The correct answer is B because the primary reason for conducting background checks on individuals who will have elevated access to production systems is to reduce internal threats . Personnel with privileged access can significantly affect confidentiality, integrity, and availability. Background screening is a preventive governance and personnel security control intended to lower the likelihood of insider misuse, fraud, abuse of privilege, or other harmful actions.
The other options are less appropriate:
* A. To eliminate risk associated with personnel is incorrect because risk cannot be fully eliminated.
* C. To ensure new hires have the required skills is handled more directly through recruitment, vetting, and qualification review, not primarily through background checks.
* D. To reduce exposure to vulnerabilities is too indirect; vulnerabilities are weaknesses in systems or controls, while this question is about personnel risk.
Exact Extracts supporting the answer:
* "The MOST effective measure against insider threats to confidential information is role-based access control."
* "The PRIMARY reason that an enterprise would establish segregation of duties controls is to prevent errors or fraudulent activity on high-risk transactions."
* "The control that focuses directly on preventing the risk of collusion is mandatory job rotation."
* "The MOST concern to the risk practitioner regarding applications running in production is backdoors." These extracts support that elevated access roles create significant internal threat exposure and require preventive controls focused on reducing insider risk. Therefore, the primary reason for background checks is to reduce internal threats .