Following the onboarding of a new senior compliance analyst, the internal audit team discovers the individual had previously been sanctioned by a financial regulator for insider trading—a fact that was completely missed during the hiring process. This scenario represents a breakdown in which compliance program element?

Due diligence is a critical preventive control that applies not only to third-party vendors and agents but also to the recruitment and onboarding of employees, particularly those in high-risk or sensitive roles. Vetting candidates through comprehensive background checks, verifying professional licenses, and searching regulatory disciplinary databases are fundamental steps in pre-employment due diligence. A failure to identify a candidate's history of regulatory sanctions during the hiring process represents a direct breakdown in this preventive vetting control. The option describing post-employment corrective controls is incorrect because corrective controls are implemented to remediate a violation after it occurs, not to prevent the initial hiring of unqualified or high-risk individuals. The option describing continuous transaction monitoring is incorrect because transaction monitoring does not address employee background screening. The option describing periodic internal compliance auditing is incorrect because periodic auditing may discover the breakdown, as it did here, but the underlying failure itself occurred within the due diligence and vetting process, not the audit process.