Controls within a compliance program are typically classified as preventive, detective, or corrective. Which of the following activities represents an example of a corrective control?

Internal controls are categorized based on their timing relative to a compliance risk event: - Preventive controls are proactive measures implemented to prevent errors, fraud, or violations from occurring (e.g., segregation of duties, pre-approval workflows, training). - Detective controls are designed to identify and alert management to errors, fraud, or violations after they have occurred (e.g., reconciliations, audits, data monitoring). - Corrective controls are designed to rectify the problems identified by detective controls, repair damage, and prevent future recurrences (e.g., disciplinary action, policy updates, insurance claims, system restoration). Formal disciplinary measures taken against an employee following a verified policy breach are a corrective control because they address a specific infraction, serve as a deterrent to others, and align employee behavior back with organizational standards. The automated screening tool that flags transaction anomalies in real time is incorrect because it is a detective control designed to identify potential anomalies after or as they are recorded. The annual training program on anti-bribery policies for employees in high-risk roles is incorrect because training programs are preventive controls designed to educate staff and prevent violations from occurring. The policy requiring compliance pre-clearance for all corporate gifts valued over $100 is incorrect because a pre-clearance requirement is a preventive control that blocks unauthorized transactions before they occur. Balanced compliance programs require a combination of all three control types to mitigate risks effectively.