In-house BS7858 screening: what changes when you leave a bureau

A reference arrives at 9pm on a Sunday, by WhatsApp, from a mobile number the candidate wrote on her form. The sender says he supervised her on a retail guarding contract in 2023 and found her reliable. When a bureau runs your screening, someone there decides whether that message is genuine and you see the outcome. Run in-house BS7858 screening and the call is yours, and the Security Industry Authority (SIA) has said what it expects: extra checks to make sure the source is genuine, and a record of how you verified the sender.

Most of what changes when you leave a bureau looks like that. Small judgement calls that someone else used to make on your behalf now land on your desk.

What does in-house BS7858 screening actually change?

It changes who does the work, not who answers for it. BS7858:2019 is the British Standard code of practice for screening people who work in a secure environment. The British Standards Institution (BSI), which publishes it, says in its description of the 2019 edition that the organisation "remains responsible for any screening activities that it decides to outsource". The SIA's guidance for approved contractors is blunter: "Outsourcing your screening does not outsource your responsibility."

So the decision to employ someone, the acceptance of any risk left in their file and the job of answering an auditor were never the bureau's to carry. The same BSI description places more importance on top management, who are expected to deploy appropriate resource and accept risk, though they can delegate specific tasks to competent people. What a bureau sold you was time.

If you want the fundamentals first, our plain-English guide to BS7858 covers what the standard asks for.

Who is responsible when a bureau does the screening?

You are. For an SIA approved contractor the stakes are specific, because the SIA says your pre-employment screening must conform to BS7858 for you to remain an approved contractor. Its guidance then lists what to do when you use a provider. Write BS7858 into the contract. Audit the screening process. Check that the provider holds BS7858 certification or, if it doesn't, that its staff hold BS7858 training certificates. And ask for a file "accounting for every stage of the screening process, not simply a certificate".

That last point deserves more attention than it gets. If your current arrangement sends you a completion certificate and nothing else, you're already carrying the responsibility without the evidence. Bringing screening in-house closes that gap rather than opening one.

The same page says "there are some elements of BS 7858 that you cannot outsource", but it doesn't list them. The standard itself is where to look, so read it before you decide which jobs to keep and which to buy in.

Which jobs move to your team?

The collecting, chasing, verifying and reconciling move to you, along with custody of the file. The deciding was already yours.

Chasing is where the hours go. A former employer's HR inbox that only answers written requests, a referee who has moved on, a candidate who can't remember whether he left the Army in March or May 2021: each one takes a call, a reminder and a note on the file. A bureau billed you for that time. In-house it lands on whoever owns screening, usually on top of the rest of their job. What BS7858 screening costs, in-house or through a bureau covers the money side.

Gaps are where judgement comes in. Your team decides whether a three-month gap in 2022 is explained by the evidence the candidate offers, and what happens when it isn't. Our guide to BS7858 employment gaps covers which evidence to accept.

Conditional starts are where things slip. Once an officer is working while full screening completes, someone has to own the date it must finish by, and with a bureau that ownership tends to sit between two inboxes. How conditional employment works under BS7858 sets out the windows.

Checking references yourself

This is the part that's easiest to rush when screening is one job among several. The SIA's guidance accepts that references now arrive "by text message or another type of electronic message", which makes the source harder to verify, and it asks for extra checks. You should verify the contact details of the person who sent the message and record how you did it. A provider is expected to keep copies, photos or screenshots of those messages in the screening file. In-house, you keep the same evidence yourself.

In practice that means looking up the former employer's number yourself rather than using the one on the candidate's form. It means checking that an emailed reference comes from the company's own domain, and calling back on an independently sourced number when a reference turns up by text. Then note on the file which of those you did.

Forged references aren't hypothetical. In October the SIA published the prosecution of a north London man who sent it two forged references to support his appeal against a possible licence refusal. One was supposedly from a former employer he had never worked for. The other was from a doctor, but no doctor with the name given was registered with the General Medical Council. He pleaded guilty at Highbury Magistrates' Court on 30 September 2026 to two offences under the Forgery and Counterfeiting Act 1981. Those went to the regulator rather than to an employer, and nothing about them would have looked different arriving in an HR inbox.

If you're thinking of speeding things up with an online employment-history data bank, read the SIA's list first. It's written for firms whose provider uses one, but the checks carry over if you use one yourself: confirm the data bank complies with the Data Protection Act, that the candidate has checked their records and consented to access, that any fees were disclosed to and agreed by the candidate, that the records belong to the right person, and that anomalies have been followed up with the former employers.

Is in-house screening right for every team?

No. It works well when you hire steadily, someone owns screening as part of their job and has been trained to the standard, and you'd rather see the file than a certificate. It's harder going when you need 200 event stewards cleared in a fortnight and nobody on the team has screened before, or when a candidate's history runs through several countries.

You don't have to choose all or nothing. BSI's wording, "any screening activities that it decides to outsource", allows for a mix: keep the file and the decision in-house, and buy in the pieces that need specialist reach. The SIA's checks on providers still apply to whatever you buy, and the evidence still has to end up in your file.

Where software fits

BSI's description of the 2019 edition mentions "a recognition of the role of automation", and its Annex A forms became informative examples you can adapt. Software still doesn't change the split in the table. Your team reviews each file and signs it off. What software can take is the collecting and chasing.

Yezda is built around that division. Candidates complete their ID, selfie and history in a mobile app, references are collected and chased, and gaps in the five-year address and employment history are flagged for your team to reconcile. A conditionally cleared case carries its full-screening deadline on the file, sign-off can require a second person, and every step is kept in an immutable audit trail. See how a case runs through the product.

A test to run before you decide

Ask your current bureau for the complete screening file on your last five starters. Not the certificates: every reference with how it was verified, every gap and how it was closed, and the consent records. If it arrives quickly and complete, your provider is giving you what the SIA says you should have, and the choice comes down to cost and control. If it doesn't, you've been carrying the responsibility without the evidence, and that needs fixing whichever way you go.