Which of the following is NOT a recommended prevention method for identity theft in businesses?

• A. Restrict the use of laptops to those employees who need them to do their jobs.
• B. Limit employees' access to customers' personal information.
• C. Perform audits of information-handling practices only when required to do so by regulators.
• D. Conduct background checks on prospective employees when permitted by law to do so.

Answer: (C)

Proactive, layered controls and ongoing monitoring are essential to prevent identity theft in a business environment. Limiting who can use laptops to those who truly need them reduces the chance of device misplacement or misuse becoming a data breach. Restricting access to customers’ personal information minimizes the amount of data at risk if credentials are compromised. Conducting background checks on prospective employees, where legally permitted, helps ensure that individuals with access to sensitive data are trustworthy.

Auditing information-handling practices only when regulators require is not aligned with strong prevention. Waiting for regulatory triggers means gaps can go undetected, security weaknesses may persist between audits, and remediation is delayed, leaving the organization more vulnerable to identity theft. Continuous internal audits and ongoing monitoring are the better approach to catch issues early and reinforce protective practices.