As a best practice, employers, especially federal contractor employers, should have an established selection and hiring process, and have this in writing. The process can stipulate that: a) resumes alone will not constitute an application, b) that individuals interested in a position should formally express their interest by submitting an application to that job, and c) that only those who submitted an application will be considered for the position. This will help you manage unsolicited resumes, but also trim down your applicant pool for the purpose of recordkeeping and analyses. It is important that this process is applied consistently and that your recruiters are trained to not review and pick candidates from the resume pool which did not follow your established application procedure. The Society for Human Resource Management (SHRM) has a great example on their website that you could use to respond, as well as helpful tools on this topic.
You can use this OFCCP audit checklist to ensure you're doing what is required to maintain OFCCP's regulations including VEVRAA, Section 503, and EO 11246. Or request a demo to streamline your compliance and recruiting efforts.