Also on the "trust but verify" bit: you don't have to hire someone new and immediately give them the keys to the kingdom. Gradually build trust, and don't give an employee access to sensitive internal information until they've shown they can be trusted with it.