Topics in this domain
- ISACA Code of Professional Ethics
- ITAF: The Standards Framework
- Standards vs. Guidelines vs. Tools
- Auditor Independence and Objectivity
- Audit Charter: Purpose and Contents
- Audit Testing: Compliance vs. Substantive
- Financial vs. Operational vs. Integrated Audits
- Forensic and Specialized Audits
- Risk-Based Audit Approach
- Inherent, Control, Detection, and Audit Risk
- Audit Universe and Annual Audit Plan
- Audit Objectives, Scope, and the Audit Program
- Types and Reliability of Audit Evidence
- Sampling: Statistical vs. Non-Statistical
- Sampling Terms: Confidence Level, Tolerable Error and Friends
- Interviews, Observation, and Walkthroughs
- CAATs and Data Analytics
- Continuous Auditing and Monitoring
- Preventive, Detective, Corrective Controls
- General vs. Application Controls
- Compensating Controls and Segregation of Duties
- Materiality and Evaluating Findings
- Audit Report Structure and Communication
- Follow-Up and Management Action Plans
- Control Self-Assessment (CSA)
- Audit Quality and Using Other Experts' Work
Preventive, Detective, Corrective Controls
What controls are for
A control is anything that reduces the chance of something going wrong, or the damage when it does. Locks, passwords, approvals, reviews and backups are all controls.
The simplest way to sort them is by when they act.
Think about protecting your house. A “protected by alarm” sticker is deterrent: it puts burglars off. A good lock is preventive: it stops them getting in. The alarm and the doorbell camera are detective: they tell you someone got in. Insurance and a locksmith are corrective: they fix the damage.
The types
| Type | Purpose | IT examples |
|---|---|---|
| Preventive | Stop errors, mistakes or attacks before they happen | Access controls, segregation of duties, input validation, encryption, approval before processing, firewalls, training |
| Detective | Notice that something went wrong | Log reviews, reconciliations, exception reports, intrusion detection, hash and control totals, audits |
| Corrective | Fix the problem and limit the damage | Restore from backup, incident response, disaster recovery, fixing root causes |
| Deterrent | Discourage people from trying | Policies with penalties, login warning banners, visible cameras |
| Compensating | Cover for a control that can’t be put in place | Independent review where segregation of duties isn’t possible |
| Recovery | Restore systems and services after an incident | Backups, alternate sites (often grouped with corrective) |
Which is the best control?
When the exam asks for the best or most effective control, the answer is usually preventive, because stopping a problem is cheaper and less disruptive than finding and fixing it later.
But no lock is perfect, so good control design layers them:
- preventive controls for the main risks
- detective controls to catch what gets through, and to show whether prevention is working
- corrective controls to recover
Example. Pay rate changes need approval in the HR system (preventive). Each month the payroll manager reviews a report of all rate changes against the approved forms (detective). Any errors are corrected and back-paid using a documented procedure (corrective).
A log nobody reads
Logs and reports are detective only if someone reviews them and acts on what they find. A log that nobody reads is just a record. Expect questions where the weakness is “logs are generated but not reviewed”.
Example. Firewall logs are collected every day, but nobody looks at them. An attacker probes the network for three weeks before breaking in. The logs recorded everything; the detective control simply didn’t exist.
Other ways to sort controls
- Manual vs automated. Automated controls do the same thing every time, so they’re generally more reliable, as long as change management stops anyone altering them. Manual controls depend on people, who get tired and make mistakes. IT-dependent manual controls are manual reviews of system reports, so the report’s accuracy needs testing too.
- Administrative, technical, physical. Policies and procedures; system settings and logical controls; locks, guards and environmental controls.
- General vs application. IT general controls support every system; application controls sit inside one system. Covered in the next topic.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| The best control to stop an unauthorised transaction | A preventive control at the point of entry, such as access control or approval |
| What kind of control is a reconciliation? | Detective |
| What kind of control is backup and restore? | Corrective / recovery |
| Logs are generated but not reviewed | There’s no effective detective control |
| Why automated controls are preferred | They’re consistent, if change management is effective |
| What kind of control is a login warning banner? | Deterrent |
In short
- Preventive controls stop a problem happening. Detective controls notice it after it happens. Corrective controls fix it and limit the damage.
- Deterrent controls discourage people from trying; compensating controls cover for a missing or weak control.
- Prevention is usually preferred, because stopping a problem is cheaper than finding and fixing it.
- Detective controls are still essential: prevention can fail, and detection proves prevention is working.
- A log is only a detective control if someone reviews it.
- Controls can also be manual or automated, and administrative, technical or physical.
- Automated controls are more consistent than manual ones, as long as change management protects them.
Exam traps
- Logs nobody reviews don't detect anything.
- Backups are corrective (recovery), not preventive.
- When asked for the BEST control, preventive usually beats detective, unless prevention isn't possible.
- Warning banners are deterrent, not preventive.
- Supervisory review of a report is detective, even though it may stop the next error.
Slides
Click the slide and use the arrow keys. F toggles full screen.
What controls are for
A control is anything that reduces the chance or the damage of something going wrong. Locks, passwords, approvals, reviews and backups are all controls.
The easiest way to sort them is by WHEN they act: before something happens, or after.