The Contractor Who Passed the Background Check
A financial services firm uses a staffing agency to supply 60 contract IT workers, 22 of whom have privileged access to production systems handling customer account data. The master services agreement states the agency will perform background checks 'consistent with industry standards.' A contractor with production access is discovered to have a 2019 conviction for computer fraud that did not appear in the agency's report because the agency checked only the most recent seven years and only the county of current residence. The contractor's access was provisioned by the IT hiring manager on the agency's assurance, with no independent verification by the firm. The firm's own employee screening standard requires a 10-year lookback and a national criminal search. Regulators are due in eight weeks. Legal advises that abruptly terminating the contractor could create a wrongful-termination exposure.
1. Identify the governance failures across the third-party relationship, and assign responsibility.
Read the worked answer
There are three distinct failures at three different layers, and conflating them will produce a fix that misses two of them.
Contract layer (procurement/legal): The MSA used the phrase 'consistent with industry standards' instead of specifying the firm's actual standard - 10-year lookback, national search. That is an unenforceable, unmeasurable obligation. The firm delegated a control to a third party without defining it, so the agency complied with a standard, just not the firm's. Responsibility sits with whoever negotiated the MSA.
Provisioning layer (IT): The hiring manager granted privileged production access on the agency's assurance alone, with no independent verification. That is a control gap inside the firm - the firm accepted an attestation as if it were evidence. Responsibility sits with IT access management and the identity governance process.
Oversight layer (security/third-party risk): No one was monitoring whether the agency's screening actually matched the contract or the firm's standard. There is no evidence of periodic audit or sampling of agency screening results. Responsibility sits with the third-party risk function.
The contractor is the symptom. The firm's own employee standard was stricter than what it required of people with more privileged access - that inversion is the core governance failure.
2. Legal warns that immediate termination creates legal exposure. Propose a sequenced response that manages both the security risk and the legal risk.
Read the worked answer
The two risks are not actually in conflict if they are sequenced correctly: access removal is a security action, employment status is a legal action, and they do not have to happen on the same day.
Immediately (same day): Suspend or revoke the contractor's privileged access and rotate any credentials or secrets the contractor could have accessed. This is a security control, not a termination, and it is defensible on its face - access is a business decision, and the firm can restrict it pending review. Preserve logs and any evidence of system activity during the contractor's tenure. Do not confront the contractor with accusations before legal has reviewed the approach.
Days 1–7: Legal reviews the termination question against the MSA, the agency relationship, and applicable employment law. Because the contractor is agency-employed, the firm's exposure may be more limited than feared, but legal must confirm. Coordinate with the agency on how the separation is communicated.
Days 7–14: Notify the agency formally of the screening deficiency and require remediation of the MSA and re-screening of the other 59 contractors against the firm's actual standard, prioritizing the 22 with privileged access.
Weeks 2–6: Re-screen the privileged population independently; do not rely on agency attestation. Document everything for the regulator.
This separates the urgent security action (revoke) from the deliberate legal action (terminate), so neither is held hostage to the other.
3. Regulators arrive in eight weeks. What should the firm be able to demonstrate, and what should it not claim?
Read the worked answer
The firm should be able to demonstrate a coherent, evidenced response - not a claim that the problem never existed. Regulators generally distinguish between an organization that had a control failure and responded, and one that had a failure and concealed or ignored it.
Demonstrate:
- The specific deficiency identified (lookback period, geographic scope) and how it was discovered.
- The MSA gap and the executed remediation - amended contract language specifying the firm's actual standard, with audit rights.
- Independent re-screening results for all 60 contractors, with the 22 privileged ones prioritized and completed.
- Access governance change: no privileged access provisioned on third-party attestation alone; independent verification required.
- The access revocation timeline and evidence preservation for the affected contractor.
- A monitoring cadence so the gap does not recur (periodic sampling of agency screening).
Do not claim:
- That the agency 'failed' in a way that absolves the firm. The firm defined an unmeasurable standard and accepted attestation as evidence; that is the firm's failure.
- That the contractor's access was harmless without having reviewed the logs. If the review is incomplete, say so and state when it will be done.
- That the issue is closed if re-screening is still in progress. Report status honestly with dates.
The governing principle: the regulator is assessing whether the firm's governance works, and a well-documented remediation is stronger evidence of functioning governance than a clean record with no evidence of oversight.