Distinguish preventive, detective, and corrective controls with examples.

Distinguish preventive, detective, and corrective controls with examples.

• A. Preventive controls deter fraud (for example, separation of duties).
• B. Detective controls deter fraud (e.g., separation of duties).
• C. Corrective controls deter fraud (e.g., reconciliations).
• D. All controls are identical and serve the same purpose.

Answer: (B)

Preventive controls are meant to stop errors or fraud before they happen. Separation of duties is a classic example because it ensures no single person can both authorize and record a transaction, or otherwise complete all steps, which reduces the opportunity to commit fraud. Detective controls, on the other hand, are designed to uncover problems after they occur. Reconciliations fit here well: by comparing sets of records (like the general ledger, sub-ledgers, and source documents), discrepancies are detected so investigators can take action. Corrective controls come into play once a problem has been found. They focus on fixing the issue and making improvements to prevent recurrence—examples include restoring data from backups, correcting erroneous entries, and updating procedures or access rules based on what was learned. So, separation of duties illustrates a preventive control, reconciliations illustrate a detective control, and corrective actions address issues after detection and aim to prevent future problems.

Preventive controls are meant to stop errors or fraud before they happen. Separation of duties is a classic example because it ensures no single person can both authorize and record a transaction, or otherwise complete all steps, which reduces the opportunity to commit fraud.

Detective controls, on the other hand, are designed to uncover problems after they occur. Reconciliations fit here well: by comparing sets of records (like the general ledger, sub-ledgers, and source documents), discrepancies are detected so investigators can take action.

Corrective controls come into play once a problem has been found. They focus on fixing the issue and making improvements to prevent recurrence—examples include restoring data from backups, correcting erroneous entries, and updating procedures or access rules based on what was learned.

So, separation of duties illustrates a preventive control, reconciliations illustrate a detective control, and corrective actions address issues after detection and aim to prevent future problems.