Police checks are step seven of ten

Two failures look nothing alike from the inside.

In the first, an organization runs a criminal record check on every person who walks through the door, including the retired accountant who counts the raffle money once a quarter, and it takes six weeks, and she gives up and volunteers somewhere else. Nobody records this as a safeguarding event. It never appears in any report.

In the second, an organization runs the same check on a youth mentor, it comes back clear, and because it came back clear nobody sets up supervision, nobody reviews the role, and nobody asks the young people how it is going. Eighteen months later something has happened that the check was never capable of preventing.

Both are screening failures. Only one of them gets called that.

The ten steps, in full

Volunteer Canada’s framework is the clearest statement of what screening actually consists of:

1. Assessment of risk
2. Position description
3. Recruitment
4. Application forms
5. Interview
6. References
7. Police checks
8. Orientation and training
9. Support and supervision
10. Follow-up and feedback

Volunteer Canada’s own framing is that screening practices are ongoing and go beyond the selection process. Read that list again with that in mind. Steps one and two happen before you have met anybody. Steps eight, nine and ten happen after the person is already in the role, which means most of screening, by count and by calendar time, takes place at moments when most organizations consider the screening finished.

The police check is step seven. It is one control among ten, it is retrospective by nature, and it tells you only about behavior that was reported, investigated and recorded. It cannot tell you about someone with no record, which describes almost everyone who has ever harmed a child in an organizational setting before the first time they did it.

Where things actually go wrong

If you read published safeguarding reviews across sectors, the same three steps keep showing up as the ones that were missing, and none of them is the check.

Step one, risk assessment. Nobody sat down and asked what could go wrong in this specific role. So the role was allowed to include unsupervised one-to-one contact, or transport, or private messaging, not because anyone decided that was acceptable but because nobody ever framed it as a decision.

Step nine, support and supervision. The person was recruited carefully and then left alone for two years. Supervision is not surveillance; it is somebody knowing what this volunteer’s week actually looks like, noticing when a role quietly expands, and being close enough that a concern has somewhere to go.

Step ten, follow-up and feedback. Nobody asked the people being served. This is the step that gets skipped most reliably and it is the one with the most information in it. Children, service users and other volunteers usually know first. What they need is a route that does not require them to accuse anyone: “is there anything about Thursdays that you’d change?” gets answers that “do you have a safeguarding concern?” never will.

A clean check at step seven can create false confidence about all three. I have watched organizations treat the certificate as the moment the responsibility transferred somewhere else.

Proportionality, and why over-screening is a real failure

NCVO’s safer recruitment guidance rests on three principles that are worth memorizing: proportionality, meaning your processes must relate to the level of risk involved; role-specificity, meaning you screen for the role rather than for the organization; and annual review, meaning the decision is not permanent.

Proportionality cuts both ways, and the sector is much more comfortable talking about one direction than the other.

Over-screening a low-risk role is not a harmless excess of caution. It costs you volunteers, and it does not cost you them at random. The requirements that feel trivial to a settled homeowner with a passport and a driving license are the ones that exclude people with no fixed address, no photo identification, a patchy work history, or an old and irrelevant conviction. Ask for three written references and a criminal record check to help at a community meal, and you will end up with a volunteer group that looks less like the community than it did before.

That is an inclusion problem with measurable consequences. Piatak and Carman’s 2023 study of 323 volunteers found that inclusion and diversity climate significantly predicted both whether volunteers intended to volunteer again and whether they would recommend the organization to others. The same study found the strongest predictor of both was appropriate training, which is step eight of the ten. Their finding that logistics such as project choice and ease of registration were not significant predictors is a useful corrective to a lot of received best practice.

There is also a straightforward reputational cost. NCVO’s Time Well Spent 2023, based on fieldwork with 7,006 UK adults, found 26 percent of volunteers said volunteering felt too much like paid work, up from 19 percent in the previous wave. A four-week application process for a two-hour shift is one of the ways an organization teaches people that.

Where proportionality stops

Under-screening a genuinely high-risk role is a different category of thing, and I do not think it should ever be excused by capacity, budget or urgency.

If the role involves unsupervised contact with children, if it involves transport, if it involves entering someone’s home, or if it involves access to money or to personal data about vulnerable people, then the full sequence applies and the schedule bends around it rather than the other way round. “We needed someone for Saturday” is not a reason. If you cannot screen properly, you run the session with fewer people, or you change the shape of the role so the risk is not there, or you do not run it.

For anyone working with minors, the Keeping Children Safe International Child Safeguarding Standards, updated in 2024, set out four standards: Policy, People, Procedures and Accountability. The one that gets neglected is the fourth, which is why the framework includes formal external evaluation every three years. Internal review of your own safeguarding is necessary and it is not sufficient, for the ordinary reason that the people closest to a system are worst placed to see what it normalizes.

Building it so it takes an hour, not a quarter

The practical objection is time. A ten-step process sounds like a quarter of work per volunteer for a coordinator who has a day and a half a week, which is roughly what most coordinators actually have.

It is not, because you do the expensive part once per role rather than once per person.

Take your list of roles, and for each one write two lines: what could go wrong here, and who would be harmed. That is step one, and it takes about ten minutes a role. Then sort the roles into two or three tiers. A public-facing role with other adults present and no access to money or data sits in the lightest tier: an application form, a conversation, and a clear role description. A role with unsupervised access to children or to vulnerable adults sits in the heaviest: references you actually call, an interview with questions about boundaries, the check, structured induction, and a named supervisor.

Then write the tier into the role description, which is where step two lives anyway. Doing this properly is most of what a role description is for: the boundaries field is a risk assessment written in the second person.

Review the tiers once a year. Roles drift. The volunteer who joined to hand out programs at the door is now, three years later, driving the minibus, and nobody re-screened that because nobody noticed the role had changed. Role-specificity means very little without annual review to catch exactly that.

What I would not claim

I do not have evidence on how much any of this changes outcomes, because it barely exists. Safeguarding failures are rare, catastrophic and studied after the fact, which makes them almost impossible to study in the way you would want. Nobody has run a controlled trial on screening depth, and nobody is going to.

So this is a judgment about where to spend limited attention, built on published frameworks and on what reviews of failures repeatedly find. My judgment is that most organizations have their effort in the wrong place: heavy at step seven, where the process is visible and defensible and produces a document, and thin at steps one, nine and ten, where the process is invisible and takes ongoing work and produces nothing you can put in a file.

The check proves you looked. The supervision is what makes looking worth anything.