An enterprise's IT director is concerned that the chair of the IT steering committee is stealing confidential company information. Which of the following is the IT director's BEST course of action?

Filing a report with law enforcement prematurely without internal investigation or substantiation can escalate the situation unnecessarily and may not be the appropriate first step.

Reporting concerns about potential theft of confidential information by a high-ranking official like a steering committee chair to an ethics hotline ensures the matter is handled by an independent, impartial body, adhering to organizational policies and legal requirements. This approach protects the whistleblower and initiates a formal, objective investigation process without personal confrontation or premature legal action.

Discussing the concern directly with the chair could jeopardize an investigation, alert the individual, and potentially put the IT director in a difficult or unsafe position.

Conducting a personal investigation by the IT director is inappropriate and potentially beyond their authority, as it could compromise the integrity of evidence or lead to accusations of bias.