A preventive control stops a risk or an error from happening in the first place; a detective control finds it after it has already happened. Segregation of duties, approval limits and passwords are preventive. Bank reconciliations, confirmations and periodic asset checks are detective. A sound system of control needs both: preventive controls cut the odds of a loss, and detective controls catch what still gets through, so it can be put right.
Key points
- Preventive controls act before the risk or event is complete; detective controls act after it is complete.
- Preventive examples from the course: segregation of duties, delegation of authority, passwords, training, locks and alarms, preventive maintenance, a surprise cash count.
- Detective examples from the course: bank and party reconciliations, confirmations, access logs, periodic verification of fixed assets, monitoring and internal audit itself.
- The same activity can be either type, depending on when it happens. A quality check during production is preventive; the identical check once production is finished is detective.
- No control system should rely on one type alone: detective controls catch what preventive controls miss, and both usually need a corrective control behind them to fix what is found.
- Directive controls (policies and instructions) set the rule before any of this; corrective controls act once a detective control has found something wrong.
Preventive controls: stopping a problem before it happens
A preventive control is put in place in advance of a risk, to stop it from occurring at all. Because nothing has gone wrong yet, a preventive control is proactive by nature: it works quietly, in the background, every time a transaction is processed.
The clearest example is segregation of duties: linked tasks are split between two people so that one cannot commit and hide an error or a fraud alone. The course gives two real audit situations where its absence caused loss. In one, the same person booked vendor invoices and processed payments, and was able to alter the bank account number and name in the vendor master before paying it. In the other, one person could both raise a purchase requisition and place the order, which opened the door to fake requisitions against favoured vendors in return for kickbacks. Separating the two roles is what makes this a preventive control: the opportunity to commit the fraud is removed before any transaction happens.
Other preventive controls from the course:
- Approval limits (delegation of authority): a purchase order needs sign-off from a manager, a GM or a director depending on its value, so nobody approves beyond their authority.
- Passwords: a preventive mechanism that stops a user logging in at all without the right credentials.
- Training programmes: staff are trained on a new skill or technology before they need it, closing a skill gap before it causes an error.
- Preventive maintenance: machinery is serviced on a schedule so that it does not break down.
- Quality checks during production: the quality team inspects output while the batch is still running, so a defect is caught before it is finished and shipped.
- Locks, alarms and surveillance cameras: physical controls that deter theft, loss or damage.
- A surprise count of cash: an unannounced check keeps the balance honest precisely because nobody knows when it is coming — the deterrent itself prevents the theft.
What to check: for any preventive control, ask whether it was designed to stop the right risk, and whether it would actually have stopped the specific case you are worried about. A password policy that nobody enforces is not a preventive control, however good it looks in the policy manual.
Detective controls: finding a problem after it happens
A detective control is reactive: it is designed to identify a risk or an error that has already occurred, so that someone can take corrective action. It does not stop the loss; it stops the loss from going unnoticed.
The standard example is a bank reconciliation. The bank statement and the bank ledger are two independent records of the same thing. Comparing them shows up an entry the bank recorded that the books did not, or the other way round — and once the gap is found, it can be corrected. A confirmation does the same job with an external party: a customer, supplier or bank is asked to confirm a balance, and any difference points to an error or omission that needs investigating.
Other detective controls from the course:
- Access logs: if a user bypasses the password or authentication, the log still shows what was accessed and by whom, after the fact.
- Periodic verification of fixed assets: a physical count finds assets that have been lost, misplaced or are sitting idle.
- Quality checks after production: testing the finished batch identifies the rejects, so they can be reworked or scrapped — the defect has already happened by the time it is found.
- Monitoring and internal audit: both exist to detect errors, control deficiencies or fraud that other controls did not stop.
What to check: for any detective control, ask how quickly it actually runs. A reconciliation done once a year detects the same gap a monthly reconciliation would, but twelve months later — and twelve months of further transactions may have built on the same error.
Preventive vs detective controls, side by side
| Aspect | Preventive control | Detective control |
|---|---|---|
| Purpose | Stop a risk or error before it happens | Find a risk or error that has already happened |
| Nature | Proactive | Reactive |
| Timing | Built into the transaction, before it is complete | Applied after the transaction or period is complete |
| Course examples | Segregation of duties, delegation of authority, passwords, training, preventive maintenance, locks and alarms, surprise cash count | Bank and party reconciliations, confirmations, access logs, periodic fixed-asset verification, monitoring, internal audit |
| Main strength | Avoids the loss altogether when it works | Catches what preventive controls miss or could not cover |
| Main limitation | Has a cost, can slow a process down, and is never 100% effective on its own | The loss or error has already occurred; it must be followed by a corrective action |
The same control can do either job, depending on timing
A few controls in the course do not sit neatly in one column, because what matters is when they act. A quality check is the clearest case: run while the batch is still in production, it is preventive, because the defective item never leaves the line finished. Run on the batch once production is done, the identical check becomes detective, because by then the defect already exists — the only question is whether it is caught before it reaches the customer.
Surveillance cameras work the same way from two directions at once. As a visible deterrent, they are preventive: a person is less likely to attempt theft knowing they are being filmed. As a record, they are detective: if a theft does happen, the footage helps identify what was taken and by whom. The same camera does both jobs.
This is a useful question to ask of any control you are testing: not just “what does it do,” but “at what point in the process does it act.” That single question often decides whether a control is preventive or detective.
Worked example: controls over cash, from receipt to the books
This is how the two control types appear across one process. It follows the course’s own running example, cash, and is a method illustration, not a real client.
| Step | Control | Type |
|---|---|---|
| Collecting cash from customers | A policy requires cash to be deposited in the bank daily | Directive (the rule itself) |
| Handling and recording cash | The cashier and the person who records the cash in the books are different people | Preventive — removes the chance of misuse or incorrect accounting by one person acting alone |
| Logging into the accounting system | A password is required before any entry can be made | Preventive |
| Keeping cash secure between counts | A locked cash box and CCTV over the counter | Preventive (deterrent) and detective (the footage, if checked later) |
| Checking the cash balance | An unannounced, surprise count of cash on hand | Preventive — the deterrent of not knowing when it will happen keeps the balance honest |
| Matching the cash book to the bank | The bank statement is reconciled with the bank ledger every month | Detective — reveals any gap so it can be corrected |
| Checking fixed assets exist | A periodic physical verification of fixed assets | Detective — finds assets that are lost, idle or misplaced |
| Reviewing system activity | Access logs are reviewed for unusual entries | Detective |
| Acting once a gap is found | The entry is corrected and the cause investigated | Corrective |
Why you need directive, corrective and compensating controls too
Preventive and detective are the two types auditors reach for most often, but the course’s full classification has four. A directive control comes first: it is the instruction or policy management issues in advance, such as a 30-day credit policy or a tagging procedure for fixed assets — it tells people how to act, but on its own it does not stop or catch anything. A corrective control comes last: it is the action taken once a detective control has found a problem, such as revising a policy that proved too weak, disciplining an employee who broke a code of conduct, or repairing a machine that broke down.
A fifth idea worth knowing is the compensating control. It is used when an independent control — often a preventive one — is missing or weak. For example, if a password policy is weak, a stronger review of access logs (detective) can compensate for it until the password policy itself is fixed. A compensating control does not replace the missing control; it reduces the risk while that gap exists.
▶ Watch it explained
Short videos from our internal audit course. Each one covers a single topic, step by step.
📄 Get the template
Cash and Treasury: Risk and Control Matrix (Excel). 39 controls (26 key) for 13 objectives and 19 risks over cash and bank — each one marked preventive or detective, with walkthrough questions, evidence to ask for and test steps.
Holiday Period Fraud Prevention: What to Do Before the Break and Check When You Return. A practical, before-and-after plan — the steps to take beforehand (preventive) and the checks to run in the first week back (detective).
✅ Test yourself
Questions from our course quizzes. Click a question to see the answer.
A retailer’s internal audit found repeated till thefts by staff. Which control type would do the most to stop this happening again, and which would only reveal it afterwards?
A preventive control — such as CCTV, restricted access to the till and lockable cash drawers — does the most to stop the theft happening in the first place. A detective control, such as a surprise cash count or a till reconciliation, only reveals the theft after it has already happened.
A company runs a training programme so that staff understand its policies and new systems before problems arise. What type of control is this?
A preventive control. It is a proactive measure, put in place in advance of a potential risk or problem, to stop it from happening.
Which is the better independent control against fraudulent financial reporting: a segregation-of-duties policy, or a whistle-blower hotline?
Segregation of duties. It is a preventive control that stops any one person having complete control over a transaction, removing the opportunity for fraud before it can occur. A whistle-blower hotline is valuable, but it is detective: it surfaces fraud that may already be happening.
Frequently asked questions
What is the difference between preventive and detective controls?
A preventive control stops a risk or an error before it happens, such as segregation of duties or an approval limit. A detective control finds a risk or an error after it has happened, such as a bank reconciliation or a periodic asset count.
Can the same control be both preventive and detective?
Yes. What matters is when it acts. A quality check run during production is preventive; the same check run after production is detective. A surveillance camera is preventive as a deterrent and detective as a record once something has happened.
Which is better, preventive or detective controls?
Neither on its own is enough. Preventive controls reduce how often a risk occurs, but no preventive control is completely reliable. Detective controls catch what gets through, so it can be corrected, but by then the loss or error has already happened. A sound process uses both.
Where do directive and corrective controls fit in?
Directive controls come first: they are the policy or instruction, such as a credit period or a tagging procedure, that tells people how to act. Corrective controls come last: the action taken once a detective control has found a problem, such as revising a policy or disciplining an employee.
What is a compensating control?
A control used when an independent control, often a preventive one, is missing or too weak. For example, a stronger review of access logs (detective) can compensate for a weak password policy (preventive) until the password policy itself is fixed.
Related reading: Internal control explained: the COSO framework and examples · The 17 COSO principles explained, with examples · Test of design vs operating effectiveness, explained · Internal audit interview questions and answers
