Security firm G4S was sent warnings not to employ an armed guard in Iraq just days before he murdered two colleagues, a BBC investigation has found.
Private security guard Paul McGuigan, from the Scottish Borders, was shot dead by Danny Fitzsimons in 2009 in Baghdad while on a protection contract.
Another man, Australian Darren Hoare, was also killed.
All were working for UK contractor G4S, which was operating under the name ArmorGroup in the region.
In a BBC documentary, it is revealed that a G4S worker sent a series of emails to the company in London, warning them about Fitzsimons's previous convictions and unstable behaviour.
The anonymous whistleblower signed one email "a concerned member of the public and father".
The worker warned G4S: "I am alarmed that he will shortly be allowed to handle a weapon and be exposed to members of the public.
"I am speaking out because I feel that people should not be put at risk."
Another email, sent as Fitzsimons was due to start work in Baghdad, said: "Having made you aware of the issues regarding the violent criminal Danny Fitzsimons, it has been noted that you have not taken my advice and still choose to employ him in a position of trust.
"I have told you that he remains a threat and you have done nothing."
Within 36 hours of arriving in Iraq in August 2009, Fitzsimons - a former paratrooper - had shot and killed the two men after what he claimed was a drunken brawl.
An Iraqi colleague was also wounded as Fitzsimons tried to flee the scene.
Fitzsimons had worked as a private security contractor before in Iraq, but he had been sacked for punching a client.
At the time he was taken on by G4S, Fitzsimons also had a criminal record, was facing outstanding charges of assault and a firearms offence, and had been diagnosed by doctors as having PTSD (post-traumatic stress disorder).
In the documentary, the parents of Paul McGuigan call for the company to face criminal charges over the killing.
His mother Corinne Boyd-Russell, from Innerleithen in the Borders, said: "[Fitzsimons] fired the bullets. But the gun was put in his hand by G4S ArmorGroup. They put the gun in that man's hand.
"I want G4S to be charged with corporate manslaughter and be held accountable for what they did."
The parents of Danny Fitzsimons, who is serving 20 years in a Baghdad prison after being sentenced for the murders in February 2011, were also shocked to hear about the existence of the emails.
Liz Fitzsimons, from Manchester, said: "And they still took him out there? They [G4S] need to be taken to task for that.
"The people who we feel are responsible, who we hold responsible for putting that gun in Danny's hand, are without a shadow of a doubt G4S."
A G4S spokesman admitted that its screening of Danny Fitzsimons "was not completed in line with the company's procedures".
It said vetting had been tightened since the incident.
Regarding the email warnings, the spokesman G4S told the BBC it was aware of the allegations but that an internal investigation showed "no such emails were received by any member of our HR department".
He did not say whether anyone else in the company had seen them.
An inquest into the death of Paul McGuigan, a former Royal Marine, is due to begin in December.
The revelations in the Fitzsimons case come just weeks after G4S found itself at the centre of a crisis over its inability to meet its commitment to recruit security staff for the Olympics in London.
It is the biggest security company in the world in an industry that is worth about £400bn globally.
Often controversial, the sector has been dogged by allegations of abuse and violence in countries such as Iraq and Afghanistan.
However, in the BBC documentary, Britain's Private War, it reveals the growing extent to which the UK government relies on armed security companies to protect its interests overseas.
The UK has spent almost half a billion pounds on such firms since the end of the Iraq war in 2003.
Yet British companies - said to be the key players - remain unregulated.
The programme-makers heard stories of contractors being forced to work on dangerous missions with inadequate equipment, incident reports sanitised to protect company reputations and numerous deaths of former soldiers.
One security contractor, Bob Shepherd, said: "We know when a soldier dies it's all over the newspapers, it's on the TV. But we never know when security contractors die.
"For the companies it's bad for business, for the government it's hiding the true cost of these conflicts.
"If the British taxpayers knew the total numbers of people that have died on behalf of British security companies in places like Iraq and Afghanistan they would be shocked."
Instead of formal regulation, the UK government has opted for the companies to set up their own body to monitor themselves, called the Security in Complex Environments Group (SCEG).
Chris Sanderson, the chairman of SCEG, told the programme his organisation did not have powers to punish poor behaviour.
Asked what action he would be able to take against companies which did not uphold the best standards, he said: "If they continue to operate underneath the radar, very little.
"What the majority of the industry is keen to do is to ensure that those companies who are behaving less professionally are identified and commercially disadvantaged.
"At the moment, signing an international code of conduct means nothing apart from perhaps a wish to differentiate themselves in the market place.
"In terms of substance and performance it means nothing.
"What will mean a great deal is when the standards are in the place and there is an independent verification of those standards."
In a statement, the foreign Office said it was vital to work in partnership with the industry to effectively prevent abuses by private security companies abroad.