After detecting that a high-level executive has been charging personal vacations to the corporate expense account, the Board of Directors initiates a targeted forensic investigation to quantify the financial loss and implement disciplinary actions. This investigation, along with the subsequent remediation steps, represents which type of compliance control?

Compliance controls are categorized by their timing and function relative to a violation. Preventive controls are designed to stop violations before they occur (e.g., policy training, system access restrictions). Detective controls are designed to identify violations after they have occurred but before major damage is done (e.g., reconciliations, whistleblower hotlines, routine audits). Corrective controls are designed to remediate the effects of a violation, discipline the wrongdoers, and implement measures to prevent future occurrences. An investigation launched in response to a known violation of company policy (such as executive misuse of funds) is a corrective control. The investigation seeks to uncover the full scope of the misconduct, determine the root cause, and enable the organization to take disciplinary or legal action, retrieve the funds, and patch control gaps. Directive controls define expected behavior through policies and codes of conduct, but they do not actively remediate or prevent violations on their own.