What Uber’s new screening standards tell business leaders about screening and workforce safety

Uber’s new screening standards show why background checks belong within an organisation’s safety and risk-management framework. Boards need assurance that screening reflects the exposure attached to each role, continues after appointment and informs wider safeguarding, security and operational-risk decisions.

Uber has strengthened the background-check criteria applied to drivers and couriers in the United States. The decision matters beyond the transport sector. It shows what happens when an organisation reassesses screening against the harm a worker could cause through direct access to customers.

A screening policy may meet statutory requirements and still leave serious gaps. Directors should ask whether the organisation has identified those gaps before an incident exposes them.

What Uber is changing

Every US driver and courier already had to pass a background check before using the Uber platform. Uber also conducts annual rescreening and continuously monitors records for new offences.

The company’s revised policy broadens the convictions that lead to permanent disqualification. All violent felonies and offences that may be sexual in nature are now included. Stalking and strangulation-related offences are also disqualifying regardless of when they occurred, whether they were charged as misdemeanours or felonies.

Uber said the stalking and strangulation changes followed recommendations from domestic violence prevention experts, who advised that these offences can indicate a risk of future violence. Convictions and pending charges for serious crimes including murder and sexual assault were already indefinitely disqualifying.

The significance of Uber’s new screening standards lies in the reasoning behind them. The company reviewed its criteria against current safety expectations and the risks created when drivers have direct, often unsupervised contact with passengers.

That same test applies to many organisations.

Screening should follow the risk attached to the role

Background screening is often treated as a recruitment process owned by HR. That is too narrow.

The purpose of screening is to help control risk before a person receives access, authority or trust. The checks selected should therefore follow the exposure created by the role.

A delivery driver may enter residential buildings and meet customers alone. A care worker may spend time with children or vulnerable adults. A finance employee may approve payments or change supplier details. An IT administrator may hold privileged access to systems containing employee, customer or commercial data.

These roles present different risks. Applying the same screening package to each one gives the board little assurance that the policy reflects the possible harm.

A role-based approach starts by identifying what the individual can access, who they can influence and how much independent authority they hold. The organisation can then select proportionate checks, such as identity, criminal record, employment history, qualifications, sanctions or relevant financial checks.

Veremark’s overview of background screening checks sets out the types of verification available for different industries and roles. The policy decision should still come from the employer’s own risk assessment.

The consequences extend beyond a poor hiring decision

An unsuitable person gaining access to customers can expose an organisation to physical harm, harassment, theft or abuse. Where vulnerable individuals are involved, weak screening can become a safeguarding failure.

Access to financial systems creates a different set of threats. An employee may be able to redirect payments, create false suppliers, approve fraudulent transactions or conceal conflicts of interest. Even where losses are recovered, the organisation may face investigation, legal costs and questions about its control environment.

Sensitive data carries similar exposure. A worker with access to customer records, payroll files, health information or intellectual property may cause damage through deliberate misuse or poor judgement. Screening cannot predict every act, yet it can identify discrepancies or relevant history before access is granted.

Physical premises also matter. Contractors, temporary workers and facilities staff may have keys, access cards or knowledge of security procedures. Screening policies that cover permanent employees while excluding third parties can leave a predictable gap.

These outcomes belong on enterprise risk registers. The controls intended to prevent them should receive the same scrutiny as cybersecurity, fraud prevention and health and safety.

Legal compliance is a starting point

Employment screening must be lawful, fair and proportionate. Employers need a valid reason for each check, clear rules on access to results and suitable retention periods.

Minimum legal compliance, however, does not answer every safety question.

A regulation may require a certain check for a defined occupation. It may say little about adjacent roles with similar access. Local law may also permit an employer to conduct further checks where they are relevant and proportionate, without making those checks compulsory.

Boards should therefore separate two questions:

1. What checks are legally required?
2. What checks are reasonably needed to control the risks associated with the role?

The second question should never be answered through instinct or a blanket policy. Excessive screening creates privacy and discrimination risks. Insufficient screening leaves people and assets exposed.

The correct standard is a documented link between the check and the role. Veremark’s guide to GDPR compliance in background screening explains how employers can keep checks relevant, proportionate and defensible.

Questions boards should ask

Directors do not need to review individual screening reports. They do need confidence in the system that produces and acts on them.

Boards should ask:

• Which workers, contractors and third parties are covered by the screening policy?
• How are roles classified according to access, authority and potential harm?
• Who approves the screening package for each risk category?
• What happens when a result contains a discrepancy or adverse finding?
• Who decides whether a finding is relevant to the role?
• Can candidates challenge inaccurate or incomplete information?
• When are employees rescreened following promotion, changed duties or new access?
• Who owns the policy, and when was it last reviewed against the enterprise risk assessment?

Escalation deserves particular attention. A screening provider can return information. It cannot take responsibility for the organisation’s employment decision.

The policy should define who reviews adverse results, which functions must be consulted and when a case reaches senior leadership. Decisions should be consistent, recorded and based on relevance rather than automatic exclusion.

Screening results should inform wider risk reporting

Screening data can reveal patterns that matter beyond recruitment.

A rise in identity discrepancies may indicate organised application fraud. Repeated qualification concerns in one business unit may point to weak recruitment controls. Adverse findings during rescreening may expose gaps in employee disclosure rules or incident reporting.

These trends should feed into safeguarding, security and operational-risk reporting. Boards do not need personal details. They need aggregated information showing coverage, exceptions, overdue checks, escalation volumes and recurring risk themes.

Ongoing checks also matter where a person’s responsibilities change. Someone promoted into a role with payment authority, sensitive data access or responsibility for vulnerable people may require further screening. Veremark’s guide to rescreening for compliance and risk management outlines how periodic and event-based checks can support this process.

Uber’s new screening standards provide a clear lesson for business leaders. Screening criteria should change when the organisation’s understanding of risk changes.

A board that receives confirmation that “checks are complete” is receiving an activity report. Assurance requires more. Directors should know whether the right people were checked, whether the checks matched their access and whether the findings changed any wider risk decision.