Duplicate Candidates Incident Playbook: IDs, Merges, Audit Logs

Recommendation: treat duplicates as an integrity incident, not a data cleanup task. When one individual exists as multiple candidate records, you create three failure modes at once: - SLA breakdown: interviews and assessments are scheduled against the wrong record, forcing reschedules and queue resets. - Audit liability: approvals are tied to the wrong profile, and the evidence cannot be reconstructed cleanly. - Fraud surface expansion: identity drift lets a bad actor "route around" controls by re-entering under a new email, name variant, or phone number. External indicators suggest this is not a corner case. Checkr reports 31% of hiring managers say they have interviewed a candidate who later turned out to be using a false identity. Pindrop reports 1 in 6 applicants to remote roles showed signs of fraud in one real-world pipeline. Duplicates and drift are the oxygen these scenarios need: fragmented records, fragmented controls, fragmented accountability.

Recommendation: use deterministic identifiers and governed merge rules because fuzzy matching is not audit-ready. Legacy systems treat identity resolution as a convenience feature. In operator terms, that means: - Matching is probabilistic, but approvals are absolute. A decision without evidence is not audit-ready. - Integrations are vendor-to-vendor point solutions. They do not enforce idempotency, retries, and reconciliation at the workflow layer, so duplicates are guaranteed during outages and race conditions. - Rubric storage is tool-local. Even if you merge records in the ATS, interview notes and scores often remain attached to the wrong vendor record, creating tamper-resistant feedback gaps. Market stacks optimized for throughput create duplicates under load because "create new" is always the easiest API call. Without a deterministic Candidate Key and a merge policy, the system will pick speed over integrity every time.

Recommendation: assign explicit owners and define the system of record per data element. Duplicates persist when ownership is "everyone and no one." Ownership model: - Recruiting Ops owns: candidate creation policy, required fields, merge workflow configuration, and reconciliation dashboards. - Security owns: identity gating policy, access control and retention, audit policy for evidence packs, and step-up verification triggers. - Hiring Manager owns: rubric discipline, score validation, and exception justification when evidence is incomplete. System of truth model: - ATS is the system of record for: canonical Candidate Key, stage changes, offer approvals, and final disposition. - Verification service is the system of record for: identity artifacts and integrity signals (liveness, face match, document auth) and their timestamps. - Interview and assessment platforms are systems of record for: raw interview artifacts and assessment telemetry, but must write back references and outcomes to the ATS using the Candidate Key. Automation vs manual review: - Automated: deterministic matching on Candidate Key inputs, idempotent create-or-update, auto-linking vendor records, and low-risk merges within strict rules. - Manual review: any merge that crosses risk tiers, any split request, any mismatch between identity verification results and ATS identity fields, and any merge affecting an in-flight offer.

Recommendation: instrument identity like secure access management. Identity gate before access, then orchestrate everything off events. Operating model checkpoints (answer-first): Integration patterns that matter in practice: - Idempotency keys: every "create candidate" call should be safe to retry without creating a second person. - Reconciliation jobs: nightly jobs that detect drift between ATS and vendor IDs and open a merge ticket rather than silently duplicating. - Conflict handling: when two systems claim different primaries, the ATS wins, and the event log records the arbitration. - Access expiration by default: interview links and assessment invites should auto-expire if a candidate is merged into another record or fails identity gate.

Recommendation: use IntegrityLens to anchor identity gating and evidence packs to a single ATS record so merges become governed, not improvised. IntegrityLens enables this operating model by: - Running biometric identity verification with liveness checks, face match, and document authentication as an identity gate before interviews and assessments. - Producing immutable evidence packs with timestamped logs and reviewer notes so merges and approvals remain audit-defensible. - Supporting risk-tiered funnels and step-up verification so low-risk candidates move fast while exceptions get routed to a review queue. - Keeping the ATS as the single source of truth by writing back identity status and evidence references, reducing data silos between sourcing and interviews. - Applying zero-retention biometrics architecture to reduce privacy exposure while preserving auditability through logs and evidence references.

Recommendation: do not "optimize for speed" by removing identity joins and merge governance. You will just move the delay to offer stage, where it is costlier. Exactly three things not to do: - Do not merge records based on recruiter judgment in DMs or spreadsheets. It creates an unlogged approval path and breaks audit readiness. - Do not use fuzzy matching as the only join key for scheduling interviews. It increases false joins and gives fraudsters a low-effort bypass. - Do not allow interview and assessment invites to be issued before a Candidate Key exists in the ATS. That is privileged access without identity gating.

Recommendation: start by enforcing a single Candidate Key and making merges review-bound with logs. You can add step-up verification next without replatforming. Implementation checklist for tomorrow morning: - Make Candidate Key a required ATS field for any new candidate record. - Turn off "invite to interview" automation unless Candidate Key is present (identity gate before access). - Stand up a merge exception queue with a 4-hour first-response SLA and a 24-hour resolution SLA. - Require a reason code and evidence reference for every merge. If it is not logged, it is not defensible. - Add a daily reconciliation report: new candidates, suspected duplicates, merges completed, and vendor artifacts not linked to the ATS. - Run a weekly audit sample of 10 merges: verify timestamps, actor identity, and that rubric artifacts are attached to the surviving record. Business outcomes to expect when this is instrumented: - Reduced time-to-hire by removing offer-stage rework and rescheduling caused by drift. - More defensible decisions because approvals tie to a single evidence pack and a single chain of custody. - Lower fraud exposure because identity drift stops being an easy bypass lane. - Standardized scoring across teams because rubric artifacts stay attached to the correct candidate identity across tools.