What you are trying to do is called Authenticated Encryption, the combination of encryption and authentication in on scheme.
The simplest form of it is doing encryption and authentication seperately either by authenticating the plain text (Mac-Then-Encrypt or Mac-And-Encrypt) or doing it the other way round: Encrypting first and then calculating the checksum over the ciphertext. None of the three variants are inherently insecure, but the latter version is considered the most secure these days and it is also the easiest one to get right.
What has to be noted is, that you should not just calculate a hash as you suggested but a MAC instead (like HMAC-SHA256), which can not be forged by an adversary. A hash alone only protects the integrity of the message helping you against errors but not against attackers.
Apart from these, there are also encryption modes which combine the encryption and authentication in one operation. If you do not have a particular reason for sticking with AES-CBC, these modes would be preferred.
The most popular of these modes would be AES-GCM, other options include AES-CCM, AES-OCB or ChaCha20-Poly1305..