"Employees are mostly trustworthy, but sometimes they can get into a situation where they need money and they have access and nobody is watching," he said.

Companies should apply more scrutiny to their employees, Jeffery said, but noted that not all companies perform background checks, and many  do background checks only at the point of hire. "Employees' circumstances change," he said, suggesting that recurring checks may pick up changes in employees' circumstances that could pressure them to commit fraud.

The Treasury Fraud & Controls survey from Strategic Treasurer suggests that companies are most likely to perform background checks on full-time employees.

Of the more than 300 treasury executives worldwide who responded to the survey, the majority (70%) said they have the ability to do background checks on full-time employees on a recurring basis, while 18% said they perform such checks only when hiring someone full-time and 12% said they never do background checks on full-time employees.

There's less scrutiny of temporary workers and contractors. The survey shows that 58% of respondents don't check temp workers at all, while just 31% do background checks on temps initially and 11% can check them on a recurring basis.

Similarly, 59% said they don't run background checks on contractors, while 29% perform a background check initially and 29% could perform checks on a recurring basis.

Jeffery said that given the risk of fraud losses, "we think the full background check makes sense," adding that the "drug panel screening and credit check tend to be pretty good indicators."

Scott Moritz, a managing director at business consulting and internal audit firm Protiviti who leads its investigation and fraud risk management practice, argued that the depth of the background check a company conducts on an employee should relate to the extent of the employee's responsibilities.

"A small subset of your employees can do a great deal of damage based on what their roles and responsibilities are, and the level of depth to which you perform a background check should correspond to that," Moritz said, citing CEOs as well as employees who control checkbooks or send wires. "You should look at these people more rigorously than someone who doesn't present the same risk profile to your organization."

Limits of Background Checks

Employers should be aware of the limits of background checks, though, said Moritz, pictured at left.

For starters, "the term 'employee background check' is in many instances a bit of a misnomer," he said. "It's more, does this person have a criminal record in their last-known county of residence, and is some of what they say on their resume confirmed by their most recent employer—that's the baseline background check.

"A mistake a lot of companies make is they allow the provider to determine the scope of practices," Moritz added.

He pointed out that while a criminal check might look at the records in the county in which a job applicant currently lives, there are more than 3,000 counties in the U.S. "Criminal records can be municipal, county, state, or federal, and there isn't a central repository," he said. "There's a lot that could be missed."

Moreover, white-collar crimes wouldn't result in a criminal record but might show up "in civil litigation—a civil suit or lien or judgment," Moritz said.

If the company is concerned about white-collar crime, "you might want to look at the civil docket, you may want to look at liens and judgments and other types of filings to suggest that maybe [job applicants] haven't conducted themselves responsibly," he said. Moritz also suggested confirming the last 10 years on an applicant's resume, because job candidates may have eliminated a position where they had problems and then extended the time frame of the jobs on either side of that position to conceal the gap.

Legal Considerations

Companies that use background checks also need to keep in mind the laws relevant to background checks at the federal, state, and local level.

"For nationwide or multistate businesses, there are a number of legal considerations that must be taken into account in preparing or drafting your background check policies and procedures," said Rod Fliegel, co-chair of the privacy and background checks practice group at the law firm of Littler Mendelson. "There are quite a number of traps for the unwary or folks that are kind of unfamiliar with the area."

Fliegel said the biggest risk on the federal level is the Fair Credit Reporting Act. The Act covers companies' use of credit reports on employees and potential employees, and says among other things that companies must disclose what they're doing and get individuals' consent before ordering a credit report on them.

"This is the number-one source of class-action litigation regarding background checks right now," he said. "Employers have shelled out tens of millions [of dollars] in recent years for not following those requirements."

Fliegel also noted the Equal Employment Opportunity Commission's focus in recent years on employers' use of information about arrests and convictions. "We have seen over the last few years what are called systemic discrimination investigations by the EEOC, and some lawsuits," he said.

Companies that operate in multiple states could find that, in some locations, they're dealing with a variety of state and local laws related to criminal or credit checks, such as ban-the-box laws that limit questions on job applications about an applicant's criminal history. Fliegel said that companies that operate in locations that do have such restrictions can find they are dealing with three levels of compliance, with federal, state, and local laws.

He also noted that laws in this area are evolving, especially the Fair Credit Reporting Act. "The point about keeping current and consulting with professionals, whether it's lawyers or HR professionals, on the current state of the law as it unfolds is absolutely critical," Fliegel said.