Sorry me again - data audits for GDPR have thrown a lot of queries my way!

I've been tasked with putting a guidance note together for our schools, as it's come to light that there are a lot of inconsistencies on how references are handled. 

I would like to move more towards tombstone references led by the HR team, however, wondered what others do - do you have your own templates, and if so what information do you provide, or are you happy to complete any and all forms sent? Who sends/fills these out and do you keep copies?

I'm suggesting that if the request comes in stating the individual is to work with vulnerable people, then we would make a disclosure as to whether there were any concerns regarding safeguarding, however, if the request was to come in say from a mobile phone shop where they have not stated the individual would be working with vulnerable people, would we be right to make such a statement as surely this is not a requirement of the job?

One last thing, do you ask for an authority form of sorts from the requester to show the individual has given permission? We are met with a lot of confusion when we ask for this.

Thanks once again :)