AI Hiring Audits Can Ignore Applicants Rejected Before Scoring

Consider one application moving through a common hiring workflow. A candidate uploads a résumé as a PDF. The applicant tracking system parses the document into fields, a knockout rule checks the answers to eligibility questions, and a ranking model scores whoever remains for recruiter review.

The published bias audit may cover only that final model. If the résumé parser failed to recognize the candidate’s employment history, or a missing field triggered an automatic rejection, that person never entered the audited population. The model can show similar selection rates across groups while the complete workflow produces a different result.

That is a scope failure, not a mathematical one.

The audit boundary can start too late

Bias audits usually compare outcomes across demographic groups. A selection rate is the share of people in a group who receive a favorable outcome, such as advancing to an interview. An impact ratio divides one group’s selection rate by the rate for a comparison group.

Both calculations depend on a denominator. If 10,000 people begin an application but only 6,000 receive an AI score, an audit of those 6,000 says nothing about how the other 4,000 disappeared. Some may have abandoned the form. Others may have failed an eligibility condition.

A parser may have left a required field blank even though the information appeared in the uploaded document.

Returning to the candidate’s PDF makes the distinction concrete. The parser could extract a blank value for years of experience, after which a rule coded as `years_experience < 3` rejects the application or routes it nowhere. The ranking model never sees the record. Testing the ranking model’s output cannot reveal whether extraction failures were concentrated among résumés with multi-column layouts, employment gaps, nonstandard job titles, or assistive-technology artifacts.

A parser is not necessarily an artificial intelligence system, and a knockout question can be a deterministic rule rather than a learned model. That technical distinction matters for legal classification and vendor contracts. It does not erase the gate’s effect on the audit population.

What

New York City’s rule requires, and what it does not

New York City’s Local Law 144 is a useful concrete reference because it attaches operational requirements to certain automated employment decision tools, or AEDTs, used to screen candidates for employment or promotion. The law defines a bias audit as an “impartial evaluation by an independent auditor” that includes testing for disparate impact.

Before a covered AEDT is used, the employer or employment agency must have a bias audit conducted no more than one year earlier and make a summary of the results publicly available. The city’s implementing rules specify calculations including selection or scoring rates and impact ratios for covered sex, race and ethnicity categories. The law also imposes candidate-notice requirements.

Those are enforced requirements, subject to the law’s definitions and jurisdiction. They are not a universal certification that an employer’s entire recruitment funnel is fair. A tool must fall within the covered AEDT definition, and the audit calculations describe the data and decision point placed inside the audit boundary.

An upstream parser that only converts a résumé into structured fields may sit outside that boundary. A separate rule that rejects candidates lacking a required credential may also be treated differently from the ranking model that “substantially assist[s] or replace[s] discretionary decision making,” the statutory language used in defining an AEDT. Classification depends on how each component works and is used, not on whether the vendor labels the full product AI.

Federal employment discrimination law creates a broader constraint. The Equal Employment Opportunity Commission has said that employers may be responsible when software used in selection causes unlawful discrimination, including software supplied by a vendor. The Uniform Guidelines on Employee Selection Procedures use the four-fifths rule as a practical indicator: a group’s selection rate below four-fifths of the rate for the group with the highest rate is generally evidence of adverse impact. It is not a safe harbor, a finding of liability, or proof that a result above that threshold is fair.

Compliance and assurance therefore answer different questions. A required audit may cover a defined AEDT. A useful workflow audit must also test how people reach it.

Audit the gate before the score

The right unit of analysis is the decision event. For the PDF application, one event records whether parsing completed and produced the fields required by the next step. Another records the knockout decision. A later event records whether the model scored the candidate, and the final event records whether a recruiter advanced the application.

Each event needs its own entering population. The denominator for parser success is every submitted résumé that the system attempted to parse, not every résumé parsed successfully. The denominator for a knockout rule is everyone presented with or evaluated against that rule. The ranking model’s denominator can remain the people scored by the model, but its result should be reported beside the cumulative rate from completed application to recruiter advancement.

That paired view prevents a narrow result from carrying more meaning than it supports. A model-level audit might show comparable advancement among scored candidates. The cumulative analysis could still reveal that one group reached scoring less often, which changes the practical opportunity to advance even though the model behaved similarly on the records it received.

A usable audit trail, meaning a record of inputs, transformations and decisions, should preserve a pseudonymous candidate identifier, the gate reached, the rule or model version applied, the timestamp, and the resulting status. It should also distinguish rejection from abandonment, technical error, duplicate removal and manual review. Combining those outcomes into “not selected” hides failures that require different remedies.

Versioning matters. If the parser changes while the ranking model stays fixed, a quarterly result can blend two workflows and make the source of a disparity hard to locate. The same problem appears when recruiters override recommendations without a reason code. The fallback is less elegant but dependable: freeze the relevant configuration during an audit window, or segment results by version and route so that unlike decisions are not averaged together.

Missing data can remove people twice

Missing demographic data creates a second denominator problem. Employers often lack voluntary race, ethnicity, sex or disability information for part of the applicant pool, and hiring systems should not infer sensitive traits from names, photographs or other proxies merely to complete an audit.

Reporting only applicants with known demographic data may still bias the result if disclosure rates differ by recruiting channel, job type or outcome. The audit should state how many records lack each protected characteristic, where those records drop out of the calculation, and whether known and unknown groups have different rates of reaching each gate. That does not reveal the missing person’s group, but it shows whether complete-case analysis, which uses only records with all required fields, describes a selective subset.

Operational fields need the same treatment. A blank degree value may mean the candidate has no degree, declined to answer, uploaded an unreadable document, or encountered a form error. Encoding every blank as “no” turns data quality into a hiring judgment. A safer workflow gives missingness its own status and routes consequential cases to clarification or human review, though that fallback adds recruiter time and can slow screening.

For the original PDF, the key record is not merely the model score. It is the parser output plus a reason code showing that a required field was unresolved and what happened next. Without that receipt, an auditor cannot distinguish a qualification decision from a software failure.

What to require before buying the audit

An audit statement should name the earliest gate covered, the population entering it, the favorable outcome, every exclusion from the dataset, and whether results describe one component or the cumulative workflow. If the report begins with “candidates scored,” procurement and compliance teams should request a reconciliation to completed applications and account for the difference.

Vendor access is often the limiting constraint. A model provider may return scores but retain no parser logs, while the applicant tracking system stores only the current application status rather than the sequence of prior states. Reconstructing the funnel later can require joining exports across systems, resolving duplicated candidate records and mapping changed reason codes. That work costs more than calculating an impact ratio, and it becomes less reliable as logs age or systems overwrite fields.

The setup step is to instrument the workflow before the audit period. Preserve gate-level events, version identifiers and machine-readable disposition reasons; separate technical failure from candidate withdrawal; and document which organization controls each component. Sensitive demographic data should be access-controlled and separated from hiring decision makers while remaining linkable for authorized analysis through pseudonymous identifiers.

An expensive independent audit is not worth the money yet if the underlying records cannot show who entered each gate. The immediate purchase should be better event logging and a data-retention design. Otherwise, the auditor can produce polished calculations for the scored population while the candidate rejected after the PDF upload remains absent from every table.

Questions people ask

Should a hiring bias audit include everyone who applied?

It should include everyone who entered the decision point being tested. For a cumulative workflow result, that usually means all completed applications exposed to the relevant gates. Withdrawals, duplicates and technical failures may need separate treatment, but the report should count and explain them rather than silently removing them.

Does passing the four-fifths rule prove an AI hiring tool is fair?

No. The four-fifths rule is an indicator used in federal selection guidance, not a fairness certificate or automatic legal safe harbor. A result can also change with the chosen comparison group, sample size, job grouping, audit period and, most importantly, which applicants reached the audited decision.

Is résumé parsing part of an automated hiring decision tool?

Sometimes, but not automatically. A parser may only extract text, or its output may directly determine whether an applicant advances. Coverage under a particular law depends on the definition and actual use. From an assurance perspective, any parser that can stop or redirect an application belongs in the workflow analysis.

What record exposes an upstream audit gap fastest?

Compare the number of completed applications with the number of candidates receiving a model score, then reconcile every difference to a recorded status. Parser errors, unresolved fields, knockout failures and withdrawals should remain distinct. A large unexplained remainder means the scored cohort is not a defensible picture of the applicant population.