SMB1001 · Control 38 · Diamond
Police vetting: what SMB1001 asks for, and what it costs
The top tier of the standard asks you to vet the people who can reach your data. For almost every business, that is a cheap and routine online check, not an investigation.
· 4 min read
Control 38 sits at the Diamond tier and asks organisations to conduct police vetting on employees and contractors. It sounds heavier than it is.
What it means in practice
A National Police Check, obtained through a body accredited by the Australian Criminal Intelligence Commission. It is an online process, takes a few days, and is inexpensive. The applicant consents and provides identity documents; you receive the result.
That is it. There is no investigator, no surveillance, nothing exotic. If a supplier makes this sound complicated, they may be selling you something you do not need.
Who actually needs checking
The standard's concern is people with access, which includes contractors and anyone with out-of-hours access to your premises, not just payroll employees. In practice the list usually comes down to: staff who handle client data, anyone with administrative access to systems, cleaners and trades with after-hours keys, and IT providers.
That last one is worth dwelling on. Your IT provider very likely has more access to your business than most of your staff. It is entirely reasonable to ask whether their people are vetted, and a provider who bristles at the question is answering it.
The policy matters more than the check
A check is a snapshot of one day. What makes this a control rather than an exercise is having written down: which roles require a check, at what point in onboarding, how often it is repeated, who reviews the result, and what actually happens if something comes back.
That last question is the one businesses avoid, and it is the one that matters. A disclosable outcome is not automatically a reason not to employ someone, and there are real limits on how such information may be used. Decide your position in advance, in writing, rather than improvising when a result lands.
Handle the results carefully. A police check result is sensitive personal information under the Privacy Act. Store it accordingly, restrict who can see it, and do not keep it longer than you need. It is a small irony that mishandling your vetting records can create a bigger problem than the vetting was intended to solve.
When it is more than a check
Occasionally vetting forms part of something larger: a workplace investigation, a due-diligence enquiry before a partnership, or verifying claims a candidate has made. That is licensed investigative work in Western Australia and needs to be carried out under an Inquiry Agent Licence. It is a genuinely different activity from a standard police check, and it is rare.
What an assessor will ask for
Your vetting policy, evidence that checks were obtained for the roles the policy names, and a sensible answer about how results are stored. As with most of this standard, the written position matters as much as the artefact.
Written by Steven Usher, Director of Owls Nest Solutions. Nothing here is legal advice, and none of it is a pitch. If the cheap option fits, take the cheap option.
Keep reading