Most hiring compliance failures are process failures, not legal ones

A note on scope first. None of what follows is legal advice, and the specifics of what applies to your organisation belong with your own counsel. This is about something upstream of that: the ordinary process failures that turn a correct policy into an incorrect outcome, long before anyone reaches for a statute.

That's where it usually goes wrong. Most organisations that run into trouble in hiring weren't ignorant of the rules. They had a policy, it was accurate, it had been reviewed, and it sat on an intranet page the people making hiring decisions had read once during onboarding. The failure happened in the gap between a written policy and a process that runs 60 times a quarter across dozens of interviewers who don't think of themselves as compliance actors.

This matters because it determines what actually fixes anything. If the problem is knowledge, training helps. If the problem is that the process permits inconsistency, produces no usable record and quietly tolerates exceptions, more training just gives you better-informed people operating the same faulty process. The organisations with the least trouble here aren't the ones with the best-informed hiring managers. They're the ones whose process makes the compliant path the easiest one to walk.

Nearly every hiring standard rests on treating comparable candidates comparably. That sounds like a matter of good faith. It's mostly a matter of structure. 10 interviewers asking their own questions in their own order, weighting what struck them, writing up their impressions in free text, will produce inconsistent treatment however scrupulous each of them is on their own.

The structural fix is unremarkable and well known: an agreed set of questions tied to the requirements of the role, asked of every candidate for that role, scored against a defined scale, recorded before the interviewers talk to each other. It's usually resisted as bureaucratic, and the resistance makes sense. It does make the interview feel less like a conversation.

What it buys is worth the trade twice over. It makes the process defensible, because comparable treatment is visible in the artefacts rather than asserted after the fact. And it makes the process better at picking people, because structured interviews outpredict unstructured ones, and because scoring before discussion stops the most confident voice in the debrief from becoming the panel's memory of what happened.

Hiring generates a long trail of material: notes, scorecards, messages between a recruiter and a hiring manager, an approval given in a meeting, a rejection reason typed into a system in a hurry. Some of it lives in the applicant tracking system. A great deal of it lives in individual inboxes, chat threads and private documents belonging to people who may not work there in 2 years.

The question worth asking isn't whether records are being kept. It's who owns them, what specifically must be captured, where it must live, and for how long. In many organisations no single person can answer all 4 for hiring. Legal owns the policy, HR owns the system, recruiters own the practice, and the actual decision evidence is scattered across whoever happened to be in the thread.

The test is a reconstruction. Pick a role filled 8 months ago and try to rebuild, from what was retained, who applied, who advanced, on what basis, who decided, and why the rejected people were rejected. Organisations that run this exercise are frequently surprised, and the surprise is almost never that they did something improper. It's that they can't demonstrate they didn't.

Somewhere in most hiring processes is a step that occasionally gets skipped. A check that hasn't come back. An approval that'll be sorted next week. A stage waived because the candidate is exceptional and about to accept elsewhere. Somebody senior says it's fine, and it usually is fine, and the hire proceeds.

The individual exception isn't the problem. The problem is that a verbal exception leaves no trace, so nobody can see how many there've been. Each one is judged on its own merits by whoever's in the room, and the pattern stays invisible precisely because the mechanism for granting them is invisible. After a year, the practice may have drifted a long way from the policy without any single decision having been wrong.

The fix costs almost nothing. Exceptions are granted in writing, with a reason, to a named person, and somebody reviews them quarterly. It isn't about catching wrongdoing. It's about being able to see when an exception has stopped being exceptional, which is the point at which the policy needs to change, or the process does, because the current arrangement is no longer describing what the organisation actually does.

Hiring passes a candidate between a surprising number of hands: an agency or RPO partner, an internal recruiter, a coordinator, several interviewers, a hiring manager, an approver, a background-check vendor, an onboarding team. Each handoff is a point where something can be assumed done by the party before or the party after.

Checks that are somebody's job in the abstract and nobody's job in particular are exactly the ones that go missing, and they go missing most often on the paths that feel exceptional: the internal transfer, the rehire, the contractor being converted, the executive hire that ran outside the normal process for confidentiality. Those paths are lower volume, so the gap can persist for a long time before anyone notices.

The design answer is a named owner per check and an explicit gate before the next stage, including on the exceptional paths, and especially on those, since that's where seniority, urgency and discretion all point the same way. Where an external partner sits in the chain, their obligations belong in the agreement, with the same precision as their delivery commitments.

The standard worth holding a hiring process to isn't whether it complies on paper. It's whether it can be reconstructed. Months later, from what was actually retained, could somebody rebuild who applied, how they were assessed, who decided, and on what basis? If yes, the process is in reasonable shape and the organisation can show what it did. If no, the process has a gap whatever the policy says, because the evidence of a good decision and a bad one looks identical when both are absent.

That test is useful because you can run it any time, and it doesn't need a lawyer. It also tends to improve hiring quality as a by-product, since the disciplines that make a process reconstructable, structured questions, scores recorded before discussion, reasons tied to requirements, one system of record, are the same disciplines that make it more accurate.

Which is the broader point. Treat compliance as a legal overlay bolted onto hiring and you get a process people work around under pressure. Treat it as a property of a well-designed process and you get something easier to defend and better at picking people, with the compliance benefit arriving as a consequence rather than a cost.