Which practice helps ensure that financial record access is legitimate?

• A. Access records without notice to the owner.
• B. Obtain legal authorization, define scope, maintain confidentiality, and document access.
• C. Share credentials with colleagues.
• D. Access only public information.

Answer: (B)

The main idea is that legitimate access to financial records comes from formal authorization and proper controls. When you have legal authorization, you’re permitted to request and review the records you need for a specific purpose. Defining the scope prevents overreach, ensuring you only access information relevant to the task at hand and nothing more. Maintaining confidentiality protects sensitive data from unnecessary exposure, which is essential for privacy and security. Documenting who accessed records, when, and for what purpose creates an auditable trail that employers and regulators can review, showing that the access was authorized and appropriate.

Accessing records without notice can breach privacy and may be illegal, since you’re acting without documented permission. Sharing credentials undermines security and accountability, making it impossible to trace who did what. Accessing only public information misses the core requirement of legitimate access for private financial records, which typically requires authorization even if some information could be public in other contexts.