Preventive vs detective controls, with practical examples
A preventive control acts before the unwanted event; a detective control identifies an event or exception that has occurred. A corrective action addresses the problem or its consequences. Classify the control against the specific risk and timing, not just the tool’s name.
Classify controls on the payment timeline
| Decision | How to apply it | Mistake to avoid |
|---|---|---|
| Preventive | The system blocks release of an invoice without an authorized approval. | Calling every automated control preventive even if it only produces a later report. |
| Detective | A daily report flags duplicate payments already processed for review. | Assuming detection stops the first incorrect payment. |
| Corrective | Recover the duplicate payment and correct the record or process weakness. | Confusing fixing a loss with preventing the original event. |
Preventive
The system blocks release of an invoice without an authorized approval.
Avoid: Calling every automated control preventive even if it only produces a later report.
Detective
A daily report flags duplicate payments already processed for review.
Avoid: Assuming detection stops the first incorrect payment.
Corrective
Recover the duplicate payment and correct the record or process weakness.
Avoid: Confusing fixing a loss with preventing the original event.
A decision path you can use
- 1Define the unwanted event
- 2Locate the control before or after it
- 3Check the action taken on exceptions
Understand the method
Work through the reasoning
Classify the control against the event you are trying to stop
A preventive control acts before the unwanted event. A detective control identifies an event or exception that has occurred. Begin by defining that event precisely. Approval before a payment is released may prevent an unauthorized release. Reviewing the same payment after release is detective in relation to that payment, even if the review helps prevent similar problems next month.
The same activity can therefore play different roles at different points in a process. A pre-release exception report can support prevention if someone resolves its exceptions before release. An identical report reviewed after release supports detection. Classification depends on the workflow and response, not on whether the activity is called a review, a report, or a system control.
Separate detection from correction and recovery
Detection identifies a problem; corrective action addresses it or its consequences. A reconciliation may reveal an incorrect balance. Investigating the difference, correcting the record, and addressing the cause are additional actions. A backup supports recovery, but its existence does not prove that restoration works or that the original disruption was prevented.
Look for the handoff between these activities. A strong alert can still fail to protect the objective when no one investigates or responds. Similarly, a correction may repair one transaction while leaving the underlying access problem unchanged. Describe the immediate remedy and the action intended to prevent recurrence separately so that management and audit can evaluate both.
Do not confuse timing with manual, automated, or compensating controls
Preventive and detective describe a control’s relationship to the event. Manual and automated describe how the control is performed. A manual approval may be preventive; an automated daily exception report may be detective. These dimensions can coexist. “Automated” does not mean error-free, because configuration, access, data quality, and change management affect the result.
A compensating control addresses risk left by a missing or impractical primary control. Evaluate whether it covers the same exposure with suitable precision and timing. A monthly review of large transactions may not adequately compensate for unrestricted access that permits many small unauthorized payments. The compensating label is a claim to evaluate, not proof of equivalent protection.
Test the mechanism rather than the control label
For a preventive approval, examine whether the right person approved the right activity before it occurred and whether bypasses were possible. For a detective review, examine the population, thresholds, reviewer competence, timeliness, and evidence of follow-up. A signature may establish that someone signed, while providing little evidence of what they actually checked.
A useful CIA answer connects the control to the stated risk and objective. Reject a control that acts too late for the claimed purpose, omits important transactions, or lacks a response mechanism. A mix of control types can be sensible because prevention is imperfect and detection can reveal failures. The choice should follow risk, not a rule that one type is always superior.
Original teaching example
Apply the method to a decision
The scenario
A duplicate-invoice rule runs in two systems. System A rejects the second invoice before payment. System B pays it, then sends an exception email the following morning.
The decision
A is preventive against duplicate payment; B is detective against that same risk.
The matching algorithm is similar, but the timing and consequence differ. If the email is never reviewed, the detective control may also fail in operation. Classification alone does not establish effectiveness.
Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.
A second application
The same exception report changes classification
The situation
A bank-change report is generated before the weekly payment run. Treasury used to investigate all exceptions before release, but now reviews the report two days after payment to save time.
Reason through it
The report’s name and fields have not changed, but the workflow has. It no longer prevents the current run’s payments from using unverified details. It may still detect exceptions and support recovery or future improvements, depending on how the review is performed.
Take the decision
Evaluate the control as it operates now. The old preventive description should not be used to claim protection that the changed timing no longer provides.
Original hypothetical teaching case.
Check your understanding
Choose the best answer, then check the reasoning for each alternative. These short learning checks are not a full exam simulation. Answers are not saved or sent.
Questions about this topic
Can one activity have both preventive and detective effects?
Yes, against different risks or at different points in a process. State the specific event first. A review that detects a data error before payment can prevent the payment error.
Can a detective control help prevent future losses?
Yes. Detection can trigger corrective action and deter or reduce recurrence. That future benefit does not make the activity preventive for an event that had already occurred when it was detected.
Sources and syllabus scope
Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.
- IIA expanded syllabus
Establishes the examined topics. Primary domain: Governance, Risk Management, and Control (30% of Part 1). This is a domain allocation, not a separate weight for this lesson.
- Global Internal Audit Standards reference
- Locator: Glossary: control and control processes; Standards 13.2 and 14.1. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.
Part 1: Internal Audit Fundamentals. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.