Since our HR department pulls credit reports on applicants and employees, do they have to have their own Red Flags program and policy or are they covered under the bank’s?

I included them in the Bank's overall identity theft program. Procedures are the same regardless of what department identifies a red flag.