Compliance controls generally fall into three categories: preventive, detective, and corrective. If your goal is to address a compliance failure after it has already occurred, restore order, and prevent it from happening again, which of the following is the best example of a corrective control?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal: controls are like the security system on your house. A lock prevents, a motion sensor detects, and fixing the broken window after the alarm is corrective. In compliance, taking disciplinary action after someone breaks the rules is corrective because it fixes the problem, enforces policy, and deters others.
Full Explanation
In compliance and internal audit frameworks, controls are classified based on when they operate relative to a risk event. Preventive controls are designed to deter or prevent undesirable events from occurring, such as segregation of duties or pre-approvals. Detective controls are designed to identify and flag undesirable events after they have occurred but before significant damage is done, such as audits, reconciliations, or transaction monitoring. Corrective controls are designed to remedy the impact of an event, correct the underlying root cause, and prevent future recurrences, such as disciplinary actions, business process redesign, or insurance claims.
The best example is implementing disciplinary measures against a staff member who intentionally bypassed a safety protocol. Disciplinary action is taken after a violation has been detected. It corrects the behavior, reinforces compliance expectations, and mitigates the risk of future violations by establishing a clear deterrent.
The mandatory pre-approval form for all corporate gifts and client entertainment is incorrect because a pre-approval process is a classic preventive control designed to block unauthorized actions before they happen.
The automated system that scans and flags suspicious transactions in real time is incorrect because transaction monitoring is a detective control designed to discover anomalies or violations that are occurring or have occurred.
The annual online code of conduct training module for new hires is incorrect because training programs are preventive controls designed to educate employees and prevent violations before they occur.