A practice manager at a firm on Chancery Lane, WC2A, once asked me for enhanced DBS certificates on all eleven of her night cleaners before we could start. She had specified it in the tender, her insurer had nodded at it, and the incumbent contractor had been supplying what looked like exactly that for four years. The certificates existed. Some of them were basic disclosures with the wrong box ticked on the covering letter, and none of the roles was eligible for an enhanced check in the first place. What she had bought was a filing cabinet full of reassurance. Meanwhile the alarm code for the second floor had not changed since 2019, three sets of keys were unaccounted for, and the sign-in book at reception recorded arrivals in the same handwriting for eight consecutive weeks.

Which DBS check can a commercial cleaner lawfully have?

A basic disclosure. In almost every commercial office in London, that is the entire answer, and it surprises people who have written “enhanced DBS” into a specification without checking whether the role qualifies.

Standard and enhanced checks are available only where the position meets statutory eligibility rules set out in the Rehabilitation of Offenders Act 1974 (Exceptions) Order and the Police Act 1997 regulations. Cleaning a solicitors’ office does not meet them. Cleaning a school during the school day, where the work is regular and unsupervised around children, generally does, and so does work in a care home. The building type drives eligibility rather than the client’s anxiety level.

Requesting a check the role does not qualify for is not a technicality anyone should shrug at. The employer signs a declaration of eligibility.

What a basic disclosure leaves out

Unspent convictions and conditional cautions, and nothing else. Spent convictions do not appear. Cautions that have run their course do not appear. Arrests without charge, ongoing investigations, dismissals for gross misconduct, county court judgments, employment history that never happened – none of it appears.

The certificate is a photograph, not a film. It describes a single afternoon at the DBS office and says nothing about the following Tuesday.

Why is BS 7858 screening the standard that matters more?

BS 7858:2019, the code of practice for screening individuals working in a secure environment, was written for the security industry and has been quietly picked up by every serious contractor working in London’s legal, financial and government-adjacent buildings. It does the thing a criminal record check cannot, which is to establish that a person’s account of their own life holds together.

Five years of employment history, verified with the employers rather than with the candidate. Identity established against documents that get examined properly. Character references from people who are not relatives. Financial probity checks where the role warrants them. Gaps in the history explained and evidenced.

The gap requirement is the part that catches people, and it is the part I would keep if I could keep only one element of the whole standard.

Here is my unpopular position, and it costs me tender points regularly: DBS certificates are close to worthless as a security control in a standard office, and clients who fixate on them are usually neglecting the controls that would matter. A basic disclosure on a cleaner with no criminal history tells you that the cleaner has no criminal history. It does not tell you who else has the fob, whether the operative on Thursday nights is the person named on the roster, or whether the subcontractor’s supervisor has ever met the person he sent. Spend the money on a named, permanent, properly paid night team and a working access log, and you will lose fewer laptops than any certificate will save you.

The gap that has to be explained

Any break in employment, education or training beyond about a month has to be accounted for with evidence rather than a verbal explanation. Sabbaticals, caring responsibilities, illness, time abroad – all legitimate, all documentable.

Screening is also not a one-off. Rescreening intervals belong in the contract, and most London specifications forget to name one. Three years is a common figure for general commercial work. Annual rescreening for anyone holding master keys is a defensible position and costs less than the first laptop.

Where does vetting break down in the subcontracting chain?

At the second tier, almost always. A main contractor holds the client relationship, screens its own directly employed staff impeccably, and then subcontracts the Saturday deep clean of a Fenchurch Street, EC3M, trading floor to a firm it has used for years. That firm covers a sickness absence with two people from an agency in Ilford. Nobody in the client’s building has checked anything about those two people, and the contractual chain ensures nobody thinks it is their job.

Cover shifts are where this shows up. The screened workforce is real and the roster is real, and then somebody’s child is ill on a Wednesday in February. The supervisor has ninety minutes to find a body who can hold a mop, and the incentive structure in that ninety minutes points in exactly one direction. Whatever screening file eventually gets created for that person is a photograph, not a film, and it gets taken three weeks after the shift.

I would rather leave a floor uncleaned than put an unscreened person on a sensitive site, and I have had that argument with clients who then complained about the bins. The complaint is fair. The alternative is worse.

What to ask before you sign

Ask whether subcontracting is permitted at all, and if the answer is anything other than a flat no, ask for the named subcontractors and their screening evidence. Ask what happens on a cover shift at nine on a Friday night. Ask to see the screening file for one operative chosen by you, redacted appropriately, within twenty-four hours of asking.

That last request separates contractors faster than any question about policy. Either the file exists and can be produced, or it takes a week while someone assembles it.

What does a sensitive site need beyond a certificate?

Depends what “sensitive” means, and London contains at least four distinct versions of it.

Government and government-adjacent premises usually require the Baseline Personnel Security Standard as a minimum, and some require Security Check clearance, which carries a UK residency requirement that rules out a substantial portion of the London cleaning labour market. Law firms care about privileged material and clear desks. Financial services care about market-sensitive information sitting on screens at eight in the evening. Healthcare premises care about patient data and about barred list status.

Physical controls do more work than screening in every one of those settings. Individually issued fobs rather than a shared one. Key cabinets with an audit trail. Cleaning that follows the occupier’s hours in the most restricted areas rather than running through them at midnight unaccompanied. Server rooms and comms cupboards excluded from the specification entirely, cleaned by the client’s own people or not at all.

A photograph, not a film – which is why access logs, spot checks and a supervisor who knows every face on the team carry the weight that paperwork cannot.

Escorted or unescorted, and who decides

The occupier decides, and the decision should appear on a plan rather than in someone’s memory. Mark the areas where cleaning happens unaccompanied, the areas where it happens escorted, and the areas where it does not happen. A partner’s office at a firm off Black Prince Road, SE11, sat in the third category for two years and everyone was content with it.

Escorted cleaning costs more because it costs the client a person. That is the honest position, and it is why so few sites that ought to use it do. The compromise most firms land on is daytime cleaning for restricted floors and a night shift for everything else, which works well enough where the occupier can tolerate a vacuum at four in the afternoon. Trading floors cannot. Barristers’ chambers, in my experience, mind less than anyone expects.

How long can anyone hold on to the paperwork?

Not long, and this is where well-intentioned facilities teams create a data protection problem while trying to solve a security one.

The DBS code of practice expects certificate information to be destroyed once a recruitment decision is made, with a short retention window measured in months rather than years. Clients who insist on receiving and filing copies of every operative’s certificate are asking a contractor to breach that expectation on their behalf. A written confirmation that a check was completed, its level, its date and its reference number is the appropriate record. The certificate itself belongs to the individual.

Right to work is the check nobody mentions in the tender and the one carrying the largest financial penalty. Civil penalties for employing someone without permission to work run to tens of thousands of pounds per worker, and the statutory excuse only exists where the check was carried out correctly before employment began – online share code, or an identity service provider for British and Irish passport holders.

The check that survives a TUPE transfer

Inherited staff arrive with whatever screening the outgoing contractor did or did not perform. Employment transfers under TUPE, and screening deficiencies transfer with it. Audit the transferring workforce in the first month, in writing, and agree with the client in advance what happens if somebody’s history cannot be verified, because dismissing a transferred employee for failing a retrospective check is a legal problem of its own.

The alarm code on Chancery Lane changed in March. The keys turned up in a drawer in the post room, all three sets, on a fob labelled with the floor number.