Five assumptions about hiring that HR should leave behind in 2026

Hiring changed materially this year, and some of the assumptions HR teams still rely on have not kept up. Identity is harder to verify, CVs are easier to manufacture, one-off screening leaves gaps, contractor risk is often underestimated, and poorly explained checks can damage trust.

I have spent much of this year talking to HR leaders about the same problem from different angles. The mechanics of hiring have changed faster than many of the controls around them.

AI can produce convincing CVs and supporting documents in minutes. Remote hiring has created new identity risks. Businesses increasingly depend on contractors who may have significant access to systems and data. Meanwhile, many screening programmes still operate as they did several years ago.

There are five assumptions about hiring I think HR teams should leave behind as they plan for 2027.

Assumption one: if someone looks credible, they probably are

Identity used to be one of the simpler parts of hiring. You met somebody, reviewed their documents and moved on.

That confidence is harder to justify now.

The FBI has warned employers that fraudulent remote IT workers have used artificial intelligence and face-swapping technology during video interviews. Its guidance recommends identity verification during interviewing, onboarding and throughout employment for remote workers. FBI guidance on North Korean IT worker threats

These are no longer hypothetical attacks. In April 2026, the US Department of Justice reported that a scheme involving North Korean remote IT workers used the stolen identities of at least 80 US citizens to obtain roles at more than 100 companies. The scheme generated more than $5 million in illicit revenue.

Your hiring process therefore needs to establish identity before you place confidence in everything attached to it.

An employment record can be genuine and still belong to the wrong person. The same applies to a qualification or criminal record search. We have written previously about why identity should sit at the centre of role-based screening and trust thresholds.

For employers reviewing this part of their process, Veremark's identity checks validate identity documents and include biometric matching.

Assumption two: a strong CV tells you a lot about the candidate

AI has weakened the CV as a source of evidence.

Candidates have always received help writing applications. Generative AI changes the scale. A person can produce a highly tailored CV, improve descriptions of previous roles and generate application answers that closely mirror your job specification with very little effort.

That does not make the applicant dishonest. It does mean presentation quality has become less useful as evidence.

Verification matters more as a result.

Our 2026 Screening Benchmark analysed close to half a million checks completed during 2025. Education verification produced discrepancies in 21.1% of checks, employment verification in 15.3%, while CV gap analysis flagged discrepancies in 51.7%. Read our analysis of screening discrepancies

Those figures should change how you interpret an impressive application.

I would treat the CV as a set of claims to investigate. Verify employment where experience matters. Verify education when a qualification is relevant to the role. Look properly at unexplained career gaps rather than assuming the chronology is accurate.

We explored this in more detail in our article on how to verify candidates in a world of AI CVs.

Assumption three: background screening is finished on day one

This remains one of the most common hiring assumptions I see.

You screen somebody before they join, record the result and consider the risk dealt with. The problem is that a pre-employment check tells you what was true at one point in time.

People's circumstances change. Licences expire. Professional status changes. New criminal matters can arise. An employee can also move into a position with far greater access to sensitive information than the role they originally joined.

Veremark's 2026 Screening Benchmark found that 81% of employers had no form of post-hire screening. See the 2026 screening benchmark findings

That is a substantial blind spot.

Your screening policy should follow risk through the employee lifecycle. That does not mean repeatedly running every possible check on everybody. Your approach should reflect the role, applicable law, the purpose of the check and the level of access somebody has.

A promotion into a financially sensitive role, for example, may justify a different screening standard from the one used when the employee joined several years earlier.

Veremark's employee rescreening solution supports recurring checks and employee notifications for organisations that need to keep relevant information current.

Assumption four: contractors are somebody else's risk

Workforce models have become more flexible. Risk policies have not always kept pace.

A contractor might have access to your production environment, financial information, customer records or intellectual property while sitting outside the controls you apply to permanent employees.

Their employment status does not reduce the value of the assets they can access.

This matters particularly when contractors are hired internationally or supplied through several layers of vendors. You need to know who has been verified, what was checked, who performed the check and whether the standard matches the access you are giving them.

Recent fraud cases show why.

In July 2025, the US Department of Justice reported that a scheme helped North Korean IT workers posing as US citizens and residents obtain remote positions at more than 300 US companies. It generated more than $17 million in illicit revenue. Read the Department of Justice announcement

The FBI has since explicitly advised businesses using contracted IT workers to scrutinise the hiring practices of third-party companies. Read the FBI's guidance for employers

Your screening policy should begin with risk and access rather than employment classification.

Assumption five: more checking means less trust

This is the assumption I would most like HR teams to reconsider.

Employee trust suffers when screening feels arbitrary, excessive or hidden. A clear verification process can produce a very different response.

You should be able to explain why a check is necessary, how its results will be used and how personal information is protected. You should also apply equivalent standards consistently to people carrying equivalent risk.

When employees understand that everybody handling sensitive customer data goes through the same proportionate checks, screening has a clear purpose. Problems arise when checks feel disconnected from the work somebody will actually perform.

This is why I think HR teams should think in terms of a trust threshold. A payroll administrator, a remote engineer with production access and a junior marketing employee create different exposures. The checks you run should reflect them.

We have written more about why trust has become both more measurable and more fragile in hiring.

Trust works best when you can explain the controls behind it.

What I would change for 2027

If you are reviewing your hiring process before the new year, examine the assumptions underneath it before adding more checks.

Establish identity early enough that the rest of your screening is attached to the right person. Decide which claims on a CV genuinely need verification. Set clear events that trigger rescreening. Apply your standards to contractors according to the access they receive. Explain your screening process clearly enough that candidates and employees understand why each check exists.

The technology around hiring will keep changing. Fraud techniques will change with it. Your hiring assumptions need to change too.

Daniel Callaghan
CEO and Co-founder, Veremark

‍