Anthony LaFaziaCEO, Atlantic Training · CEO at Atlantic Training | EdTech & Safety Compliance Leader

Red Flags Rule Annual Reporting: How to Structure Compliance Briefings and Program Updates

15 Jun 2026 · 1 min

Watch on YouTube

0:49

In this instructional segment, the presenter explains the annual reporting obligations under the Red Flags Rule. A compliance report must be delivered each year to the board of directors, a board committee, or a designated senior‑management officer. The report must assess the effectiveness of the organization’s identity‑theft risk program, evaluate policies, detail significant identity‑theft incidents and near‑misses, and recommend material changes. The presenter stresses that board‑level approval and ongoing oversight are required, making the board directly accountable for the program. Reporting is only half the process; any critical gaps identified must be remediated promptly, not postponed until the next reporting cycle. The annual report should also be leveraged to justify additional resources, such as advanced authentication tools, by linking observed fraud trends to budget needs. The segment includes a mid‑roll advertisement for Atlantic Training’s Wave management platform, which offers HR and soft‑skill training solutions integrated with onboarding and leadership‑development tracking.

Chapters

Finally, we have to talk about the paper trail. The rule requires that a report be provided to the board of directors, a committee of the board, or a designated senior management employee at least annually. This isn't just a memo, it's a compliance report. This report needs to address the effectiveness of your program. It should cover the effectiveness of your policies in addressing the risk, significant incidents involving identity theft and your management's response. This is where you detail the near misses and the actual hits and recommendations for material changes to the program.
Is your employee training scattered across spreadsheets and emails? There's a better way to grow your team. Atlantic Training provides world-class HR and soft skills courses. All hosted inside our Wave management platform. From onboarding automation to tracking leadership development, Wave tracks it all. And you get the software for free when you choose your training plan. Click the link below to build your custom plan now.
Why does the board need to see this? Because the rule requires board-level or senior management-level approval of the initial program and oversight of its administration. They are on the hook, so you need to keep them informed. But reporting is only half the battle. You also need timely remediation. If your report tells the board there is a critical gap, you can't wait until next year to fix it. The rule expects you to update the program and address those gaps promptly. Use this annual report as your opportunity to ask for resources. If you're seeing a spike in sophisticated digital fraud, use the report to justify the budget for better authentication software. Yeah, I see. Use the data to drive the strategy.