Corporate and compliance
Pre-employment and vendor due diligence in New Zealand
Verification and surveillance are different activities with different legal footing. Most disputes start when a check quietly turns into the second one.
By Mike Gillam, Managing Director
Published · Reviewed
Due diligence on a person or a supplier has two modes that look similar and sit on very different legal footing. Verification confirms that what you were told is true. Surveillance looks for what you were not told. Most problems in this area start when a check drifts from the first into the second without anyone deciding that it should.
Pre-employment: relevance is the whole test
Information Privacy Principle 1 permits collection of personal information where it is necessary for a lawful purpose connected with the agency's functions. For hiring, the purpose is assessing suitability for a specific role, so every check should be traceable to a requirement of that role.
A directorship and insolvency check is plainly relevant for a finance director and hard to justify for a warehouse position. A credit check is relevant where the role carries financial authority and is otherwise intrusive. A criminal record check is appropriate where the role or the sector requires it, is obtained through the Ministry of Justice with the candidate's consent, and is not something a search platform provides.
Making the candidate aware of the checks, before they are run, satisfies the notification obligation and has a practical benefit. Discrepancies are usually explained rather than discovered.
What is reasonable to verify
Identity and right to work. Qualifications and professional registrations, verified with the issuing body rather than accepted on a copy. Directorships and disqualifications where the role involves stewardship, drawn from the companies register. Insolvency status where the role handles money, using the register described in checking bankruptcy and liquidation status. Publicly available professional history, and references from named referees.
Where to stop
Family circumstances, health, political or religious views, and financial position where the role does not require it are not job related, and collecting them creates exposure under both privacy and human rights law. Reviewing a candidate's social media for anything other than role relevant conduct falls into the same category: what a profile mostly reveals is protected characteristics, and once seen they cannot be unseen in a hiring decision.
A useful discipline is to write the check list before seeing the candidate, tied to the role description, and then run that list rather than following curiosity.
Vendor and counterparty due diligence
Suppliers attract fewer personal information constraints and more commercial risk, so the emphasis shifts.
The entity, properly identified. The name on the proposal is often a trading name. Get to the registered entity and its number, then confirm status, age and previous names.
The people behind it, across entities. The important question is rarely this company's record. It is what the directors' other companies did. A pattern of entities incorporated, run for two years and liquidated is visible only in the director's full appointment history.
Encumbrance. A PPSR search showing a general security agreement over all present and after acquired property tells you who ranks ahead of you if the supplier fails mid contract.
Dispute behaviour. Litigation history shows how a counterparty conducts itself when a contract goes wrong, which is exactly the scenario the diligence is meant to price.
Control. For material contracts, follow the ownership to the natural persons using the approach in beneficial ownership, and screen where the relationship or the jurisdictions warrant it.
Proportionality and the record
Scale the enquiry to the decision. A three month contract for routine services does not justify the diligence appropriate to a multi year outsourcing arrangement, and the same applies to a fixed term junior role against an executive appointment.
Record the purpose before each search and keep the results only as long as the decision requires. Candidate information in particular should not accumulate indefinitely in a recruitment folder once the role is filled. The reasoning is set out in what a professional search audit should record.
Corporate and compliance teams will find the wider workflow on the corporate and compliance page. Access is issued to verified professional users through the request access page.