Controls within a compliance program are typically classified as preventive, detective, or corrective. Which of the following activities represents an example of a corrective control?

Internal controls are categorized based on their timing relative to a compliance risk event: - Preventive controls are proactive measures implemented to prevent errors, fraud, or violations from occurring (e.g., segregation of duties, pre-approval workflows, training). - Detective controls are designed to identify and alert management to errors, fraud, or violations after they have occurred (e.g., reconciliations, audits, data monitoring). - Corrective controls are designed to rectify the problems identified by detective controls, repair damage, and prevent future recurrences (e.g., disciplinary action, policy updates, insurance claims, system restoration). Disciplinary action taken against an employee who has violated a policy is a corrective control because it addresses a specific infraction, serves as a deterrent to others, and aligns employee behavior back with organizational standards. Let's analyze the incorrect choices: - Option A is incorrect because automated transaction screening is a detective control designed to identify potential anomalies after or as they are recorded. - Option B is incorrect because training programs are preventive controls designed to educate staff and prevent violations from occurring. - Option C is incorrect because a pre-clearance requirement is a preventive control that blocks unauthorized transactions before they occur. A balanced compliance program requires a combination of all three control types to mitigate risks effectively.