Individualized Assessments: How to Review a Record Fairly

Most hiring teams have a plan for what happens when a background check comes back clear. Far fewer have a written plan for what happens when it does not. That gap is where inconsistent decisions, legal exposure, and lost candidates all begin.

An individualized assessment is the structured review an employer performs when a criminal record appears on a report. Instead of treating the charge as an automatic disqualifier, the reviewer looks at the specific offense, the circumstances around it, and how — or whether — it actually relates to the duties of the role.

Individualized assessment is not the same as adverse action

The two processes are related but come from different places, and confusing them is a common mistake.

• Adverse action is a federal obligation under the Fair Credit Reporting Act. It governs the notices you send, the copy of the report you provide, the waiting period you honor, and the final notice that closes the loop.
• Individualized assessment obligations come primarily from EEOC enforcement guidance and from state and local fair-chance laws. They govern how you reach the decision in the first place.

In practice, the assessment happens before and during the adverse action sequence. You review the record, you give the candidate a chance to respond, and only then do you finalize a decision and issue the required notices. Several jurisdictions — New York City and California among them — require employers to document the analysis and share elements of it with the candidate.

The Green Factors: the framework courts and regulators expect

The EEOC's 2012 enforcement guidance on arrest and conviction records draws on Green v. Missouri Pacific Railroad, an Eighth Circuit case from 1977. The resulting three-part test — often shortened to nature-time-nature — asks:

1. The nature and gravity of the offense or conduct
2. The time that has passed since the offense, conduct, or completion of the sentence
3. The nature of the job held or sought, including its duties, environments, and level of supervision

The purpose of the test is to determine whether the conduct is job-related for the position in question and consistent with business necessity. It is not a scoring system, and it is not a way to justify a decision you already made. It is a discipline for asking whether this record actually predicts risk in this role.

A concrete example

A candidate has a DUI conviction from fourteen months ago. For a delivery driver position, the offense is recent, directly tied to the core duty of the role, and creates real safety and insurance exposure. For a warehouse inventory clerk who never operates a company vehicle, the same conviction has little bearing on the duties of the job. Same record, same candidate, two defensible outcomes — because the third factor changed.

Why the process is worth building properly

Roughly one in three American adults has some form of criminal record. Screening every one of them out on sight shrinks a talent pool that most employers cannot afford to shrink, and it invites disparate-impact claims because arrest and conviction rates are not evenly distributed across demographic groups.

Employers who build a real assessment process also report a second benefit: their decisions become explainable. When a hiring manager, an executive, or opposing counsel asks why a particular candidate was rejected, there is a documented answer that references duties and dates rather than instinct.

How to run an individualized assessment

1. Write the policy first. Define which roles trigger a review, who performs it, what evidence is considered, and how outcomes are recorded. Consistency is the single strongest defense against a discrimination claim.
2. Confirm the record is accurate and reportable. Check identifiers, disposition, and jurisdiction-specific reporting limits before analyzing anything. A dismissed or sealed case may not belong on the report at all.
3. Apply the three Green Factors in writing. Document the offense and its gravity, the elapsed time, and the specific duties that make the offense relevant or irrelevant.
4. Give the candidate a real opportunity to respond. Invite context: rehabilitation, completed probation, treatment or coursework, employment since the offense, references, or evidence the record is inaccurate.
5. Weigh mitigating evidence honestly. If you solicit context and then ignore it, you have added a step without adding fairness.
6. Use more than one reviewer where volume allows. A small panel with different functional backgrounds reduces the influence of any single person's assumptions.
7. Record the outcome and the reasoning. Keep it confidential to the reviewers and the file, and retain it alongside your other FCRA records.
8. Then run adverse action correctly if the decision is negative — pre-adverse notice with the report and Summary of Rights, a reasonable waiting period, and a final notice.

Common mistakes to avoid

• Treating any felony as an automatic bar regardless of role, age of the record, or jurisdiction
• Considering non-conviction arrest information where state or local law prohibits it
• Asking for candidate context but making no record of how it was weighed
• Letting each hiring manager improvise, so two similar candidates receive different outcomes
• Running the assessment after the final adverse action notice has already gone out
• Discussing the record with people outside the review, which creates both privacy and retaliation exposure

Frequently asked questions

Is an individualized assessment legally required?

It is not required by the FCRA itself. It is strongly recommended by EEOC enforcement guidance and is affirmatively required — sometimes with a documented, candidate-facing analysis — by fair-chance laws in jurisdictions including California, New York City, Los Angeles, and others. Requirements vary by location and by role, so confirm what applies to each place you hire.

Who should perform the assessment?

Ideally a trained HR or compliance owner, not the hiring manager alone. In higher-volume programs, a small standing panel produces more consistent outcomes and makes the process easier to audit.

How much time should the candidate get to respond?

The FCRA requires a reasonable period before final adverse action, and five business days is the widely used floor. Several jurisdictions require longer — some as much as five business days after receipt, others more. Build the longest applicable window into your workflow rather than tracking exceptions by hand.

Do we have to hire someone whose record we assessed?

No. The assessment governs how you decide, not what you decide. If the offense is job-related for the position and consistent with business necessity, declining to hire is a defensible outcome — provided the analysis and the notices are documented.

Key takeaways

• Individualized assessment answers how you decide; adverse action governs the notices that follow
• Nature of the offense, time elapsed, and nature of the job are the three factors regulators expect to see analyzed
• A written policy applied consistently is the strongest protection against disparate-impact exposure
• Solicit candidate context, weigh it honestly, and document the reasoning in the file