Why Defence’s workforce screening guidance risks confusing administrative compliance with genuine personnel security assurance.
The Defence Industry Security Program (DISP) exists to strengthen security across Australia’s Defence industrial base. At its centre is a straightforward principle: organisations entrusted with Defence information, systems and capabilities must be able to trust the people they employ.
But how do we establish that trust?
The Defence Industry Security Office (DISO) has published a Workforce Screening Factsheet intended to help DISP members understand their obligations under AS 4811:2022 Workforce screening.
Its intentions are sound. The problem is what the guidance leaves out.
When examined against AS 4811:2022, AS ISO 31000:2018 and the Australian Government’s personnel security framework, the factsheet presents a simplified screening model that risks encouraging organisations to mistake completed background checks for a completed suitability assessment.
A police check establishes certain facts about a person’s history. It does not establish their character.
A completed screening checklist demonstrates that activities occurred. It does not necessarily demonstrate that personnel security risks have been identified, analysed or evaluated.
These distinctions matter enormously to the Defence industry.
1. DISO Identifies a Compliance Problem — But Does Its Guidance Solve It?
The factsheet acknowledges that DISP audit and assurance activities have identified workforce screening as an area of common non-compliance.
It also recognises that gaps arise when organisations have limited access to, or understanding of, AS 4811:2022.
That is a significant admission.
Defence has correctly identified that DISP members are struggling to understand and operationalise the Australian Standard.
However, the solution cannot simply be to reduce a comprehensive, risk-based workforce screening framework to a series of administrative tasks.
AS 4811:2022 was developed to provide organisations with ongoing assurance about the eligibility and suitability of individuals entrusted with organisational assets.
It incorporates the risk management principles of AS ISO 31000:2018.
Misinterpreting ISO 31000 Proportionality
Factsheet Text: “Screening should be risk-based and proportionate to the position, access and operating environment. AS 4811:2022 incorporates the risk management principles of AS ISO 31000:2018.”
High Inherent Role Risk: For DISP members accessing Defence information, systems, or sensitive capabilities, statutory and contractual rules establish that role risk is inherently high before recruitment begins
Scaling Depth, Not Existence: Under AS ISO 31000:2018, proportionality dictates the length, depth, and format of the 1:1 suitability interview across risk tiers (e.g., a 15-minute baseline check vs. an intensive multi-hour review), rather than providing an excuse to skip candidate character suitability evaluation entirely.
The ISO 31000 requires more than collecting information. It requires organisations to identify risks, gather relevant evidence, evaluate that evidence against established criteria and make defensible decisions.
The distinction is between evidence collection and risk assessment. They are not the same thing.
2. The Most Significant Omission: The 1:1 Suitability Interview
The factsheet’s minimum screening checks include:
- Identity verification.
- Address history.
- Character references.
- National Police Checks.
- Regulatory checks.
- Employment experience and qualifications.
These are legitimate and valuable screening activities.
But there is a significant omission.
Where is the 1:1 Suitability Interview?
AS 4811:2022 identifies conducting a suitability interview within its screening process architecture. The Risk Assessment (Green Box at the top) comes before the Interview. The Risk Assessment does not justify ignoring or by-passing the Suitability Interview and Suitability Risk Assessment.
Figure 1 positions the interview upstream of the eligibility and suitability assessments.
Its purpose is to obtain information that contributes to an informed decision about the individual.
This is important because there are two fundamentally different ways to learn about a candidate.
The first is to retrieve information held by third parties: police records, employment records, databases, professional registrations and qualifications.
The second is to engage directly with the individual to understand circumstances, behaviours, motivations, explanations and relevant risks.
One verifies existing records.
The other allows the assessor to develop and test a fuller understanding of the individual.
An interview is not infallible, and the information obtained should be corroborated where appropriate. Nevertheless, it provides an important source of qualitative evidence that databases cannot independently supply.
To be precise, the interview is not expressed as a standalone mandatory shall requirement in isolation. But its inclusion in the standard’s process architecture raises an important operational question.
How does an organisation establish suitability without directly engaging the person it is assessing?
The factsheet should address that question rather than omit the interview from its presentation of minimum screening activities.
3. Resolve Discrepancies — But Against Which Criteria?
The factsheet instructs DISP members to verify information, assess results, resolve discrepancies and record decisions.
That sounds sensible.
But it leaves a fundamental question unanswered.
What evaluation criteria should an Assessor (or DISP Security Officer) use to determine whether an adverse finding makes a candidate unsuitable?
Consider a candidate whose National Police Check reveals an offence from several years earlier.
The certificate may establish the recorded offence and its disposition.
It cannot establish the full circumstances, the candidate’s motivation, the degree of participation, subsequent rehabilitation or the likelihood of recurrence.
These are not minor details.
They can materially change the interpretation of the evidence and the outcome of a suitability assessment.
There is an instructive comparison with the Australian Government Personnel Security Adjudicative Standard 2026.
That framework identifies eight conduct considerations for assessing adverse information, including the seriousness of the conduct, its surrounding circumstances, frequency and recency, maturity, rehabilitation, motivation, potential vulnerability to coercion and likelihood of recurrence.
Importantly, the Adjudicative Standard applies to Authorised Vetting Agencies undertaking security clearance assessments. It is not automatically a mandatory assessment framework for every DISP pre-employment screening activity.
Nevertheless, it demonstrates the level of contextual reasoning necessary for sound personnel security decisions.
There is also a procedural fairness issue.
The Australian Human Rights Commission’s guidance on criminal record discrimination emphasises the importance of considering whether criminal history is relevant to the inherent requirements of the particular position.
An automatic rejection based solely on the existence of a police record may overlook relevant circumstances and create avoidable discrimination risks.
A properly structured suitability interview provides an opportunity for the candidate to explain relevant information before a decision is made.
Procedural fairness and national security are not competing objectives. Good assessment practice supports both.
Also see The AS 4811 Suitability Interview: Why It Isn’t Optional: https://www.linkedin.com/pulse/4811-suitability-interview-why-isnt-optional-edward-barker-z7p7c/
4. The Clean Police Check Fallacy
One of the most persistent misunderstandings in workforce screening is the assumption that a clear National Police Check establishes that a person is trustworthy.
It does not.
A National Police Check provides information about disclosable police history, subject to applicable disclosure rules.
It does not establish that the individual has never engaged in misconduct, that they are free from vulnerabilities or that they possess the character qualities required for trusted access.
The Australian Government Personnel Security Adjudicative Standard identifies seven risk factor areas relevant to national security clearance suitability.
Those areas extend beyond criminal history to include external loyalties and influences, personal conduct, financial considerations, alcohol and drug use, security attitudes and violations, and relevant emotional and mental health considerations.
These are assessment domains, not automatic indicators of adverse character. Their relevance must be evaluated carefully, proportionately and without discriminatory assumptions.
Criminal history is only one dimension of personnel security risk.
A clean police check cannot independently identify matters such as deliberate résumé falsification, undisclosed conflicts of interest, drug use, gambling, emerging financial pressures or circumstances that may expose an individual to coercion.
Nor does the absence of a recorded conviction positively establish honesty, trustworthiness, tolerance, maturity, loyalty or resilience.
A “black mark” background checks can help answer what has been recorded about a person.
A suitability assessment must go further and consider what the available evidence means for the person’s proposed responsibilities and access.
5. Outsourced Screening: Who Actually Makes the Suitability Decision?
The DISO factsheet correctly states that outsourcing screening does not remove the DISP member’s accountability.
This is one of its most important messages.
But it creates another question.
What happens when a DISP member outsources screening to a provider whose services primarily consist of automated document and database checks?
Many commercial background screening services efficiently verify identity, criminal history, employment records and qualifications.
That can be appropriate for the contracted scope.
However, a bundle of verification results is not a suitability determination and legacy screening companies will say we “support” AS4811, but not conform to it.
Where a report identifies a discrepancy or adverse finding, someone must take responsibility for investigating its significance.
Who contacts the candidate?
Who gathers mitigating information?
Who evaluates the findings against the position’s risk requirements?
Who documents the risk assessment and determines whether the residual risk is acceptable?
If these responsibilities are not clearly allocated, the DISP member receives a completed screening report while still lacking an adequately evidenced suitability decision.
And as DISO itself acknowledges, accountability remains with the DISP member.
The commercial distinction is important.
Are you purchasing background checks, or are you purchasing a structured suitability assessment?
Both services have value.
They should not be represented as interchangeable.
6. Risk-Based Screening Must Mean More Than Fewer Checks
The factsheet correctly observes that screening should be risk-based and proportionate to the position, access and operating environment.
That is consistent with AS ISO 31000:2018.
However, proportionality must not become an excuse for superficial tick & flick like AS4811:2006 was criticized heavily for.
For a Defence contractor (or SOCI / Critical Infrastructure Sector) handling sensitive technologies, privileged systems or protected information, the consequences of an unsuitable individual obtaining access can be substantial.
The appropriate response is not to perform every possible screening check under the sun!
It is to design a screening process capable of addressing the risks associated with the actual position.
For lower-risk roles, a shorter, structured candidate interview and proportionate verification may be sufficient.
Higher-risk roles may require more extensive questioning, corroboration, specialist checks and a deeper risk assessment.
The duration and depth should be driven by evidence requirements, not arbitrary time limits.
There should also be appropriate privacy safeguards and clear boundaries around collecting sensitive personal information.
The objective is not maximum intrusion.
It is sufficient evidence to support a defensible decision.
Risk-based screening should scale the depth of the assessment to the risk—not confuse reduced administration with reduced risk.
7. Another Important Distinction: PSPF Section 16
The Australian Government Protective Security Policy Framework, Release 2026, also provides important context.
Section 16 addresses pre-employment eligibility and screening, with Section 16.1 covering pre-employment screening.
The PSPF distinguishes between establishing a person’s eligibility and assessing their suitability.
Those are related but different obligations.
A person may satisfy identity and employment eligibility requirements while still presenting a suitability concern relevant to the position.
Equally, identifying potentially adverse information does not automatically establish that a person is unsuitable.
The decision requires analysis and context.
8. What DISO Should Change
The solution does not require an entirely new screening standard.
AS 4811:2022 already exists.
What Defence industry needs is operational guidance that accurately reflects the standard’s risk-based architecture.
In my view, the DISP Workforce Screening Factsheet should be strengthened in five areas.
First — Explicitly recognise the 1:1 Suitability Interview.
Explain its position within the AS 4811 screening workflow and its contribution to understanding candidate circumstances and risks.
Second — Distinguish verification from suitability assessment.
Make clear that documentary checks are evidence inputs, not the final outcome of the screening process.
Third — Explain how adverse findings should be evaluated.
Provide a practical framework for considering context, mitigating circumstances, procedural fairness and residual risk.
Fourth — Clarify outsourcing responsibilities.
Require DISP members to identify who conducts candidate engagement, who performs contextual risk analysis and who makes the final suitability decision.
Fifth — Connect screening to ongoing personnel security assurance.
Pre-employment screening is not the end of the process. AS 4811:2022 also addresses ongoing suitability and the broader workforce lifecycle.
These additions would help DISP members understand not only what checks to perform, but how to translate screening results into meaningful personnel security assurance.
Conclusion: Compliance Theatre or Genuine Workforce Assurance?
Defence is right to identify workforce screening as an area requiring improvement.
But there is a fundamental difference between demonstrating that checks were completed and demonstrating that a person was appropriately assessed.
A candidate may have a clean National Police Check, verified qualifications, confirmed employment history and satisfactory identity documents.
All the boxes may be ticked.
But what does the organisation actually know about the candidate’s suitability to be trusted with Defence information, systems or capabilities?
Without appropriate evaluation criteria, contextual information and a defensible assessment process, the answer may be surprisingly little.
That is the risk of compliance theatre: demonstrating that a process occurred without demonstrating that the underlying risk was properly understood.
AS 4811:2022 offers a more comprehensive foundation.
It connects workforce screening with risk management, ongoing assurance and the responsibility to make considered decisions about individuals entrusted with organisational assets.
The DISP Workforce Screening Factsheet should help industry operationalise that framework—not unintentionally narrow it.
For every DISP Chief Security Officer, Security Officer and Defence contractor, I would leave one question:
Are you screening people to satisfy an audit or fact-sheet checklist, or are you assessing whether they are genuinely suitable to be trusted?
The answer matters to individual candidates, Defence industry businesses and Australia’s national security.
References and further reading
Australian Standard AS 4811:2022 — Workforce screening, Standards Australia.
AS ISO 31000:2018 — Risk management guidelines.
Australian Government PSPF Release 2026 — Section 16, Pre-Employment Eligibility and Screening.
Australian Government Personnel Security Adjudicative Standard 2026 — Released 1 July 2026.
Department of Defence — Defence Industry Security Program, Eligibility and Suitability guidance.
Australian Human Rights Commission — Discrimination in Employment on the Basis of Criminal Record.
This article is an independent professional critique of the screening approach presented in the DISO factsheet. It distinguishes the mandatory provisions of relevant instruments from professional recommendations about how to deliver effective workforce screening.
#DISP #AS4811 #PersonnelSecurity #WorkforceScreening #DefenceIndustry
