A financial institution or creditor should update its Program periodically, based on its experiences with identity theft, changes in methods of identity theft or methods to detect, prevent and mitigate identity theft, changes in the types of accounts offered or maintained, and changes in its business arrangements, including mergers, acquisitions and joint ventures.