Due Diligence Checklist for Acquiring a Background Screening Company

Request all FCRA-related consumer disputes, adverse action complaints, and regulatory correspondence from the past five years.

Patterns of consumer disputes signal systemic process failures that create ongoing class action liability.

Red flag: Multiple unresolved consumer disputes or any active FCRA litigation filed against the company.

Review written adverse action procedures, permissible purpose documentation, and consumer disclosure templates.

Deficient adverse action processes are the most common trigger for FCRA class action lawsuits.

Red flag: Absence of documented adverse action workflows or outdated disclosure forms that predate recent CFPB guidance.

Audit compliance with state ban-the-box laws, salary history bans, and EEOC individualized assessment requirements across all active client jurisdictions.

State-level violations create independent liability exposure beyond federal FCRA risk.

Red flag: No state compliance monitoring process in place or clients operating in high-risk jurisdictions without updated screening workflows.

Confirm whether the company holds a Consumer Reporting Agency registration or license in all states that require it, including California, New York, and Minnesota.

Operating without required state CRA licenses creates immediate regulatory exposure post-acquisition.

Red flag: Missing state registrations or lapsed licenses discovered during diligence with no remediation plan.

Obtain a full client revenue schedule segmented by contract versus transactional revenue for the trailing 36 months.

Contractual recurring revenue justifies higher multiples; transactional volume tied to hiring cycles does not.

Red flag: Less than 60% of revenue under active contracts or significant revenue volatility tied to one or two client hiring surges.

Identify the top 10 clients by revenue and calculate each client's percentage of total trailing twelve-month revenue.

Concentration above 20% in a single client creates material post-acquisition revenue risk.

Red flag: Any single client representing more than 25% of revenue without a multi-year contract with renewal provisions.

Calculate gross and net revenue retention rates for each of the past three years, segmented by client vertical.

Net retention above 100% signals upsell capability; churn above 10% annually indicates client satisfaction problems.

Red flag: Annual churn rate exceeding 10% or net revenue retention consistently below 95% across the client base.

Review all master service agreements for pricing terms, volume minimums, auto-renewal clauses, and change-of-control provisions.

Change-of-control clauses can allow clients to terminate contracts immediately upon acquisition close.

Red flag: Multiple enterprise contracts containing change-of-control termination rights without amendment or client consent secured.

Review the technology stack architecture, identifying proprietary versus licensed components, hosting environment, and system uptime history.

Outdated or heavily manual platforms require costly replacement capital that should reduce purchase price.

Red flag: Legacy on-premise systems with no API capabilities, high manual processing rates, or recurring downtime incidents affecting client deliverables.

Audit all active ATS and HRIS integrations including Workday, Greenhouse, iCIMS, and BambooHR, and assess integration depth and stability.

Deep ATS integrations create switching costs that protect revenue; shallow integrations are easily displaced by competitors.

Red flag: No native ATS integrations or integrations built on undocumented custom code with no third-party support contracts.

Request the most recent cybersecurity assessment or penetration test results, SOC 2 certification status, and incident response documentation.

A PII data breach post-close creates regulatory liability, client attrition, and reputational damage that falls on the buyer.

Red flag: No formal cybersecurity assessment in the past 18 months, absence of SOC 2 certification, or undisclosed prior data incidents.

Confirm data retention and destruction policies comply with FCRA seven-year limits and applicable state privacy statutes including CCPA.

Improper PII retention creates ongoing regulatory exposure and inflates data breach liability scope.

Red flag: No documented data retention schedule or evidence that consumer PII is stored indefinitely without a deletion protocol.

Obtain and review all data vendor agreements including county court search networks, TransUnion or Equifax credit bureau access, MVR providers, and drug testing administrators.

Vendor contract terms, pricing, and exclusivity directly determine gross margin and competitive positioning.

Red flag: Month-to-month vendor agreements with no volume pricing, or key data source contracts that expire within 12 months of close.

Calculate data vendor costs as a percentage of gross revenue and benchmark against industry norms of 30–45% of revenue.

Thin margins driven by high vendor costs signal limited pricing power and susceptibility to vendor price increases.

Red flag: Data vendor costs exceeding 55% of revenue or gross margins consistently below 40% with no clear path to improvement.

Assess whether the company has direct county court researcher relationships or relies entirely on national aggregator networks.

Direct county relationships provide faster turnaround, broader coverage, and lower unit costs than aggregator pass-through pricing.

Red flag: Complete dependence on a single national court search aggregator with no direct county relationships or backup search options.

Review drug testing program administration agreements and confirm chain-of-custody compliance with DOT and non-DOT collection site networks.

Drug testing revenue carries separate compliance obligations; collection site network gaps limit geographic service capability.

Red flag: Drug testing revenue with no formal MRO agreement or collection site coverage gaps in key client operating markets.

Map the owner's direct involvement in client relationships, identifying which enterprise accounts interact exclusively with the founder.

Owner-held client relationships that cannot be transitioned create immediate post-close churn risk.

Red flag: The seller is the primary contact for clients representing more than 40% of revenue with no documented transition plan.

Review employment agreements, non-solicitation clauses, and compensation structures for the compliance officer and top account managers.

Departing compliance staff post-close creates regulatory vulnerability; losing account managers accelerates client attrition.

Red flag: No non-solicitation agreements with key account managers or the compliance officer planning to exit within 90 days of close.

Assess whether operational processes including onboarding, dispute handling, and report fulfillment are documented in written SOPs.

Undocumented processes dependent on tribal knowledge cannot scale and create operational risk during ownership transitions.

Red flag: Core screening workflows exist only in the minds of one or two employees with no written procedures or training materials.

Evaluate the depth of the sales pipeline and whether new business development is driven by the owner or a dedicated sales function.

Owner-dependent sales pipelines collapse post-close when founders disengage from the business.

Red flag: 100% of new client wins in the past 24 months sourced directly by the owner with no sales team or referral channel.