Reputational audit before appointing an executive

The role, powers and risk profile of the position

The main error in a reputational audit is to begin with the person. The correct order is the reverse: first the position is described, and only then is it determined which of the candidate's circumstances relate to it. This is not a formality: it is the link to the role that makes a check justified rather than merely curious.

The risk profile of a position is made up of several clear parameters. Scope of powers: can the person dispose of funds alone, sign obligations, take personnel decisions. Access: to money, to client data, to intellectual property, to employees' personal data. Public exposure: will the candidate speak on behalf of the company, comment in the media, represent it before a regulator. Regulatory burden: does the industry impose requirements on the business reputation of a manager, fitness tests, mandatory approvals.

The depth of the check follows from this profile. For the head of a business line without signing authority and without a public role, one scope is justified. For a finance director with access to payments and signing authority - another. For the CEO of a public company who will represent it before investors and a regulator - a third.

This order also provides practical protection. Processing personal data under the pan-European regulation requires a legal basis and compliance with the principle of minimisation: only the data necessary for the stated purpose is collected. The European Data Protection Board, in its 2024 guidelines on legitimate interest, examines in detail how to assess the necessity of processing and how to weigh the employer's interest against the rights of the individual. A check tied to the specific powers of a position demonstrates that link. A check carried out "just in case" does not.

The practical takeaway of this chapter is straightforward. Before work begins, the following is recorded in writing: what the position is, what powers it carries, what the purpose of the check is and what scope is proportionate to it. That document later answers the candidate's question "why did you collect this" and the board's question "why was the check conducted in this way".

Граница вывода. The risk profile determines the scope of the check but does not predetermine its outcome. Broad powers do not mean heightened suspicion towards the candidate - they mean only that the cost of error is higher and that a greater depth of checking is justified.

Verification of career and achievements

A CV is a statement by one party, not a document. It may be entirely truthful, but it is selective by nature: it includes what the candidate considers useful and omits what the candidate considers unnecessary. The task of the audit is to compare what is stated with what can be independently observed.

Four layers are checked. The first is formal positions: where and in what periods the person held positions that appear in public records. In most jurisdictions, directorships and management roles are reflected in corporate registers, and this is the most reliable layer. The second is continuity: how the periods relate to one another, whether there are unexplained gaps, whether positions overlap in ways that would be physically difficult to combine. The third is education and professional qualifications: confirmed by the educational institution or the relevant professional body, not by a copy of a document. The fourth is claimed achievements.

Achievements are the most slippery layer, and it calls for care in both directions. The phrase "took the company into a new market" may describe the real work of a person who was one of several participants in the process. That is not a lie but an ordinary feature of corporate language. The audit does not catch the candidate out in exaggeration; it establishes what is observable: whether the described event took place in that period, whether this person's role is mentioned in independent sources, whether the scale matches.

The difference between "not confirmed" and "disproved" is fundamental here. The absence of public traces of participation in a project ten years ago is most often a property of the sources, not a sign of invention. In the report such points remain a gap with an explanation, rather than turning into an accusation.

The practical value of this layer is that it gives the board language for a conversation with the candidate. Not "we do not believe you", but "this role is not reflected in open sources - please tell us more". Most discrepancies are closed by such a question in a single meeting.

Граница вывода. The absence of a public trace does not disprove the experience claimed: many roles do not appear in open sources. What is observable is confirmed; the rest is recorded as unverified and put forward as questions for the candidate.

Previous companies and management results

This layer answers a question a CV never closes: what happened to the organisations the person led, and how that relates to the period of their employment.

The condition of former companies is checked: current status, insolvency proceedings, liquidations, material corporate changes. Separately, the chronology: whether the problems arose during the candidate's tenure, before their arrival or after their departure. This comparison is the substance of the chapter; without it, a list of companies in bankruptcy means nothing.

Care is needed here, and it is often omitted. The bankruptcy of a former employer says nothing in itself about a manager. Companies close for market reasons, because of owners' decisions, because of industry crises. Moreover, a turnaround manager comes, by the nature of the work, precisely into companies with problems: a formal count of "how many companies in their biography were liquidated" would in such a case produce the opposite meaning.

What matters is not an isolated fact but a recurring pattern. If several organisations with the same kind of ending run through the biography, if each departure preceded the disclosure of problems, if the same scheme of corporate changes recurs in different companies - that is an observation worth checking further. But even that is stated as an observation, not as a conclusion about involvement.

A separate signal is disqualifications. A number of jurisdictions maintain public registers of persons barred from holding management positions; such an entry is a documentarily verifiable fact and is checked directly. This is a rare case in a reputational audit where the source gives not an indication but a fact with legal consequences.

Граница вывода. A company's problems do not automatically transfer to its director: the connection between one person's decisions and the organisation's financial result is almost never established in open sources. The audit shows an overlap of periods, not causation.

Court cases, regulators and public conflicts

A director's litigation history is read by the same rules as the corporate one: what matters is not the length of the list but the role in the proceedings, the subject of the dispute and the stage.

The first distinction is the procedural role. Claimant, defendant, third party, witness - these are fundamentally different positions, which in superficial reports are often merged into the line "appears in court cases". A person recovering a debt from a bad-faith counterparty and a person against whom a claim has been brought for causing losses to a company are in opposite situations.

The second is the subject matter. An employment dispute over termination payments, a corporate conflict with a former partner, a business reputation dispute and a claim to recover losses from a director all relate to a candidate's profile differently. For a CFO position, a claim of financial liability is directly relevant; a dispute with a former employer over compensation is far less so.

The third and most important is the stage and the outcome. A claim accepted for consideration means that someone has asserted a demand. It establishes no fact whatsoever. Court materials provide reliable confirmation only as to what is recorded in an act that has entered into force. A report in which a filed claim is described in the language of a proven violation is not rigour but an error, and one for which the client bears the consequences.

The regulatory layer works in a similar way. An order, fine or measure against an organisation does not automatically transfer to a particular director unless he is named in the document itself. Personal measures - disqualification, a ban on holding office, withdrawal of a certificate - by contrast relate to the person directly and are checked first.

Sanctions screening is carried out separately and against official lists: the European Commission publishes an overview of regimes and related resources. A name match is not an identification - it is verified against date of birth, jurisdiction and role, and the result is stated unambiguously: confirmed, excluded or requiring additional data.

Граница вывода. A claim is not equivalent to guilt, and a publication about a dispute is not equivalent to a court act. Closed and unpublished proceedings are not accessible by lawful means and are recorded as a gap, not as the absence of problems.

Publications, public appearances and digital footprint

For a director who will speak on behalf of the company, the public record is not a secondary layer but part of the professional profile. A boundary matters here: the audit looks at public statements made in a professional capacity, not at the person's private life.

What is relevant. Interviews and comments in the media, appearances at industry conferences, bylined columns, public statements made on behalf of previous employers, professional profiles and activity on business social networks. All of this the candidate made public deliberately and in a work context.

What is assessed. Consistency of position: whether public statements contradict what the candidate says at interview. The tone and manner of public communication - for the role of official spokesperson this is a direct part of the competence. The presence of sharp public conflicts that will move into the company along with the person. Statements that, in the new role, may be construed as the position of the organisation itself.

What is not relevant and is not collected: political views, religious beliefs, state of health, family circumstances, orientation, origin. These are special categories of data or information unconnected with the position; their processing is either directly restricted or fails the necessity test. It is worth stating the obvious separately: the audit does not involve access to closed accounts, correspondence or information obtained by deception.

The practical recommendation from this chapter is to separate three things in the report: what the person said himself (a direct quotation with date and source), what others wrote about him (a publication with the outlet identified and an indication of whether primary documents underlie it), and what follows from this for the specific role. Conflating these three levels is the most frequent reason reputational reports turn out to be useless for a decision.

Граница вывода. A digital footprint describes the public part of a professional life. It does not characterise a person in full, and its absence says nothing about competence: many capable executives maintain no public activity.

Conflicts of interest and connected persons

Conflict of interest is the one layer of the audit that almost always produces a practical result, and at the same time the most underestimated. It is not about a person's good faith but about the structure of their connections: even an impeccable executive will be unable to make decisions impartially in certain configurations.

What is checked. The candidate's participation in other companies: shareholdings, directorships, roles in non-profit organisations. Connections with competitors, suppliers, contractors and clients of the future employer. Overlaps with current employees and owners of the client company. Obligations to a former employer: non-compete, confidentiality, options still held.

A separate question is political exposure. If the candidate or a person connected with them holds or has held public office, this falls into the category of politically exposed persons. The international approach proceeds on the basis that PEP status means a heightened level of attention, not an assumption of wrongdoing: the FATF recommendations describe it as grounds for enhanced measures, not as a negative conclusion. The wording in the report must reflect exactly that.

The practical significance of this layer is that almost any conflict identified is manageable if it is found in advance. A shareholding in a supplier company is addressed by disclosure and recusal from the relevant decisions. A non-compete obligation - by agreement with the former employer. A family connection with an employee - by changing the reporting line. A conflict becomes a problem when it comes to light after the appointment.

This is also where the points worth raising in conversation with the candidate are set out. The audit shows connections observable from the outside; only the person themselves knows the full picture. A direct question with a prepared list of what has been found works better than a general request to "disclose any conflicts of interest".

Граница вывода. Open sources reveal only the formal part of connections. Informal relationships and arrangements cannot be established by external methods - they are addressed by disclosure from the candidate.

The context of negative material

A negative publication is not the result of a check but the start of separate work. It may reflect a real event, be a good-faith error, a retelling of someone else's item, or part of a targeted campaign. The difference becomes clear only by verifying the material itself.

The order of work is consistent. First the original source: who published it first, when, and on the basis of what. Then dissemination: did the story spread through independent publications with their own verification, or was it multiplied as copies of a single text. Then the documentary basis: is the assertion supported by a court act, a regulator's decision, an official document - or only by the words of an anonymous source. Then the response: did the candidate deny it, was the publication amended or removed, is there a court decision in a dispute over it. And finally time: an event from fifteen years ago and an episode from last year carry different weight for a decision.

A separate indicator worth being able to recognise is synchronicity. The appearance of a series of similar materials over a short period on platforms without editorial standing, coinciding in time with a corporate conflict or a transaction, is characteristic of an organised campaign. This is an observation, not evidence: it is recorded as an indicator and requires separate analysis rather than being carried into the conclusion.

The result of this chapter is a reformulation. Instead of "there is negative material about the candidate online", the report states: such an assertion was published by such a publication on such a date, has no primary confirmation, spread through reprints, was not publicly commented on by the candidate, and there are no court acts on the subject. A board can work with that wording. With the first, it cannot.

And a fundamental limitation: the audit does not establish the truth of media assertions. It establishes what was published, by whom, when, and whether it is confirmed by independent material. Assessing the reliability of a disputed assertion is a matter for legal proceedings, not for an analytical report.

Граница вывода. A publication confirms the fact of publication, not the event it describes. Indicators of a coordinated campaign are recorded as indicators; a conclusion that one exists requires separate research and is not drawn from a coincidence of dates.

How to present a balanced conclusion to the board of directors

The value of an audit is determined by its last page. A board takes its decision not on the volume of material collected but on how clearly it is shown where the confirmed ends and supposition begins.

Three rules of formulation. The first - separating levels. Every material statement is marked: confirmed by an official source, follows from the totality of facts, remains a hypothesis, unavailable for verification. A report written throughout in a single tone forces the reader to guess what is fact and what is conjecture.

The second - connection with the position. For each circumstance, answer the question of how it relates to the powers of that role. A dispute with a former employer over payments may be immaterial for a chief operating officer and significant for the head of the HR function. Without that link, the report becomes a dossier, and the board does not need a dossier.

The third - symmetry. An audit records not only risks: confirmed experience, the absence of expected problems, a stable professional reputation - these are also results of the check, and they must appear in the conclusion. A report consisting only of troubling findings gives a distorted picture and pushes toward a decision no less than an openly flattering one.

The practical form that works: a one-page summary - what has been established, what was not confirmed, what remains open; a list of questions for the candidate; a list of manageable risks with an indication of how each is closed (by disclosure, a change of reporting line, a contractual condition, an additional check). The decision remains with the board - the audit provides grounds, not a recommendation to hire or reject.

And finally: the candidate has rights in respect of their personal data. Transparency here is not only a legal requirement but also a practical interest of the company - an appointment that begins with a sense of surveillance is rarely successful.

Граница вывода. The audit does not pass judgment on a person's suitability and does not replace the board's decision. It describes verifiable circumstances and the limits of their confirmation as at the date of the check.

What a professional process looks like

The order of work matters more than the set of sources: it determines both the lawfulness and the usability of the result.

The first step - framing: the position, the powers, the purpose of the check, the deadline for a decision. The second - the legal basis and the scope: which categories of data are necessary, which jurisdictions are involved, what is deliberately not collected. The third - notifying the candidate and obtaining from them the information they are prepared to confirm themselves. This step is often skipped, yet it saves the most time: half of the discrepancies are closed by a direct question.

Then collection: corporate registers in each country, court and regulatory materials, sanctions and watchlist sources, professional publications, media archives. Each source is recorded with the date of access.

Then verification: material conclusions are checked against a second independent source, contradictions are not smoothed over but set out separately. Contested statements from publications are checked against the primary source and documentary basis.

The final stage - formulating the conclusion with levels of confirmation, a list of questions for the candidate and a working session with the client, at which not only the findings are discussed but also what remained unverified.

Граница вывода. Following the process does not guarantee completeness: part of the information is unavailable by lawful means. The process guarantees that what is unavailable will be named, not replaced by an assumption.

What the client receives as a result

The material must be usable by a person who took no part in collecting the data, and for a conversation with the candidate themselves.

The first - a summary for the decision-maker: what is confirmed, what was not confirmed, what remains open.

The second - a verified professional profile: positions and periods, education and qualifications, former companies with a chronology of their condition.

The third - the layer of circumstances: court and regulatory materials with the procedural role and stage, sanctions and PEP results with identification, the public professional record, a map of conflicts of interest.

The fourth - the working part: a log of sources with dates, a list of discrepancies between what was stated and what was confirmed, questions for the candidate and a list of manageable risks with the way each is closed.

Граница вывода. The report describes the position as at the date of the check and is not a hiring recommendation, a legal opinion or an assessment of professional suitability.

Limitations and the lawfulness of methods

Reputational audit works with open and official sources, public professional materials and information the candidate provides directly. Processing personal data requires a legal basis and proportionality to the purpose: these are principles expressly set out in the European regulation, and the 2024 guidance of the European Data Protection Board examines in detail how to assess the necessity of processing where legitimate interest is relied upon.

What the audit does not do. It does not obtain access to closed state or banking data. It does not conduct surveillance of a person and does not collect information about their movements. It does not request information from third parties under false pretences. It does not work with closed accounts or private correspondence. It does not collect special categories of data - health, beliefs, origin - or data on private life unrelated to the position.

What the audit does not guarantee. It does not predict a person's conduct in a new role: a confirmed unblemished record is no protection against future decisions. It does not prove a violation - procedural mechanisms exist for that. It does not replace assessment of professional competence, which is done through interviews, assessment and references.

And the principal practical limitation: some conclusions in a check on an individual are probabilistic in nature, because public sources are by their nature incomplete. An honest report differs from an impressive one in that it shows which points remained unverified.

Граница вывода. A legal assessment of specific circumstances - employment, corporate, sanctions-related - is given by a specialist adviser in the relevant jurisdiction.

What to prepare for the initial assessment

• The position, its authority and signing rights: without this it is impossible to determine a reasonable scope of checking.
• The candidate's CV or a list of stated positions and periods - as material for comparison, not as a source.
• The countries connected with the candidate's biography: the availability of sources and the timeframe depend on them.
• The deadline for a decision by the board or the hiring manager.
• What you have already checked: references, interviews, internal procedures - so that you do not pay for work to be repeated.
• Whether the company has an internal candidate screening policy and a notification procedure - this affects the legal basis.

Copies of documents, the candidate's personal data and internal materials are not needed at the initial assessment stage. What is listed above is enough to answer what scope of checking is justified in your case, within what timeframe, and what will remain unavailable.

Frequently asked questions

• 01

  How does a reputational audit differ from an ordinary security department check?

  The difference lies in the starting point and in the discipline of the conclusion. A classic check more often answers the question "is there anything bad" and collects everything available. A reputational audit begins with a description of the position and checks only what relates to its authority, marking each conclusion with a level of confirmation: fact, conclusion drawn from a body of facts, hypothesis or gap. Material of this kind is suitable for a conversation with the board of directors and with the candidate himself.

• 02

  Does the candidate have to be informed of the check?

• 03

  Are social media and private life checked?

• 04

  What should be done if the candidate has court cases?

• 05

  What does a politically exposed person status mean for a candidate?

• 06

  How long does a reputational audit before an appointment take?

• 07

  Can an audit guarantee that a candidate will not cause problems?

• 08

  What should be done with a negative publication that has no documentary confirmation?

What follows from this

A reputational audit before an appointment rests on two things: proportionality and discipline in the conclusion. Proportionality means that the depth of the check is set by the position, not by curiosity. Discipline in the conclusion means that the report always shows where there is a confirmed fact, where there is a reasoned observation, and where there is a gap.

Practical benefit appears not at the moment something troubling is found, but at the moment the finding is turned into a specific action: a question to the candidate, disclosure of a conflict, a change in reporting lines or a term in the contract. Most findings are manageable if they are known before the appointment.

If an appointment decision is due and there is a deadline, it makes sense to start with an initial assessment: what scope of checking is justified for this position, within what timeframe it can be carried out, and what will remain unavailable.

Sources

• EUR-Lex - General Data Protection Regulation (GDPR), Regulation (EU) 2016/679проверено 6 августа 2026

  Legal bases for processing, the minimisation principle and the rights of the data subject

• EDPB - Guidelines 1/2024 on processing of personal data based on legitimate interestпроверено 6 августа 2026

  How to assess the necessity of processing and balance the interests of the parties

• FATF - Guidance on politically exposed persons (Recommendations 12 and 22)проверено 6 августа 2026

  PEP status as grounds for enhanced measures, not as a conclusion of wrongdoing

• European Commission - Overview of EU sanctions regimes and related resourcesпроверено 6 августа 2026

  Official lists and tools for checking matches

The links lead to official materials. The applicability of the rules depends on the jurisdiction and on the industry: before relying on them in a particular country, local regulation must be checked and a lawyer consulted.

Связанные материалы

• 01 /ServiceIndividual background check→
• 02 /CaseИнформационное давление на CEO перед сделкой M&A→
• 03 /ArticleWhat a check on an individual shows before entering a partnership→
• 04 /ArticleSigns of a nominee owner in a company structure→
• 05 /ArticleHow to check a counterparty before a deal→