Answer:
This should be addressed in your board approved CIP as well as your FACT Act Identity Theft procedures. If staff does not follow these procedures, there should be accountability standards in place.
It sounds like your institution has a compliance culture issue, rather than a policy/procedure issue.