A multinational manufacturer implements a policy requiring all incoming supply chain partners and distributors to formally sign and agree to the company's Supplier Code of Conduct before any purchasing orders are issued. In the context of internal compliance controls, this measure is classified as a:

In internal control design, controls are broadly categorized based on their timing and objective relative to a risk event: preventive, detective, and corrective.

The correct classification is preventive control. Preventive control is designed to deter or prevent undesirable events from occurring. Requiring incoming supply chain partners and distributors to sign the Supplier Code of Conduct before purchasing orders are issued establishes ethical standards, legal obligations, and operational boundaries from the outset. This upfront commitment helps deter vendors from engaging in non-compliant behavior, thereby reducing the likelihood of a risk event.

The detective-control classification is incorrect because detective controls are designed to identify and expose errors, omissions, or unauthorized actions after they have already occurred. Examples include bank reconciliations, inventory counts, and whistleblowing hotlines.

The compliance-audit classification is incorrect because compliance audit is structured review process designed to verify adherence to policies and regulations after activities have taken place; it functions as detective mechanism, not contract signature requirement.

The corrective-control classification is incorrect because corrective controls are implemented to rectify problems that have been detected, restore the system to its proper state, and prevent future recurrences. Examples include system backups, disciplinary actions, and process redesigns.

By integrating preventive controls like vendor codes of conduct into the procurement process, companies establish a strong compliance baseline that reduces reliance on costly detective and corrective measures.