Orange County NC Website
Browse       Search
"I <br />IX. Administration of Program <br />A. Oversight. The Identity Theft Prevention Program Committee is responsible <br />for oversight of the program and program implementation. The Committee is <br />responsible for reviewing red flags rules compliance reports prepared by <br />Departments, addressing changing identity theft risks and identifying new or <br />discontinued covered accounts within the County. Recommendation for <br />material changes to the program shall be forwarded to the County Manager <br />for consideration. The Committee shall report to the County Manager at least <br />annually, on compliance with the red flag requirements. The County Manager <br />will then provide a report to the Board of County Commissioners and present <br />to the board any changes to the policy. The report will address material <br />matters related to the program and evaluate issues such as: <br />1. The effectiveness of the policies and procedures of the County in <br />addressing the risk of identity theft in connection with the opening of <br />covered accounts and with respect to existing covered accounts; <br />2. Service provider arrangements; <br />3. Significant incidents involving identity theft and management's response; <br />and <br />4. Recommendation for material changes to the Program. <br />B. Staff Training and Reports. County staff responsible for implementing the <br />Program shall be trained either by or under the direction of the Identity Theft <br />Prevention Program Committee in the detection of Red Flags, and the <br />responsive steps to be taken when a Red Flag is detected. Initial training will <br />be mandated for all employees who are responsible for opening new covered <br />account, restoring an existing covered account or accepting payment for a <br />covered account with respect to the implementation and requirements of the <br />Identity Theft Prevention Program. The Committee will exercise its <br />discretion in determining the amount and the substance of the training <br />necessary; however, periodic updates will be conducted as material program <br />changes occur. <br />C. Service Provider Arrangements. In the event the County engages a service <br />provider to perform an activity in connection with one or more accounts, the <br />County will take the following steps to ensure the service provider performs <br />its activity in accordance with reasonable policies and procedures designed to <br />detect, prevent, and mitigate the risk of Identity Theft. <br />1. Require, by contract, that service providers have such policies and <br />procedures in place; and <br />2. Require, by contract, that service providers review the County's Program <br />and report any Red Flags to the Committee. <br />Draft <br />Identity Theft Prevention Program Policy <br />Page 7 of 8 <br />