Designate a single person in your organization to handle reference requests. Often, this person is someone in human resources, since he or she would have access to the relevant information. Work with him or her to develop a clear policy on references, and make it clear that all requests for references are to be sent directly to this person, and no one else.
In addition to ensuring that all requests are handled properly, this will also ensure the validity of references. Bad employees may choose to have friends stand in as "references" if they suspect that they will be getting a bad reference. If a company knows that it can call any phone number at your company and be forwarded to the person who handles reference requests, it can be assured that a reference is genuine.
Only give references to people who are authorized to request them. References should only be given out to prospective future employers who have informed applicants that their references will be checked. If someone calls to request a reference, you should always verify this. Some companies require reference requests in writing, for this very reason.
If you suspect that a reference request is not genuine, ask them to have the ex-employee contact you and confirm that it is ok to release reference information.
Stick to the facts. Some employers choose to take this very literally, and when called for a reference, they will only confirm that someone did work for them, and provide the dates of employment.
If you choose to give more information than this, especially if you plan to give a negative reference, choose your words carefully. Only make statements which can be factually backed up, and if you state an opinion, make this clear.
"Mary Sue was a bad employee," for example, is not the way to go.
"In my opinion, Mary Sue was not a good fit for the position" would be more appropriate, and it allows the company requesting the reference to request additional information.
Information you can provide: