Which item is part of the core components of an Identity Theft Prevention Program under the Red Flags Rule?

• A. Disaster recovery plan
• B. Employee performance reviews
• C. Procedures to identify red flags
• D. Annual budget projections

Answer: (C)

The key idea is that the Identity Theft Prevention Program must have a plan to detect signals of potential identity theft. Procedures to identify red flags are essential because they lay out exactly how staff should recognize suspicious activity, what counts as a red flag, and when to escalate or take steps to prevent or mitigate identity theft. That direct focus on recognizing and flagging risky activity is what makes this element a core component of the program.

Disaster recovery plans relate to keeping operations running after a disaster, not to spotting identity theft signals. Employee performance reviews are about managing staff and performance, not about detecting red flags. Annual budget projections are part of financial planning, not the process of identifying identity theft indicators.