Which of the following is NOT a required element of an Identity Theft Prevention Program?

• A. Risk assessment
• B. Ongoing monitoring
• C. Training
• D. Annual consumer surveys on satisfaction

Answer: (D)

The required elements focus on internal processes to prevent identity theft: identifying risks, continuously monitoring for red flags, and training staff to recognize and respond to those red flags, with ongoing updates to the program as risks change. A risk assessment establishes where threats exist; ongoing monitoring keeps an eye on accounts for suspicious activity; training ensures employees know how to act when red flags appear. Overseeing service providers and updating the program as needed are also part of the structure.

Annual consumer surveys on satisfaction, however, are not mandated components of the Identity Theft Prevention Program. The regulation centers on the institution’s internal controls and procedures, not on conducting customer satisfaction surveys about the program.