Which of the following is the least effective procedure for protecting the confidentiality of client information?

A$.$

Developing standard confidentiality policies applicable regardless of the size and nature of business operations.

B$.$

Undertaking a regular review of a firm's confidentiality policies and procedures.

C$.$

Avoiding disclosure of any information received from a client except to authorized fellow employees who also work for the client.