Who remains accountable if a framework agency has already checked the nurse?

The current employing organisation remains accountable, because third-party assurance does not remove the trust’s duty to verify employment eligibility and identity. Agencies can support the process, but they cannot own the final decision for the receiving employer. That distinction is the core governance issue in temporary staffing.

Why the receiving employer still owns the final check

The core governance point is that assurance can be delegated, but accountability cannot. If a framework agency has screened a nurse, that may reduce duplicate work, yet the receiving employer still has to satisfy itself that the person is eligible, suitably identified, and fit for the role it is placing them into.

That matters because the employer is the party taking on the risk of letting the individual work under its authority. Third-party confirmation can inform the decision, but it does not replace the employer’s own duty of care, especially where local onboarding, role scope, and supervision expectations differ.

What third-party checking does, and does not, prove

Agency vetting is best understood as an input to the hiring or placement process, not the decision itself. It can help verify identity, qualifications, and documentary consistency, but it rarely proves that the candidate is acceptable for every receiving organisation, ward, shift pattern, or regulatory setting.

The practical boundary is simple: the agency can attest to what it checked and when it checked it, but the employer must decide whether that evidence is sufficient for its own environment. If the receiving organisation cannot explain who made the final decision and on what basis, accountability has already become blurred.

Good practice is to keep the evidence chain intact. The employer should be able to show what it relied on from the agency, what it re-checked itself, and who authorised the placement. That is especially important when the same worker may move across sites, contractors, or short-term assignments with different control expectations.

Why this becomes a governance failure when responsibilities are unclear

Temporary staffing breaks clean lines of ownership if organisations assume that “someone else already checked.” The real failure mode is not just incomplete paperwork, it is a misplaced trust decision: an organisation allows access or assignment based on an external check without formally accepting responsibility for the outcome.

That can leave gaps in identity verification, employment eligibility review, record retention, and escalation when something does not match. It can also create audit weakness, because no one can demonstrate a clear handoff between the agency’s screening and the employer’s acceptance decision.

In practice, the safest model is dual accountability with separate duties: the agency checks within its mandate, and the employer confirms what it must before the person starts work. This aligns naturally with NIST Cybersecurity Framework 2.0, which treats governance and risk ownership as distinct from delegated operational tasks.

Risk and Threat Considerations

When a receiving organisation treats agency screening as sufficient by itself, the main risk is unauthorised or poorly governed access, assignment, or engagement. The same pattern can also hide recordkeeping failures, because a bad or incomplete onboarding decision may be hard to detect once the worker is already active.

Failure mechanism: A third party performs part of the verification, but the receiving employer does not independently confirm the result, so the final trust decision is made without clear ownership or adequate local validation.

Impact: The organisation can end up relying on an unverified or unsuitable worker, with consequences for safety, compliance, auditability, and incident response if the placement later proves improper.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST CSF 2.0	GV.OC-03 — Roles, Responsibilities, and Authorities	Accountability for delegated screening and final acceptance is a governance ownership issue.
	GV.RM-02 — Risk Appetite and Risk Tolerance	The employer must decide what evidence is sufficient before accepting placement risk.
Recommendation — Define who retains final acceptance authority when third-party checks are used. Set the acceptance threshold for agency-verified workers against local risk tolerance.
NIST SP 800-53 Rev 5	IA-2 — Identification and Authentication (Organizational Users)	The question turns on verifying the person before allowing them to act under the employer's authority.
	IA-5 — Authenticator Management	If identity evidence is shared between parties, the receiving employer still needs controlled handling of that evidence.
Recommendation — Require the receiving employer to authenticate and validate the worker before access or duty assignment. Control how identity evidence is issued, handled, and relied on before onboarding.
ISO/IEC 27001:2022	A.5.18 — Access rights	Final approval of who may work or access systems remains with the receiving organisation.
Recommendation — Make the receiving organisation own final access approval and review, even when an agency pre-screens.

Practitioner Guidance

What to verify: Confirm that the receiving employer has a documented acceptance step, not just an agency screening record. The file should show who approved the placement, what was checked externally, and which checks the employer still owns locally.

Decision rule: If the worker will operate under the employer’s authority, treat agency assurance as supporting evidence only. If local policy, role sensitivity, or regulatory obligations differ from the agency’s process, require an employer-specific review before start.

What good looks like: The agency and the employer have separate but connected responsibilities, with no ambiguity about who is accountable if something was missed. The receiving organisation can explain its own decision, not just cite the agency’s check.

Practitioner takeaway: Delegation can reduce effort, but it never transfers final accountability, so the receiving employer must always be able to defend its own trust decision.