In almost every family program I am asked to look at, the widest gap is not the fence, the camera or the guard. It is a person who was checked thoroughly on the day they were hired and has never been checked again since. They are trusted, they are competent, and they have keys, codes, schedules, vehicles, devices and the confidence of the household.
This is also the cheapest gap to close. It costs a process and two uncomfortable conversations, not a budget. What follows is how I do it.
A background check tells you who someone was on a Tuesday nine years ago. It tells you nothing about who they are under pressure today.What a check from nine years ago no longer tells you
Vetting captures a moment. People do not stay in that moment. In nine years the things that actually create exposure are precisely the things that change:
- Financial pressure. Debt, a business that failed, a medical event, a divorce, gambling. Financial distress is the single most common precondition of an insider incident, and it is invisible in a hiring-day credit check.
- New relationships. A partner, a family member or an associate with their own problems — or their own interest in the household. The employee may be entirely loyal and still be the route in.
- Legal matters. Charges, judgments, restraining orders, licence actions. Most employers never learn about any of it.
- A second income. Outside work that creates a conflict, an obligation, or a reason to talk about the family.
- Public exposure. Nine years of social media, much of it created before they understood what their job would become. Photographs of the residence. Location posts. The principal in the background of a family picture.
- Leverage. Something in their life that someone else can use. This is the one that matters most and the one no form will ever surface.
None of these make a person untrustworthy. They make a person reachable. The purpose of re-vetting is not suspicion. It is to know where pressure could be applied before someone else finds it first.
The cadence
A schedule is what converts this from an accusation into an administrative fact. It runs whether or not anyone is worried, which is the entire reason it works.
- Annually — the light touch. Criminal and civil records, licence and driving status, sanctions and watchlists, a public-record and open-source sweep, and confirmation that declared outside work has not changed. Roughly an hour per person.
- Every three years — the full review. Everything above, plus financial indicators appropriate to the role and the jurisdiction, identity and right-to-work re-verification, a fresh reference conversation, and a sit-down.
- On any trigger — out of cycle. Immediately, regardless of where the person sits in the schedule.
Scope the depth to the access, not to the job title. A groundskeeper with a gate code and an alarm PIN warrants more than a senior employee who has never been inside the residence.
The triggers
Any of these pulls a person out of the normal cycle and into a review now:
- A significant change in financial circumstances, disclosed or observed.
- A new partner, housemate or family member with access to the employee's home, devices or vehicle.
- Any contact from press, investigators, or someone asking about the family.
- An unexplained change in working pattern — volunteering for unusual hours, resisting time off, or a sudden interest in areas outside their role.
- A security incident anywhere in the program, even one that appears unrelated.
- Promotion, or any material widening of access.
- A grievance, a disciplinary matter, or a resignation that is later withdrawn.
- The employee's own disclosure. Make disclosure the easy path and most of this arrives voluntarily.
The half everyone forgets: access
Re-vetting the person and never reconciling what the person holds is half a job. Access accumulates silently — a code issued for a single weekend, a spare key for a contractor, an app that was never removed from a phone.
- Maintain one written inventory: keys, door and gate codes, alarm PINs, safe combinations, vehicle keys and fobs, devices, accounts, shared passwords, building credentials, and anything held by a family member of the employee.
- Reconcile it against reality on the same cadence as the vetting. Physically. Count the keys.
- Rotate every shared credential on a schedule, not only after departures. A code that has never changed is a code that everyone who ever worked there still knows.
- Write the last-day procedure before you need it, and make one named person accountable for executing it within twenty-four hours.
- Apply the same discipline to vendors' staff. The cleaning company's turnover is your exposure, and their people are rarely in anyone's inventory.
Never single anyone out
The moment a re-vet is aimed at one person, it stops being a policy and becomes an accusation — and you will damage a relationship that took a decade to build. It is applied to everyone, on a schedule, from the newest hire to the estate manager who has been there twenty years. Where the principal's own office staff are in scope, they go first and visibly.
The conversation
Long-tenured staff do not resent being re-vetted. They resent being surprised by it. The difference is entirely in how it is introduced.
- Put it in writing first, in the employment terms and the handbook, so it is a condition of the role rather than an event. Where contracts are already signed, introduce it as a program-wide change with a start date, not a decision about a person.
- Explain what it protects. A documented, current file protects the employee as much as the family. When something goes missing, the people who have been checked recently are the people who stop being asked about it.
- Say what you are not doing. You are not reading their messages, not monitoring their family, and not looking for a reason to dismiss them.
- Ask directly, once. "Is there anything in your life right now that someone could use against you, or against this family?" Then stop talking. The pause is where the answer comes from.
- Make disclosure survivable. If the honest answer to that question ends someone's career, you will never hear an honest answer again from anybody.
When something does turn up
Most findings are not grounds for dismissal. They are grounds for a decision, and the decision belongs to whoever is accountable for the whole program — not to the household manager alone and not to the vendor who ran the check.
- Separate relevance from discomfort. A nine-year-old conviction unrelated to the role is rarely relevant. Undisclosed debt in a person who handles payments always is.
- Weigh non-disclosure more heavily than the finding itself. What the person chose not to say is the better signal.
- Consider adjusting access before considering employment. Most findings are solved by moving a credential, not a person.
- Document the decision and who made it. The next incident will be assessed against this record.
- Take advice before acting. Employment and privacy law varies by jurisdiction, and a badly handled dismissal creates a motivated former insider who knows the residence.
The working checklist
Print this. One per person, per cycle.
- Written policy exists and applies to every member of staff without exception
- Consent and disclosure authorisations are current and signed
- Role's actual access is documented before the review, not assumed
- Depth of the review is scoped to that access
- Jurisdictional limits on what may lawfully be checked are confirmed
- Identity and right to work re-verified against current documents
- Criminal and civil records checked across every jurisdiction of residence
- Driving record and licences confirmed where the role involves vehicles
- Sanctions, watchlist and adverse-media screening completed
- Financial indicators reviewed where the role touches money, payments or purchasing
- Open-source and social-media sweep — including the residence, vehicles and the principal appearing in the background of the employee's own posts
- Declared outside employment and business interests confirmed as unchanged
- One current reference spoken to, not emailed
- Every key, fob and physical credential physically accounted for
- Door codes, gate codes and alarm PINs verified against the inventory
- Device, account and shared-password access reviewed and pruned to the role
- Shared credentials rotated on schedule
- Credentials held by the employee's family members identified
- Sit-down held in person, framed as policy and not as suspicion
- The direct question asked, and the silence left open
- Anything disclosed is recorded, with the response agreed and dated
- Employee told when the next review falls due
- Findings, decisions and the decision-maker documented
- Access adjustments executed and re-verified, not merely instructed
- Next scheduled review entered in the calendar
- Trigger list re-circulated to whoever supervises staff day to day