Background checks should be conducted before an employee starts with a customer. Checks should then be carried out based on role and risk at least annually or when a significant change occurs.