Before the team acts on a branch training session, an audit analyst must address Privacy and Information Security. Which response is most defensible?

Correct Answer

A) Use secure channels for borrower documents

Why this is correct: The governing concept is that loan originators have a fundamental duty to protect the confidentiality and security of nonpublic personal information (NPI) under laws like the Gramm-Leach-Bliley Act (GLBA). The original explanation anchors this by stating borrower information must be protected and shared only with authority. The most defensible action is to proactively implement secure channels (e.g., encrypted email, secure portals) for transmitting sensitive borrower documents. This directly addresses the Privacy and Information Security requirement before the training session proceeds. Why the other choices are wrong: Using "prior PMI cancellation approval as a substitute" is wrong because a past, unrelated transaction approval does not fulfill the ongoing, independent legal obligation to protect data privacy and security. Ignoring the issue "unless the borrower complains" is wrong because the duty to protect information is proactive and mandatory, not reactive based on consumer complaints. Documenting the issue "later instead of correcting the compliance problem first" is wrong because it delays necessary corrective action, which could lead to a data breach; compliance problems must be corrected promptly. Exam tip: Remember that "most defensible" actions in ethics questions almost always involve proactive, direct compliance with core consumer protection duties like data security.