Preventive, Detective, Corrective: When Does the Control Act?
The easiest distinction is timing: before, during or after the problem.
Preventive
Attempts to stop the problem before it happens. Examples can include access restrictions, approvals, firewalls, and input validation.
Detective
Identifies a problem that occurred or is occurring. Examples can include log monitoring, exception reports, reconciliations, and intrusion detection.
Corrective
Helps restore operations or remediate the issue after detection. Examples include backup restoration, remediation, and corrective processing.
Controls can overlap
Real systems are messy and one technology can support multiple objectives. Identify the primary objective described in the scenario.
The takeaway
Prevent before. Detect during or after. Correct the consequences.
Related Summit guides
FAQ
Is a backup preventive?
Usually its primary role is recovery or correction.
Is monitoring preventive?
It is often primarily detective.
Can one control serve multiple roles?
Yes.