Preventive vs Detective Controls

Every control is designed either to stop something going wrong or to notice when it has. A lock on a door, a requirement for manager approval and a system rule that blocks duplicate invoices are preventive. They make the problem less likely to happen. A reconciliation of bank statements, a review of exception reports and a security alert for unusual logins are detective. They find problems that got through. A third category, corrective controls, fixes problems once they are found, such as restoring data from backups or reversing an incorrect payment. Some frameworks also describe deterrent controls, such as warning notices, and recovery controls.

The distinction appears in the COSO framework, auditing standards, security frameworks and most control documentation, where each control is tagged by type. Neither type is better in every case. Preventive controls stop losses before they occur but can slow the business and cannot anticipate everything. Detective controls catch what prevention misses but only after the event. For finance, security, audit and risk teams, combining the two gives defense in depth, with each type covering the other's weaknesses. The right mix depends on the risk, the volume of activity and the cost of each control.

Definition of Preventive and Detective Controls

Preventive controls are designed to avoid unintended events, errors, fraud or security incidents by stopping them before they occur. Detective controls are designed to identify such events after they have occurred, in time for corrective action to be taken. Corrective controls restore systems or correct errors once a problem is detected.

Both types are core internal controls, are recorded as control attributes in a risk control matrix and are tested through control testing.

Examples of Preventive Controls

Approval requirements and authorization limits stop unauthorized transactions, such as purchases above a threshold without manager sign-off. Limits should be set so that approvals focus on transactions that matter.

Segregation of duties prevents one person from controlling a transaction from start to finish.

Access controls and multi-factor authentication stop unauthorized users from reaching systems and data.

System validation rules block invalid inputs, such as duplicate invoice numbers or payments to suppliers that have not been approved.

Training and clear policies prevent errors by making sure people know the rules. Training is a weaker preventive control on its own, since people can still forget or ignore the rules.

Examples of Detective Controls

Reconciliations compare records, such as bank statements and the general ledger, to find discrepancies.

Management reviews of reports, such as expense exceptions or variance analyses, identify unusual items.

Security monitoring and alerts detect suspicious activity, such as logins from unusual locations.

Audits and inventory counts compare records with reality. They often uncover problems that other controls have missed.

Continuous control monitoring checks transactions and settings automatically and flags exceptions.

Importance of Preventive and Detective Controls in Risk and Compliance

Combining both types provides defense in depth. If a preventive control fails or is bypassed, a detective control can still catch the problem. This layering is especially important for critical risks.

The balance affects cost and speed. Too many preventive controls slow the business, while relying only on detection allows losses to occur before they are found. Finding the right balance is a business decision as well as a control decision.

Classifying controls also helps auditors. Knowing whether a control prevents or detects helps auditors judge whether a risk is adequately covered and how to test it.

Preventive and Detective Controls and Financial Management

Preventive controls avoid losses entirely, which matters most where losses are large or hard to recover, such as fraudulent payments that leave the organization.

Detective controls can be cheaper and less disruptive for high-volume, low-value transactions, where reviewing exceptions costs less than approving everything in advance.

Automated preventive controls, such as system rules, are often the cheapest to run over time, since they work without human effort once configured.

The timeliness of detective controls matters, since an error found the same day is much cheaper to fix than one found at year end.

Common Challenges

Organizations may rely too heavily on detective controls, such as monthly reviews, that find problems only after losses have occurred. Monthly detection may be too slow for fast-moving risks such as payment fraud.

Excessive preventive controls can create bottlenecks, encouraging people to find workarounds. Workarounds can create new, unmonitored risks.

Detective controls lose their value if exceptions are not investigated and corrected. Every detective control needs a clear owner and a response process.