Building a role-based verification matrix

Ask most Indian companies what they verify and you will get one answer for the whole organisation: identity, address, education, last employer, and a criminal record check. The same five, for a warehouse associate and a finance director.

This is defensible as an operational simplification and indefensible as a risk design. The associate is being checked for exposures they cannot cause. The director is not being checked for the exposures they can.

A verification matrix fixes this by making the checks a function of the role rather than the company.

Start with what the role can actually damage

Not seniority. Damage. Two questions produce most of the answer:

What can this person reach? Money, customer data, cash handling, physical premises, credentials, regulated systems, vulnerable people, the company's name in public.

How much of that can they reach alone? A payments engineer with production database access and a maker-checker requirement is a materially different exposure from one without the second half.

A junior treasury analyst who can initiate transfers is a higher financial exposure than a senior engineering manager who cannot. Seniority is a proxy for reach; it is a poor one, and using it directly is how you end up with expensive, irrelevant checks on senior hires and no checks at all on the ones who matter.

Sort roles into tiers, not a spectrum

Four tiers is usually enough. More than that and nobody can remember which is which, which means the matrix stops being applied.

Tier 1 — Standard. No independent access to money, customer data or premises. Identity and address establish who the person is and where they can be reached; employment confirms the work history the hire was based on. Education only where the role genuinely requires a qualification.

Tier 2 — Trusted access. Customer data, internal systems, or unsupervised time on site. Everything in Tier 1, plus a criminal record check in the jurisdictions where the candidate has actually lived, and education verified rather than assumed.

Tier 3 — Financial or regulated. Money movement, financial advice, or a role a regulator names. Everything in Tier 2, plus a credit and directorship search — the point is not creditworthiness but undisclosed conflicts and undisclosed businesses — and sanctions and PEP screening.

Tier 4 — Leadership and licensed. Officers, licensed professionals, anyone who can bind the company. Everything in Tier 3, plus directorship history examined properly, adverse media, structured reference conversations with named prior managers, and regulatory or licence status confirmed with the issuing body.

What each check is actually for

The matrix only works if the checks are chosen for what they establish, not for what they sound like.

Identity establishes that the person is who they claim. It is the foundation for everything after it — a criminal record check on the wrong identity is worse than no check, because it returns a confident clear.

Address establishes reachability and, more usefully, tells a court-record search which jurisdictions to search.

Employment confirms the work history the hiring decision rested on. Verified against the provident fund record it also exposes overlapping employment, which document-based verification cannot see.

Education confirms a credential with the issuing institution. Necessary where the role requires the qualification; decorative where it does not.

Criminal record searches court records in named jurisdictions. It does not search "India" — there is no such search — which is exactly why it depends on the address history.

Credit and directorship surface undisclosed businesses and conflicts of interest. Treating the credit score itself as a hiring signal is a different decision, and one worth making deliberately rather than by accident.

Sanctions and PEP are list screens. Fast, cheap, and worth re-running continuously rather than once.

References are the only check that produces judgement rather than fact. Structured, with named prior managers, they surface how someone works. Unstructured, they surface whether the candidate has three friends.

The two failure modes

Over-checking the bottom. Running a credit check on a delivery role costs money, delays the start date, and collects sensitive financial data you have no purpose for — which, under the DPDP Act, is now a compliance problem and not merely a wasteful one.

Under-checking the top. Senior hires are frequently exempted from verification because they came through a trusted referral, because the process felt insulting, or because they were needed urgently. Every one of those is a reason to check more carefully, not less. The senior hire has the widest reach and the strongest incentive to smooth over a prior exit.

Write down the exceptions before you need them

Every matrix meets a case it does not fit: an urgent hire, an internal transfer, a rehire, a contractor converting to permanent. Decide the rule in advance and write it into the matrix itself.

Useful defaults: an internal transfer into a higher tier gets the delta between tiers, not a full re-run. A rehire within twelve months gets identity and a criminal check. A contractor converting to permanent gets the full package for the destination tier, because contractor screening is usually lighter than anyone remembers. An urgent hire may start on a completed identity check with the rest in flight — provided somebody senior signs that exception and the case is tracked to completion rather than quietly forgotten.

The exception that is not written down is the one that becomes the norm.

Review it against what you actually find

A matrix designed once and never revisited drifts away from the organisation. Once a year, look at where discrepancies actually surfaced. If a tier has produced no findings across hundreds of cases, it is either checking the wrong things or checking things that were never at risk. If a tier keeps producing findings after the hire is made, it is checking too little, or too late.

The matrix is a hypothesis about where your risk is. Your own case data is the only thing that can tell you whether the hypothesis was right.

• strategy
• screening design
• risk