Review relevant publicly available content for defined roles or trigger events—with human verification, protected-data controls and an evidence trail for your decision.
Screening should be necessary for an identified risk, transparent, fair and proportionate. See the ICO’s current draft vetting guidance.
A good screening programme defines the reason, scope and decision standard before collecting public information.
A reviewer should be able to understand what was found, where it came from, what was withheld and what judgement still belongs to the firm.
The final employment or regulatory decision remains with the authorised people in your firm.
Document the role, trigger, lawful basis, review criteria and retention period.
Resolve public profiles carefully so information is not attributed to the wrong person.
Apply the defined criteria while retaining source context, date and evidential detail.
Withhold protected or irrelevant information from the decision view where the process allows.
Review the evidence, invite context where appropriate and record the firm’s own rationale.
Technology can support a controlled process, but it does not replace lawful-basis, policy, transparency or human accountability.
Configure the process so reviewers do not receive unnecessary protected or irrelevant detail simply because it appears in a public source.
Define the conduct and role criteria before review. Preserve which criterion was applied and why a finding reached the report.
Keep source context available and give the person an appropriate way to explain, challenge or correct material information.
Retain the report and evidence only for a documented period aligned to your policy, legal obligations and the purpose of the assessment.
Public information does not become fair, relevant or reliable merely because a manager can find it in a browser.
| Control | Ad hoc manager search | Configured review workflow |
|---|---|---|
| Purpose | Often implicit or undocumented | Defined role, trigger and criteria |
| Protected information | Visible directly to the decision-maker | Designed to restrict irrelevant exposure |
| Identity and context | Reviewer-dependent | Human verification and source context |
| Consistency | Varies by manager and search | Configured criteria and review record |
| Audit trail | Browser history or notes | Evidence, source, date and rationale |
| Person’s context | May be requested late or not at all | Response step built into the firm’s process |
PS25/23 changes how specified misconduct can engage COCON and informs FIT, but the FCA explicitly says firms need not monitor private lives or social media.
Identify the COCON, FIT or people-risk question and the evidence needed to answer it.
Do not treat an allegation, opinion or isolated signal as a conclusion without context.
The report supports analysis; it does not determine fitness, discipline or employment outcome.
Walk through the evidence, source context and protected-data controls that should support a proportionate review process.
