Due Diligence on an executive before hiring or partnership

How the risk of the role determines the depth of the check

A candidate check begins with a description of the position, not with a surname. This is not a bureaucratic formality: it is precisely the link between specific powers and the composition of the check that makes it justified rather than excessive.

It is practical to break the role down into four dimensions. Access: to money, payment systems, client data, intellectual property, employee personal data. Powers: the right to sign obligations alone, to dispose of a budget, to make personnel decisions, to represent the company before third parties. Geography: the countries where the person will work and where they worked before - this determines both the availability of sources and the applicable rules. Public exposure: whether the candidate will speak on behalf of the company before investors, a regulator or the media.

These four dimensions work as multipliers, not as addends. A head of department without signing authority, working in one country and without a public role, is one profile. A finance director with access to payments and signing authority in several jurisdictions is a fundamentally different one - not because there is more suspicion attached to them, but because the cost of an error in that role is higher.

The profile determines not only the depth but also the composition. For a role with access to client data, previous episodes involving the safekeeping of information and obligations to a former employer are material. For a role with budgetary powers - financial circumstances and conflicts of interest. For a public role - the consistency of statements and the existence of unresolved public conflicts. The same set of checks for every role means that either part of the work is unnecessary or part of the risks has been missed.

The formal output of this stage is a short one-page document: the position, the four dimensions, the justified composition of the check, and what is deliberately not checked. It later answers both the candidate's question "why did you collect this" and management's question "why was it checked this way".

Граница вывода. The role profile determines the volume of work but does not predetermine the result. A high level of authority is not grounds for a stricter assessment of the candidate - only for a fuller check of the circumstances relevant to the position.

Consent and legal basis

The fact that information is public does not mean there is permission to collect it and use it in a personnel decision. This is the key point of this section, and it is most often ignored: the availability of information on the internet does not automatically make its processing by an employer lawful.

The European regulation requires a legal basis for any processing of personal data and compliance with the principles of purpose, minimisation, accuracy and storage limitation. In the hiring context, the basis is usually not consent: in the employer-candidate relationship, consent is considered vulnerable, since there is an imbalance between the parties and its voluntary nature is open to doubt. Other bases are more often applied - necessity for entering into a contract or the employer's legitimate interest - and each requires its own justification. The 2024 guidelines of the European Data Protection Board on legitimate interest set out the three-step test in detail: whether an interest exists, whether the processing is necessary for it, and whether the rights of the individual override it.

A separate category is data on criminal convictions and offences. The regulation singles it out: such processing is permitted only under the control of an official authority or where it is authorised by national law with appropriate safeguards. The practical consequence is simple: whether a criminal record certificate can be requested from a candidate depends on the country of hire and the position, not on the employer's wishes. In some jurisdictions this is lawful and common for certain roles, in others it is restricted or prohibited.

For that reason, the first step in every check is a set of four questions: the country of hire, the applicable employment law, the permissible categories of data and the procedure for notifying the candidate. The answers differ even within Europe, and there is no universal template here. The jurisdictional part is agreed with the client's lawyer before work begins, not afterwards.

Transparency also has a practical side. A candidate who knows the scope of the check in advance more often explains discrepancies himself - and does so faster than any external search. An appointment that begins with a sense of surveillance damages the relationship from day one, even where the outcome is positive.

Граница вывода. General principles do not transfer mechanically to a specific country. Whether records may be requested, the scope of the check and the need for consent are determined by local law and confirmed by a lawyer in the relevant jurisdiction.

Verification of identity, education and career

The base layer looks dull right up to the moment a discrepancy appears in it. The task here is not to catch the candidate out, but to be satisfied that the further work concerns the right person and that the background he states corresponds to what is independently observable.

Identification. Common names produce matches constantly, and attributing another person's biography to the candidate is the most costly error in a check, because it harms an innocent person. Identification is carried out on a combination of attributes: date of birth, jurisdictions, professional field, confirmed roles. If a name match is not confirmed by a second attribute, what has been found is not attributed to the candidate.

Education and qualifications. Confirmed by the institution or the relevant professional body, not by a copy of a document sent by the candidate himself. A copy confirms only the existence of a copy. Professional licences and memberships are checked in the registers of the issuing organisations, where the current status is also visible.

Career. In most jurisdictions formal positions are recorded in corporate registers: director and management roles, dates of appointment and termination. This is the most reliable layer of a career check. Positions not formally recorded in a register are confirmed differently - through independent publications, industry materials, public references during the period of employment.

Continuity is checked separately: how the periods relate to one another, whether there are unexplained gaps, whether positions overlap that would be difficult to hold at the same time. A gap in a biography means nothing in itself - it may be explained by study, health, family circumstances or a move to another country. The reason is not established by external search; the question is put to the candidate directly if the gap is material to the role.

Граница вывода. The absence of a public trail does not disprove the stated experience: a significant proportion of positions never appear in open sources. What is unconfirmed remains unconfirmed; it does not become a conclusion that the account is untrue.

Outcomes and reasons for moves, without speculation

The most tempting and the most dangerous layer of a check. The temptation is to reconstruct from external signs why a person left a company. The danger is that the real reason is almost never visible from the outside, while the constructed version looks convincing and enters the decision as fact.

What is genuinely observable. The start and end dates of positions. The state of the company during the candidate's employment and after his departure. Material corporate events recorded in public records. The frequency of moves and the duration of each position. Public statements by the company itself about personnel changes, where these were made.

What is not observable and is therefore not asserted: conflict with the owner, dissatisfaction with results, disciplinary circumstances, whether the departure was voluntary. The wording "left against a background of declining performance" is already an interpretation, joining two independent facts by a causal link that has not been confirmed.

Working correctly with this layer involves two steps. First, the observable sequence is recorded: when he joined, what was happening to the organisation, when he left, what happened afterwards. Then - if the sequence is material to the role - a question is put to the candidate. Not an accusation, but a question: "during this period the company went through the following changes, tell us about your role". The candidate's answer becomes part of the material and is assessed on the same basis as external data.

Frequent changes of employer are a separate case, and the one where intuition most often fails. Short tenures may indicate problems, or they may reflect project-based work, an industry norm, a series of acquisitions or a deliberate specialisation in turnaround work. What matters is not the fact itself, but whether the candidate's explanation is consistent with the observable picture.

Граница вывода. An overlap between a period of employment and a decline in the company's performance does not establish causation. The reasons behind personnel decisions are almost never confirmed in open sources and should not be reconstructed in the report.

Conflicts of interest and corporate connections

This is the layer that more often than others produces a result that can be applied immediately. It is not about a person's integrity: even an impeccable executive, in a certain configuration of connections, will not be able to make decisions impartially, and it is better for both sides to know this in advance.

Several groups are checked. The candidate's participation in other legal entities: shareholdings, director positions, roles in non-profit organisations, sole trader status. Connections with the prospective employer's counterparties - suppliers, contractors, clients, competitors. Overlaps with current employees and owners of the company. Obligations to a previous employer: non-competition, non-disclosure, retained options, obligations relating to the client base.

Political exposure is considered here as well. If the candidate or a person connected to them holds or has held a prominent public function, this is a status requiring heightened attention. The international approach states directly that the corresponding measures are preventive in nature and do not imply involvement in any offence. In the report this is recorded as a circumstance, with the function and period stated, and not as a negative indicator.

The practical value of this layer lies in manageability. A shareholding in a supplier company is addressed by disclosure and recusal from decisions concerning that counterparty. A non-competition obligation - by agreement with the previous employer or by changing the area of responsibility. A family connection with an employee - by changing the reporting line. Any of these situations becomes a problem only when it comes to light after the appointment.

An important limitation: external sources show the formal part of connections. Informal arrangements, personal friendships and verbal commitments cannot be established this way. For that reason, the outcome of this layer always includes a direct question to the candidate with a list of what has been found - this works better than a general request to disclose conflicts of interest.

Граница вывода. Only the formal part of connections is visible. The existence of a conflict of interest is not a characteristic of a person - it is a circumstance that is either managed through disclosure and organisational measures, or makes a specific role unsuitable.

Litigation, sanctions and regulatory events

The legal layer requires the greatest precision of wording, because here an error in the report translates directly into an unfair personnel decision.

Court records. What matters is the procedural role, the subject matter of the dispute and its stage. Claimant and defendant are fundamentally different positions. An employment dispute over payments, a corporate conflict with a former partner and a claim for damages against a director relate to a candidate's profile in entirely different ways. And most importantly: a claim accepted for consideration means only that someone has brought a demand. Reliable confirmation comes only from a judicial act that has entered into force.

Criminal record data. This is a separate category with a special processing regime: the regulation permits it only under the control of an official authority or where it is authorised by the law of the country with appropriate safeguards. In practice this means that requesting a certificate is not always permissible and not for every role - applicability is determined by the country of hire and the nature of the position. The check does not substitute for the official procedure and does not gather such information by indirect means.

The sanctions layer is checked against official lists: the European Commission publishes an overview of the regimes and related resources. A name match is not an identification - it is verified against date of birth, jurisdiction and role, and the result is stated unambiguously: confirmed, excluded, or requiring additional data. A false positive that enters a decision as a fact is damage to a specific person's reputation.

Regulatory events. Personal measures - disqualification, a ban on holding office, withdrawal of a certificate or licence - relate to the candidate directly and are a confirmable fact. Measures against an organisation are not transferred to its director automatically unless he is named in the document itself. This distinction must be drawn explicitly: "the company received an order during the candidate's employment" and "the candidate was held liable" are different statements.

Граница вывода. A claim is not the same as fault, and a measure against an organisation is not the same as the liability of its director. Information on criminal convictions is processed only in the manner permitted by the law of the country of employment and is not collected by circumventing official procedures.

Reputation and digital exposure

For a role involving representation of the company, the public record is part of the professional profile. The boundary follows context: the audit looks at what the person said and did publicly in a professional capacity.

What is relevant to the matter: interviews and media comments, appearances at industry events, authored publications, statements made on behalf of former employers, professional profiles on business networks. All of this was created deliberately and in a work context.

What is assessed: consistency between the public position and what the candidate says in negotiations; the manner of public communication, where the role involves representation; the existence of unresolved public conflicts that will follow the person into the company; statements that in the new role would be read as the organisation's position.

What is not relevant to the matter and is not collected: political views, religious beliefs, health, family circumstances, origin, private life outside a professional context. These are either special categories of data or information that does not pass the necessity test. Closed accounts, correspondence and information obtained by deception are not touched at all.

Negative publications are a separate exercise. Each is checked by the same procedure: original source and date, whether there is a documentary basis, the pattern of circulation (independent verification or reprints of a single text), the candidate's response, how long ago the event occurred. Indications of a coordinated campaign - a series of similar materials within a short period on platforms with no editorial standing - are recorded as an observation, not as an established fact.

A practical rule of wording: the report separates what the person said themselves, what others wrote about them, and what follows from this for the specific role. Mixing these three levels turns the material into a set of impressions.

Граница вывода. A publication confirms the fact of publication, not the event described in it. The absence of public activity says nothing about professional ability: many capable executives maintain none.

A fair decision and the right to respond

The final step determines whether all the preceding work was of any use. A check whose result is applied without speaking to the candidate creates two risks at once: an unfair decision towards the person and legal risk for the company.

The basic rule: no material discrepancy should affect the outcome until the candidate has had the opportunity to explain it. There are two reasons. The practical one - a significant share of discrepancies is resolved in a single meeting: a namesake, an inaccuracy in the CV, changed circumstances, an event with a different context. The legal one - the person has rights in respect of their personal data, including the right to know about the processing and to challenge an inaccuracy.

The form of the material for the decision. A one-page summary: what is confirmed, what was not confirmed, what remains open. A list of questions for the candidate - specific, not general. A list of manageable circumstances, stating how each is addressed: by disclosure, by a change in reporting lines, by a contractual condition, by a further check once details are clarified. And an explicit separation of levels: fact, conclusion, hypothesis, gap.

Symmetry is essential. Confirmed experience, the absence of expected problems, a stable professional reputation - these are results of the check on the same footing as findings. A report consisting only of concerns distorts the picture no less than a flattering one, and pushes towards a decision that is later difficult to explain.

And the limit of responsibility: the check does not judge a candidate's suitability and does not recommend hiring or rejection. It describes the circumstances checked, their confirmation and their relevance to the role. The decision is made by the employer - and it is the employer who is responsible for basing it on what is confirmed rather than on an impression.

Граница вывода. The check does not replace the employer's decision and is not an assessment of professional suitability. It describes circumstances as at the date of the check and the limits of their confirmation.

What a professional process looks like

The order of the steps determines both the lawfulness of the work and the usability of the result for a hiring decision.

The first step is the role profile: access rights, authority, geography, public exposure. The second is the legal framework: country of employment, applicable law, permissible categories of data, notification procedure. Both steps are completed before a single fact is collected.

The third is notifying the candidate and obtaining information from the candidate directly. This is not a formality: the candidate's materials define the subject matter for comparison and often resolve part of the questions immediately.

Next comes collection by jurisdiction: corporate registers, court and regulatory materials, sanctions sources, professional publications. Each source is recorded with the date of access.

Then verification: material conclusions are checked against a second independent source, and contradictions are set out separately rather than smoothed over. The identification of each match is confirmed by a combination of identifying features.

The final stage is preparing the material with levels of confirmation, questions for the candidate, a meeting with the candidate on those questions, and the final version for the decision-maker.

Граница вывода. Following the process does not guarantee a complete picture: part of the information is not obtainable by lawful means. The process guarantees that what is unavailable will be stated, and that what is disputed will be checked with the candidate directly.

What the client receives as a result

The material must be usable by three audiences: the decision-maker, the legal function, and the conversation with the candidate.

First, the summary: what is confirmed, what was not confirmed, what remains open, and what requires an explanation from the candidate.

Second, the verified profile: identification, education and qualifications, positions and periods, the status of previous companies tied to the relevant dates.

Third, the layer of circumstances: court and regulatory materials with the procedural role and stage, sanctions results with identification, a map of conflicts of interest, the public professional record.

Fourth, the supporting section: a log of sources with dates, a list of discrepancies, a list of questions for the candidate, and a list of manageable circumstances with the means of closing each one.

Граница вывода. The report is not a hiring recommendation, a legal opinion or an assessment of competencies. It describes verifiable circumstances as at the date of the check.

Limitations and the lawfulness of methods

The check works with official and open sources, public professional materials, and information the candidate provides directly. Processing personal data requires a legal basis, proportionality to the purpose and respect for human rights - these are expressly established principles, not a recommendation.

What the check does not do. It does not obtain access to closed state or banking data. It does not conduct surveillance and does not collect information on movements. It does not request information under a false pretext. It does not work with closed accounts or private correspondence. It does not collect special categories of data or information about private life unrelated to the position. It does not circumvent the established procedure for processing data on criminal records.

What the check does not guarantee. It does not predict how a person will behave in a new role. It does not prove a violation - procedural mechanisms exist for that. It does not replace the assessment of professional competencies provided by interviews, assessment and references. And it does not remove uncertainty entirely: in checks on individuals, part of the conclusions remains probabilistic, because public sources are incomplete by their nature.

A practical sign of an honest report is that it shows which points remained unverified, and why.

Граница вывода. The legal assessment of whether particular checks are permissible in a particular country is given by a lawyer of the relevant jurisdiction, not by an analytical firm.

What to prepare for the initial assessment

• A description of the role: powers, signing authority, access rights and area of responsibility.
• The country of employment and the countries where the candidate worked previously - the applicable law and the availability of sources depend on this.
• Whether the company has an internal candidate screening policy and an established notification procedure.
• The date by which a decision on the candidate is required.
• What has already been done on your side: interviews, references, internal procedures.
• The specific questions that give rise to doubt: these work better than a request to "check everything".

The candidate's CV, copies of documents and personal data are not required at the initial assessment stage. What is listed above is enough to answer what scope of checking is justified for this role, what is permissible in this jurisdiction and what will remain unavailable.

Frequently asked questions

• 01

  How does checking an executive differ from an ordinary background check?

  In the extent of the justification, not the depth of the search. Ordinary screening applies the same set of checks to all candidates. Checking an executive starts with the profile of the role - access rights, powers, geography, public exposure - and derives the scope of work from it. In addition, for critical roles the layers that mass screening usually does not touch matter more: conflict of interest, corporate connections and the results of managing previous organisations.

• 02

  Is the candidate's consent required for a check?

• 03

  Is it possible to check a candidate's criminal record?

• 04

  What should be done if a discrepancy is found in a CV?

• 05

  How should frequent changes of employer be assessed?

• 06

  What should be done about a conflict of interest if one is found?

• 07

  How long does checking a candidate for an executive role take?

• 08

  Does a check guarantee that the candidate will prove reliable?

What follows from this

A check on a senior executive is built as a sequence of limitations, not as an expansion of the search. The role sets the scope, the jurisdiction sets the permissible methods, the nature of the source sets the weight of the conclusion, and the conversation with the candidate makes the decision fair.

Practical value appears at the moment when what has been found turns into action: a follow-up question, disclosure of a connection, a change in reporting lines or a term in the contract. Most circumstances are manageable if they are known before the appointment, and almost unmanageable afterwards.

If a decision on a candidate is pending and there is a deadline, it makes sense to start with an initial assessment: what scope of check is justified for this role, what is permissible in these jurisdictions and what will remain unavailable.

Sources

• EUR-Lex - General Data Protection Regulation (GDPR), Regulation (EU) 2016/679проверено 6 августа 2026

  Processing principles, legal bases and the special regime for data on criminal convictions (Article 10)

• EDPB - Data protection framework for organisationsпроверено 6 августа 2026

  Categories of data, grounds for processing and employer obligations

• EDPB - Guidelines 1/2024 on processing of personal data based on legitimate interestпроверено 6 августа 2026

  The three-step test: interest, necessity and balance with individual rights

• FATF - Guidance on politically exposed persons (Recommendations 12 and 22)проверено 6 августа 2026

  Measures in respect of PEPs are preventive in nature and do not imply involvement in crime

• European Commission - Overview of EU sanctions regimes and related resourcesпроверено 6 августа 2026

  Official lists and tools for checking matches

The links lead to official materials. The applicability of the rules depends on the country of employment and the industry: the permissibility of specific checks is confirmed by a lawyer in the relevant jurisdiction before work begins.

Связанные материалы

• 01 /ServiceIndividual background check→
• 02 /CaseCheck on a high-risk individual→
• 03 /ArticleWhat a check on an individual shows before entering a partnership→
• 04 /ArticleRed flags when checking an individual→
• 05 /ArticleReputational audit before appointing an executive→