In the context of internal compliance controls, which of the following is classified as a corrective control?
Select an answer to reveal the explanation.
Short Explanation
Check this out: compliance controls work like network controls—preventive stops issues, detective spots them, and corrective fixes them after a violation. When you issue a formal warning and suspension to an employee who bypassed purchasing protocols, the violation already happened, so you're correcting behavior and enforcing accountability. That's a corrective control.
Full Explanation
Internal compliance controls are categorized based on their timing and function relative to a violation. These categories are preventive controls, detective controls, and corrective controls. Corrective controls are designed to remediate problems, correct errors, and address violations after they have been detected. Their goal is to mitigate the impact of the violation, return operations to a compliant state, and prevent future recurrences. Disciplinary action—such as issuing a formal warning, suspension, or termination to an employee who has violated a policy—is a primary example of a corrective control. It addresses the non-compliant behavior directly and enforces the organization's standards after a breach has occurred.
The mandatory annual anti-bribery training module for all procurement staff is incorrect because training is a preventive control. It aims to educate employees on proper procedures and ethical decision-making to stop violations from happening in the first place.
The system that flags transactions exceeding a specific monetary threshold for compliance review is incorrect because transaction monitoring systems that flag anomalies are detective controls. They identify and alert compliance personnel to potential issues that are occurring or have already occurred, but they do not automatically correct them.
The dual-authorization requirement for any corporate bank transfers exceeding $10,000 is incorrect because dual authorization is a preventive control. It establishes a structural barrier, such as segregation of duties, to prevent unauthorized transfers from occurring.
Understanding the distinction between these control types is essential for building a balanced compliance framework that not only prevents and detects issues but also has the teeth to correct them when they arise.