Sector risk profiles: what to check in six industries

The frame

The scoping guide argues that packages should be built against what a role can reach: money, data, customers, premises, goods, signature. That works role by role. At sector level a second question matters as much: who is imposing the requirement, and what happens if it is not met?

Where the requirement is internal, it flexes under hiring pressure. Where it comes from a client contract, a regulator or a licence, it does not. That difference explains most of the variation in how seriously verification is taken across Indian industry, and it is worth knowing which situation you are in before designing a programme.

IT and ITeS

Protecting: client data, client contractual commitments, and the right to keep bidding for work.

The distinguishing feature of this sector is that the verification standard is usually not the employer's own. Enterprise clients require verified staff on their accounts, often to a specified standard with a specified look-back, and an audit of that requirement is a commercial event rather than an HR one. The consequence of a gap is not an internal risk conversation, it is a client finding.

What that produces in practice is the most consistently applied programme in Indian industry, and also the most tightly time-bound: an unverified person cannot be staffed, so verification sits directly on the revenue path.

Carries the most weight: previous employment and education, because the claims being sold to clients are experience and qualifications. Moonlighting matters here more than anywhere else, because concurrent work for a competitor is both a client contract issue and a data issue.

Underestimated: the contractor population. The permanent staff are verified to client standard and the vendor engineer on the same project frequently is not. See verifying the people you never put on payroll. Sector page: IT and ITeS.

Banking and NBFCs

Protecting: the loan book.

This sector is the exception on this page, and it is worth being clear about why. Banks and NBFCs do run employee verification, but that is not the work GVS mainly does for them. For lenders, GVS operates as the Risk Containment Unit, and the subject of the check is the borrower, not the staff.

That is a different service with a different method: screening and sampling of applications, verification of the documents submitted with a loan application, field investigation, and contact point verification at the residence and the workplace of an applicant. The exposure is credit fraud and identity fraud on the lending side, and the output feeds a credit decision rather than a hiring one.

Carries the most weight: field investigation and contact point verification, because the documents can be fabricated and the address cannot be visited from a desk.

Worth reading before you scope anything here: RCU services, which sets out what the unit does. Do not assume an employee BGV package translates to this work, because it does not.

Retail

Protecting: stock and cash, across many sites, with thin supervision at each.

Retail's exposure is the most physical on this page and the most dispersed. The person who can cause loss is a store assistant, a cashier or a stockroom supervisor, not a head office manager, and there are a great many of them across a great many locations. Turnover is high, hiring is continuous, and the checks have to run at that pace or they will simply be skipped when a store is short-staffed.

Carries the most weight: address, then identity. This surprises people who expect court record to lead. The reasoning is practical: after a shrinkage incident, the first question is who the person actually is and where they can be found, and a confirmed address answers both. A court record check on a first-time offender returns clear.

Underestimated: that the volume and speed constraint is a design constraint, not a preference. A package designed for a head office hire, applied to store hiring, will be bypassed within a month. Sector page: retail.

Staffing

Protecting: the client relationship, and the right to place people at all.

Staffing firms sit in an unusual position: they carry the verification obligation for people they place but do not manage, to a standard their client sets, and their commercial risk is that a client audit finds a gap. Verification here is a product feature rather than an internal control.

The operational problem is that the population changes constantly. Placements end, replacements are sent, and a check completed on the person who started in March says nothing about the person on site in September. A programme built around onboarding events rather than around the current population will drift out of compliance without anybody noticing.

Carries the most weight: whatever the client contract specifies, which is the honest answer. Where the firm has discretion, identity and address for site-based placements, employment and education for skilled ones.

Underestimated: re-verification on replacement. Sector page: staffing.

Gig and logistics

Protecting: customers, and the platform's reputation with them.

The defining constraints are volume and speed. Onboarding is continuous, in the thousands, and a worker who cannot start today will go and work for a competitor tomorrow. Any verification process that takes weeks is not a slow process, it is a process that does not exist, because the business will route around it.

The exposure is also different in kind. A delivery rider is not being trusted with credentials or systems; they are being trusted at a customer's door, with a vehicle and with goods. Education and employment history are largely irrelevant. Identity and address are the whole game.

Carries the most weight: identity, then address, delivered in a form that works on a basic phone over a poor connection. Digital address verification exists for exactly this population, and police verification earns its place for anyone entering a home.

Underestimated: re-verification. A gig workforce churns, returns and re-registers, and a platform that checks once at first onboarding is checking a population that no longer resembles the one it has. Sector page: gig and logistics.

Healthcare

Protecting: patients, and the institution's licence.

Healthcare is the sector where a verification failure has the most direct consequence for a person who is not party to the employment relationship. A practitioner whose qualification is not what it was claimed to be is a patient safety matter before it is an HR matter.

It is also the sector where the recognition question in education verification matters most. A qualification can be genuinely awarded and still not be the recognised qualification the role requires, and for a clinical role that distinction is the whole check.

Carries the most weight: education and professional registration, then court record and police verification for anyone with patient contact, particularly with vulnerable patients.

Underestimated: the non-clinical population. Housekeeping, security, catering and administrative staff move through wards, handle records and enter patient areas, and they are frequently agency staff nobody has checked. Sector page: healthcare.

The six side by side

Sector	Protecting	Check that carries most weight	Binding constraint
IT and ITeS	Client data and contracts	Employment and education	Client-specified standard and audit
Banking and NBFC	The loan book	Field investigation and CPV, on borrowers	Credit fraud, not hiring
Retail	Stock and cash across sites	Address, then identity	Volume and store-level speed
Staffing	The client relationship	Whatever the contract specifies	Constant population change
Gig and logistics	Customers at their door	Identity, then digital address	Same-day onboarding at scale
Healthcare	Patients and the licence	Education and registration	Recognition, not just authenticity

A note on company stage

Sector is not the only axis. A twenty-person company and a twenty-thousand-person company in the same sector have different problems, and the smaller one is frequently told it does not need verification yet.

That advice is wrong in a specific way. A small company has fewer roles with real exposure, but the exposure in those roles is more concentrated: often one person holds the production database, one can move money, and there is no second pair of eyes on either. The logic of scoping against what a role can reach does not change with headcount; only the length of the list does. See startups, small businesses and enterprise.