One-Click Compliance: The End of Multi-Site DBS Checks

Managing DBS checks manually across multiple sites means logging into separate employer accounts, chasing individual certificate numbers, maintaining separate records per location, and manually reconciling compliance status across a workforce that may span dozens of staff. For multi-site providers in care and hospitality, this process is one of the most time-consuming and risk-exposed tasks in the entire onboarding workflow.

If you operate more than one site, you already know the problem. The Disclosure and Barring Service system was not designed with the multi-site employer in mind. Each check requires individual management. Each location creates its own compliance records. Each new starter triggers the same sequence of manual steps, regardless of whether you are onboarding your fifth person this month or your fiftieth.

The result is an onboarding bottleneck that delays hiring, creates inconsistency across sites, and introduces the kind of compliance gaps that regulators look for at inspection.

We’re going to show you why the traditional DBS process fails at scale, what the DBS Update Service actually provides (and where its limits are), and how a single integrated compliance platform eliminates the problem entirely.

What Is the Traditional DBS Check Process for Employers?

The step-by-step reality of a manual DBS workflow

A Disclosure and Barring Service check is a legal requirement for anyone working in a regulated role with children or vulnerable adults in the UK. For care and hospitality providers regulated by CQC or Ofsted, enhanced DBS checks with barred list checks are mandatory before a new starter can begin supervised or unsupervised work.

The traditional employer-managed process looks like this:

1. Collect the candidate’s identity documents (three forms required, originals only)
2. Complete an application form or submit via an umbrella body / registered body
3. Wait for the DBS to process the application and issue a certificate
4. Receive the certificate (posted to the candidate, not the employer)
5. Request sight of the original certificate from the candidate
6. Record the certificate number, issue date, and disclosure level
7. File the record and update your compliance tracker
8. Repeat the entire process when the certificate expires or when CQC queries it

For a single hire at a single site, this is manageable. For a multi-site provider running rolling recruitment across care homes, nursing homes, or hospitality venues, it is an administrative operation in its own right.

How long does an enhanced DBS check take?

Processing times for enhanced DBS checks vary significantly based on police force involvement and application volume. Standard processing through the DBS system typically takes between 8 and 14 days for straightforward applications. Checks that require police force disclosure can extend to several weeks.

For regulated care providers, the enhanced check with barred list is not optional. A new starter cannot begin unsupervised work until it is received. Every additional day of processing time is a day of delayed productivity, and in a staffing-pressured sector, that carries a real operational cost.

What Is the DBS Update Service, and Does It Solve the Multi-Site Problem?

What the DBS Update Service actually provides

The DBS Update Service is an online subscription that allows individuals to keep their DBS certificate registered and current. Employers can then run an instant online status check against an existing certificate, rather than applying for a new one, provided the role requires the same level and type of check.

Key facts:

• Annual subscription fee: £16 per year (paid by the individual; free for eligible volunteers)
• Available for: Standard and Enhanced DBS checks only; not Basic checks
• Check result options: Certificate current with no new information / certificate current with original disclosure / new information found (new check required) / certificate cannot be checked
• Employer requirement: Must obtain consent from the individual before running a status check
• Identity verification: Employers must still see the original DBS certificate and verify identity documents before relying on an Update Service check

 
The Update Service and e-bulk are not integrated systems. There is a separate facility which organisations can use to carry out multiple status checks at once. This multiple status check facility requires organisations to either build their own front-end system or use a compliant platform that has already integrated with the DBS API.

Where the Update Service falls short for multi-site providers

The Update Service is a significant improvement on requesting new checks from scratch. But it does not solve the core multi-site management problem:

• Each site still requires individual login access and employer account management
• Certificate records must still be maintained per location with accurate issue dates and expiry tracking
• Consent records must be stored per individual in line with GDPR data minimisation requirements
• The service does not cover Basic checks, meaning some roles still require separate applications
• Employers should conduct a risk assessment before deciding if accepting an Update Service check is suitable. Accepting a certificate registered on the Update Service is not as straightforward as asking for a disclosure number or seeing a copy of the certificate.
• The effectiveness of the Update Service in enabling portability is reliant on individuals maintaining their own subscription. Employers should make clear the individual’s responsibility to ensure their account details are kept up to date at all times.

 
In short: the Update Service reduces the cost and time of individual checks for subscribed staff, but it does not give a multi-site operator a single view of compliance status across their workforce.

The moment you have more than one site, the DBS process multiplies. You are not just tracking checks anymore. You are tracking checks at multiple locations, across different rotas, with different renewal timelines, managed by different site managers who each have their own way of recording things. That is where compliance gaps appear.

The Multi-Site Compliance Gap: Where Things Go Wrong

Why logging into multiple systems creates risk

A multi-site care provider with three homes and a home care service does not have one compliance problem. It has four, operating in parallel, with no central visibility of who is compliant and who is not.

The practical consequences of managing DBS checks manually across multiple sites include:

• Inconsistent recording standards across sites as individual managers develop their own filing systems
• No central expiry visibility, meaning a certificate due for renewal at Site B is only noticed when that site’s manager checks their spreadsheet
• Duplicate applications when a worker transfers between sites and no one knows their existing check is still current
• Audit exposure during CQC inspection when compliance records for different sites are held in different formats and cannot be produced quickly
• GDPR risk as certificate information is stored in unsecured spreadsheets, shared drives, or email threads rather than in an access-controlled system

 
CQC Regulation 19 and Schedule 3 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 require providers to maintain documented evidence that all pre-employment checks were completed. In a multi-site operation, demonstrating that consistently across every location during a single inspection is a significant administrative challenge if records are not centralised.

What does a compliance audit trail actually need to contain?

A robust, inspection-ready DBS compliance audit trail for a regulated provider should include:

• Certificate number, issue date, and disclosure level for every active staff member
• Date the employer viewed the original certificate (not just received confirmation of a check)
• Consent record for any Update Service status checks run
• Identity verification records linked to each certificate
• Renewal tracking for certificates approaching expiry or requiring re-check
• Record of any Update Service check results and the action taken

 
Maintaining this manually across multiple sites, in spreadsheets or shared folders, is not a sustainable compliance model. It is an inspection liability waiting to surface.
________________________________________

How a Single Compliance Platform Changes Everything

One login. Every site. Every staff member.

Orta’s compliance platform centralises the entire DBS and pre-employment compliance workflow into a single dashboard, accessible across every site from one login. There is no switching between employer accounts, no cross-referencing spreadsheets from different locations, and no relying on site managers to each maintain their own records.

The platform provides:

• DBS tracking from application to clearance, with status visible at every stage
• Automatic expiry alerts at 90, 60, and 30 days, delivered to managers and staff so renewals are never missed
• Document storage for original certificates, keeping everything in one access-controlled location
• Inspection-ready exports that produce a complete compliance report for any site in seconds
• Audit trail tracking every change, every check, and every document update with a timestamp

 
For multi-site providers, this means a single compliance view that covers every home, every location, and every staff member without any manual reconciliation between sites.

The security case for consolidation

Storing DBS certificate information across multiple spreadsheets, email chains, and shared drives is not just inefficient. Under GDPR and the Protection of Freedoms Act 2012, employers have legal obligations around how DBS certificate data is handled, stored, and disposed of. The DBS’s own code of practice for registered bodies requires that:

• Certificate information is only accessible to those who need it
• Data is stored securely with appropriate access controls
• Information is not retained for longer than necessary
• A clear data retention and disposal policy is in place

 
A spreadsheet accessible to anyone with the shared drive link does not meet these standards. Orta operates on UK servers, holds ISO 27001 certification, and is fully GDPR compliant. Every document stored within the platform is encrypted and access-controlled, with a full audit trail of who has viewed or changed any record.

Compliance data in a spreadsheet is not compliance. It is a liability stored in a format that offers no access control, no audit trail, and no protection if that file is shared with the wrong person.

Orta and the DBS Workflow: From Weeks to Days

The definitive guide to compliant onboarding sets out in full what a CQC-ready pre-employment process requires. Orta’s onboarding module is built to deliver that process from a single platform.

For DBS specifically, the workflow inside Orta looks like this:

• New starter application triggered automatically when a candidate is moved to offer stage
• DBS application tracked from submission through to certificate receipt with status updates visible to the manager
• Certificate details captured digitally with the original document requirement flagged and recorded
• Expiry date entered and monitored automatically, with tiered alerts as renewal approaches
• For Update Service checks: consent record stored, check result logged, action documented

 
The result is a compliant onboarding process where DBS management is no longer a task that falls through the cracks between sites, managers, and spreadsheets. It is a system-driven workflow that runs in the background and surfaces problems before they become inspection findings.

For providers dealing with the specific challenge of slow reference collection alongside DBS tracking, Orta’s automated reference chasing covers how the two workflows integrate within a single onboarding sequence.

Frequently Asked Questions

Do I need a separate DBS employer account for each site?

Under the current DBS system, multi-site employers managing checks independently typically require separate registered body arrangements or umbrella body relationships per location. A platform like Orta centralises the tracking and management layer across all sites, eliminating the need for separate login credentials and manual record reconciliation.

Can I use a previous DBS check for a new role?

Only if the candidate is subscribed to the DBS Update Service and the new role requires the same level and type of check. You must still obtain consent, see the original certificate, verify identity documents, and record the status check result. If any of those conditions are not met, a new application is required.

What are employers’ GDPR obligations around DBS certificates?

Employers must store DBS certificate information securely with access restricted to those who need it, retain it only for as long as necessary, and have a documented disposal policy. Storing certificate data in unprotected spreadsheets or shared drives does not constitute adequate data security under GDPR or the DBS code of practice for registered bodies.

Will CQC ask to see DBS records at inspection?

Yes. CQC inspectors checking compliance with Regulation 19 (Fit and Proper Persons Employed) will expect to see evidence that enhanced DBS checks with barred list checks have been completed for all staff in regulated roles. They may ask to see certificate details, issue dates, and evidence that certificates were viewed prior to the individual starting work. See Orta’s pre-employment checklist for CQC for the complete list of what inspectors expect.

How does Orta handle DBS checks across multiple sites?

Orta provides a single compliance dashboard that covers every site under one login. DBS tracking, expiry alerts, document storage, and audit trail records are all centralised. Managers at individual sites can view and manage their own staff, while senior operations leads have full cross-site visibility from one screen. Book a demo to see the multi-site view in action.

What does “one-click compliance” actually mean in practice?

It means that instead of switching between employer accounts, cross-referencing spreadsheets, and manually chasing certificate details across sites, a manager can open Orta’s compliance dashboard and see the complete compliance status of their entire workforce in a single view. Expired certificates, outstanding checks, and upcoming renewals are all visible without any manual reconciliation.

Multi-site DBS management does not have to mean multi-system complexity. Orta brings every check, every certificate, and every site into one place, so compliance is a dashboard, not a spreadsheet hunt.

Book a demo with Orta