licence numbers |
| After interview | Work history and references | Referee details and permission to contact them |
| Preferred candidate | Qualifications, identity, police or criminal record checks where the role justifies them | Written consent for each check and what it covers |
| Offer | Anything still outstanding, named in the offer | A conditional offer that says what happens if a check fails |
The OAIC gives, as an example of a collection that may not be reasonably necessary, collecting information about all job applicants when it is only required for shortlisted candidates. The rule of thumb: the deeper the check, the later and narrower it runs.
How to verify candidates claim by claim
Work history and references
The Fair Work Ombudsman's reference checking template says to ask for referee details at interview and get permission to contact them. Employment New Zealand says employers should only contact referees the applicant provides, and must get permission before contacting a current employer who is not a nominated referee.
Call referees on a number you found yourself. For the records that confirm an Australian job, see our guide to employment verification in Australia; for referees abroad, how to confirm an overseas referee you cannot meet.
Qualifications, licences and registrations
Business.gov.au lists checking the licences or qualifications a job needs as a hiring step. Where a public register exists, check it yourself: the NSW Government's home building licence check shows a licence's status, expiry and conditions. For health roles, use Ahpra's public Register of practitioners; Ahpra says international health practitioners cannot work in their profession in Australia before they are registered. A qualification or RPL does not make someone a registered nurse or an enrolled nurse.
Identity
The Document Verification Service checks whether the name and date of birth on an Australian-issued document match the original record, and does not check photos. The identity verification services site says a match result should not be the only basis for a decision.
Work rights
Home Affairs tells employers to check visa work conditions through the free online system VEVO, with the visa holder's permission. In New Zealand, Employment New Zealand says employers must check the right to work before employing someone, and Immigration New Zealand's VisaView service needs the visa holder's consent, given verbally or in writing.
Police and criminal record checks
Under the Privacy Act, criminal record information is sensitive information, and the OAIC says organisations should generally seek express consent before collecting it. The ACIC says a police check needs the applicant's informed consent. Employment New Zealand says an employer needs written approval to request a criminal record, and the clean slate rules mean some applicants do not have to disclose old convictions. For candidates who lived abroad, see our guide to background checks for overseas candidates.
If the role needs a criminal history check, our step-by-step guide to a national police check for employers covers consent, timing, reading the result and storage.
Consent and notice: what candidates should hear from you
Consent and notice are not the same thing. The OAIC says an organisation cannot infer consent simply because it gave notice, and lists four elements of valid consent: the person is adequately informed, agrees voluntarily, the consent is current and specific, and they have the capacity to understand and communicate it.
Under APP 5, an organisation must take reasonable steps to tell the person about a collection at or before the time, or as soon as practicable after, and the OAIC says this includes information from a third party such as a referee.
New Zealand added a similar rule this year: the Privacy Amendment Act 2025 brought information privacy principle 3A into force from 1 May 2026. The Privacy Commissioner says an organisation collecting information from someone other than the person must take reasonable steps to make sure they know it was collected, why, who will receive it, and that they can access and correct it. An older reference consent form is worth reviewing against that.
A short line in your interview invitation covers most of this: "If you reach the final stage, we will contact the referees you nominate and check the licence the role needs. We will ask before contacting anyone else."
When a check is slow: keeping it fair
The ACIC says the National Police Checking Service aims to finish 95 per cent of checks within 10 business days, with around 30 per cent referred to police agencies because a possible match is found. New Zealand's Ministry of Justice says it aims to answer criminal record requests within 20 working days.
A delay or a mismatch is a question to ask, never proof that someone lied. Tell the candidate what is outstanding and let them explain or offer another way to confirm it.
A conditional offer keeps a good candidate while you wait. Business.gov.au says an employer still checking references can make a conditional offer, then a written offer if no issues are found. Employment New Zealand says such an offer should make clear what happens if results are unsatisfactory or the information given was false or incomplete.
- List the claims the job depends on and the check for each, before you advertise.
- Say in the interview invitation which checks the final candidates will go through.
- Check public licence and registration records for the shortlist.
- Ask for referee details and permission at interview, and call on numbers you found yourself.
- Get written consent for police, criminal record, identity and visa checks from the preferred candidate only.
- Make a conditional offer that names the outstanding checks.
- Record what was checked, when and by whom, then set a date to delete what you no longer need.
Storing and deleting what you collect
Under APP 11.1 an organisation covered by the Privacy Act must take reasonable steps to protect personal information from misuse, loss and unauthorised access, and under APP 11.2 destroy or de-identify it once it is no longer needed.
The OAIC says the employee records exemption does not cover unsuccessful applicants. It also says most small businesses with an annual turnover of $3 million or less are not covered by the Privacy Act, though some are regardless of turnover, such as health service providers. In New Zealand, the Privacy Commissioner says agencies should have a clear retention policy and apply it consistently.
Write notes as if the candidate will read them. The OAIC says a job applicant can generally ask for access to information about them, and that as a general guide a reply should not take longer than 30 calendar days. The Privacy Commissioner says New Zealand applicants can ask for interviewers' notes.
Where verified profiles fit
When you search through Talent Tabloid's people search, a profile can show work history confirmed by the person the candidate nominates, or through document review, alongside a video intro and work evidence. Read what was confirmed and by whom, then run the checks your role still needs. The employer page explains how searching and contacting candidates works.
Common mistakes when you verify job applicants
- Running police and identity checks on every applicant instead of the preferred candidate.
- Treating a notice in the job ad as consent for every check that follows.
- Calling people the candidate did not nominate, or a current employer, without asking first.
- Reading a slow result or a database mismatch as proof of dishonesty.
- Starting someone on an unconditional offer before outstanding checks are back.
- Keeping unsuccessful candidates' police results, ID copies and referee notes indefinitely.
This guide is general information, not legal advice. Rules can change: check the official government website, or get advice for your situation, before you act.
Frequently asked questions
What is candidate verification for employers?
It is the set of checks an employer runs to confirm what a candidate has claimed: work history, references, qualifications and licences, identity, work rights and, for some roles, criminal history. A good process checks only what the job needs, at the stage where it is needed, with the candidate told what is happening.
Do I need consent to verify job applicants?
For some checks, yes. The ACIC says a police check needs the applicant's informed consent, and Home Affairs says employers need the visa holder's permission to use VEVO. For the rest, telling the candidate what you will check, and why, is the fair default.
Should I run checks on every applicant?
Usually not. The OAIC gives, as an example of a collection that may not be reasonably necessary, collecting personal information about all job applicants when it is only required for shortlisted candidates. Run the deeper checks on the shortlist or the person you intend to hire.
How long should I keep verification records for unsuccessful candidates?
Only as long as you need them. Under APP 11.2 an organisation covered by the Privacy Act must take reasonable steps to destroy or de-identify personal information it no longer needs, and New Zealand's Privacy Commissioner says agencies should have a clear retention policy and apply it consistently.
Can a candidate ask to see what a referee said about them?
Often, yes. The OAIC says the right of access includes information relating to a referee's report, with limited exceptions. In New Zealand, the Privacy Commissioner says an applicant can request a referee's comments, but evaluative material given in confidence can be withheld.
Key takeaways
- List the claims the job depends on, and check only those.
- The deeper the check, the later and narrower it runs.
- Notice is not consent: ask clearly for police, criminal record, identity and visa checks.
- Treat delays and mismatches as questions, and use a conditional offer while you wait.
- Protect what you collect, and delete it once the decision no longer needs it.
