Candidate source records and attribution controls

A candidate source record is the chain of custody for a sourcing lead. It should let an authorized reviewer reconstruct how the organization encountered the person, what information was captured, and why that information entered a hiring workflow. Attribution is not clerical decoration. Without it, stale or copied claims can become indistinguishable from candidate-provided facts.

The minimum record is not a candidate dossier

A useful record can be compact:

Record element	Purpose	Do not substitute
Origin page	Returns the reviewer to the actual source	A search engine results page
Observed on	Shows when the page was checked	An assumed publication date
Captured statement	Preserves the relevant fact as seen	A broad personality summary
Search rationale	Connects capture to an approved role criterion	Generic interest in the person
Provenance type	Distinguishes self-report, employer page, registry, or directory	One undifferentiated trust score
Lifecycle state	Shows notice, access, correction, retention, or deletion status as applicable	A recruiter's private reminder

This design follows two different bodies of evidence. OPM's job analysis and assessment materials put work requirements before selection choices. FTC and NIST privacy materials emphasize purpose, risk, safeguards, and data lifecycle. Together they support a narrow record: enough to explain a job-related sourcing action, but not an open-ended archive of everything found online.

Attribution answers one question only

Suppose a researcher finds a conference biography stating that a person led a named implementation. The origin URL, organizer, page date if available, and observation date establish where that statement appeared. They do not prove authorship, the scope of the work, current skill, availability, or interest. If the same assertion appears on copied aggregator pages, repetition does not necessarily create independent corroboration.

The record should classify the statement accurately: "conference biography states" is safer than "candidate led" until confirmed. If a candidate later provides a resume or answer, keep candidate-provided evidence distinct from the original discovery record. That separation prevents a source note from silently becoming treated as verified application data.

A reconstruction test

Select records across roles, researchers, and source types. Give each record to a reviewer who did not create it. The review is successful only if that person can:

open or identify the original source;
understand what was visible at the recorded time;
find the approved criterion that justified capture;
distinguish quotation, paraphrase, and researcher inference;
identify the applicable lifecycle state and owner.

A broken link is not automatically a control failure. Pages move and disappear. The relevant questions are whether the original capture complied with policy, whether any permitted snapshot is authentic and necessary, and whether the remaining claim should still be used. Do not create a permanent screenshot archive by default. That may retain more personal information than the business purpose warrants.

Handling corrections and disputes

When a person disputes a source record, preserve the request and route it to the authorized owner. Do not overwrite history in a way that conceals what informed a past action. Depending on applicable policy and law, the organization may correct, annotate, restrict, or delete the record. Front-line sourcers should have a clear route rather than improvising a legal conclusion.

The FTC's information protection guidance links sensible collection with secure disposal. NIST's Privacy Framework provides a risk-management structure rather than a recruiting-specific retention period. Consequently, this brief does not prescribe a universal duration. The organization should document a schedule based on purpose, legal duties, and risk.

How occupational references fit

BLS and O*NET describe HR specialist work, including recruitment-related activities, but do not tell employers which candidate source to use or how long to retain a lead. CIPD's talent and recruitment factsheets discuss recruitment in workforce context, yet they are professional guidance rather than local law. These sources help define operating context. They should not be cited as permission to collect unrelated data.

EEOC selection guidance and the Uniform Guidelines add another boundary. A source can be properly attributed while the criterion derived from it remains unrelated to the job or produces unlawful discrimination. Source governance and selection validity are related controls, not interchangeable ones.

Ownership map

The sourcing operator records provenance and flags uncertainty. The recruiter owns movement within the approved workflow. The hiring manager owns role requirements. Security or privacy owners establish access and disposal controls. Legal or employee-relations specialists interpret applicable obligations. A system administrator can implement a deletion status, but should not decide independently whether a legal hold or hiring record requirement applies.

For remote teams, use role-based access. A coordinator who schedules an interview need not see the research trail. An interviewer generally needs the structured brief, not the collection history. Limit exports because copied spreadsheets often lose correction state, retention rules, and access controls.

Limitations

An attribution record cannot demonstrate truth, consent, job suitability, or unbiased treatment. Public pages can be wrong, edited, impersonated, or generated from other sources. Platform terms and laws vary by location and can change. The listed materials are predominantly US oriented, with professional and technical guidance that may not be binding. This is not legal advice and it offers no claim about recruiting yield or candidate response.

Methodology and source register

On 2026-10-13, the editorial team reviewed the materials below. We retained each source's stated date or version where available. We read occupational references for context, job-analysis and selection sources for relevance, and privacy publications for minimization and lifecycle principles. We did not infer performance percentages from guidance documents.

BLS, Human Resources Specialists (2025 edition)
O*NET, Human Resources Specialists (updated 2025)
OPM, Job Analysis (accessed 2026-10-13)
OPM, Assessment and Selection (accessed 2026-10-13)
CIPD, Talent Factsheet (2024)
CIPD, Recruitment Overview (2024)
EEOC, Employment Tests and Selection Procedures (2007)
Uniform Guidelines on Employee Selection Procedures (current eCFR, accessed 2026-10-13)
NIST Privacy Framework (version 1.0, 2020)
FTC, Protecting Personal Information (2016)

Frequently asked questions

Why save the original URL instead of only a source name?

A specific URL allows later review of the actual page and its context. The record should also name the publisher because links can change.

What if the source page disappears?

Mark it unavailable and reassess whether the claim can still be used. Preserve a copy only when policy permits and the copy remains necessary. Never represent an unavailable page as freshly verified.

Does accurate attribution authorize outreach?

No. Attribution answers where data came from. Outreach requires a separate assessment of business purpose, channel rules, notices, preferences, and applicable law.

To design a traceable sourcing process without transferring hiring authority, schedule a free recruiting call.