An international shipping company is reviewing its compliance controls to ensure it can quickly identify potential bribery or kickbacks. Which of the following measures operates as a detective compliance control?

Compliance controls are categorized by their timing and intent relative to a compliance failure: preventive controls aim to prevent the violation from occurring, detective controls identify violations after they have occurred, and corrective controls remediate the violation. An automated transaction monitoring system that flags and alerts on anomalous payments to third-party agents operates as a detective control because it analyzes transactions post-execution, or during processing, to identify anomalies, unauthorized payments, or potential red flags, such as suspicious third-party disbursements, that warrant further investigation. By contrast, the mandatory annual training module covering the Foreign Corrupt Practices Act for all sales reps is a preventive control because it educates employees beforehand to ensure they understand legal requirements and avoid making non-compliant decisions. The formal requirement for all newly hired staff to sign off on the organizational Code of Conduct is also a preventive control, establishing expectations and securing employee commitment to ethical behavior before they engage in business activities. The strict corporate policy establishing a zero-tolerance threshold for conflicts of interest is a preventive control, setting clear rules and thresholds to deter employees from entering into situations where conflicts of interest could arise. Therefore, the automated transaction monitoring system is the only detective control among the listed measures, designed to identify and flag issues that have already bypassed preventive barriers.