Business and Technology · Internal controls

Types of Control: Preventive, Detective and Corrective Controls

Updated 11 October 2026 · Fact-checked

Controls are classified by when they act. **Preventive** controls stop errors or fraud happening. **Detective** controls find problems that have already happened. **Corrective** controls fix the problem and restore normal operations. To classify a control, ask: does it stop, find or fix? Controls can also be financial or non-financial.

Understand Types of Control: Preventive, Detective and Corrective

An internal control is any policy or procedure that helps a business protect assets, keep reliable records, follow rules and run efficiently. Businesses use many controls. To understand them, you group them by purpose.

The most tested grouping is by timing. A preventive control works before the event. It makes the error or fraud hard or impossible. A password on an accounting system is preventive. So is a rule that a manager must approve any purchase above a set limit.

A detective control works after the event. It does not stop the problem, but it finds it. A bank reconciliation is detective, because it reveals differences between your records and the bank's. So is a stock count that is compared with stock records, or an exception report of unusual payments.

A corrective control works after a problem is found. It fixes the damage and stops it recurring. Restoring data from a backup, correcting a posting error, and retraining staff after repeated mistakes are corrective. Many students confuse these with detective controls, so remember: detective finds, corrective fixes.

Controls can also be grouped by what they cover. Financial controls relate to money and accounting records, such as authorisation of payments and reconciliations. Non-financial controls relate to other areas, such as staff recruitment checks, training, security passes and quality checks. Other labels you may meet are manual or automated, and directive controls, which tell people what to do, such as policies and procedures.

Key formulas to remember

Preventive control: Acts BEFORE the event: stops the error or fraud; Examples: segregation of duties, authorisation limits, passwords, locked stores.
Detective control: Acts AFTER the event: finds the error or fraud; Examples: reconciliations, stock counts, exception reports, internal audit review.
Corrective control: Acts AFTER detection: fixes the problem and restores normal operation; Examples: data backup restoration, correcting entries, disciplinary action, retraining.
Financial vs non-financial: Financial = money and records; Non-financial = everything else; A control can be both financial and preventive, for example payment authorisation.

How to solve Types of Control: Preventive, Detective and Corrective questions

Use this method for any question asking you to classify a control or give examples of a type.

1Read the control carefully and identify exactly what it does.
2Ask when it acts: before the event, or after it?
3If it acts before and stops the problem, it is preventive.
4If it acts after and reveals the problem, it is detective.
5If it acts after the problem is known and repairs it or stops it recurring, it is corrective.
6Check whether it deals with money and records (financial) or other matters (non-financial) if the question asks.
7Check the options for the one that fits the full wording, not just a keyword.

Quickest way: Stop, Find, Fix

When to use it: Use this on one- or two-mark objective test questions where you must label a control.

Say to yourself: does it stop, find or fix?
Look for keywords: approve, restrict, lock, password mean stop; reconcile, review, count, compare mean find; restore, correct, retrain mean fix.
If it could be two types, choose the main purpose stated in the question.
Move on within about a minute.

Common mistakes in Types of Control: Preventive, Detective and Corrective

Calling a reconciliation preventive.
It feels like a safeguard, so students assume it stops errors.
Fix: A reconciliation happens after transactions are recorded and reveals differences, so it is detective.
Confusing detective and corrective controls.
Both act after the event, so they look similar.
Fix: Detective only discovers the problem. Corrective takes action to repair it or prevent recurrence.
Treating a stock count as corrective because the records are then adjusted.
Students focus on the adjustment, not the purpose of the count.
Fix: The count finds differences, so it is detective. Only the follow-up action is corrective.
Assuming all controls are financial.
Internal control is linked to accounting in many students' minds.
Fix: Controls such as staff training, vetting and physical security passes are non-financial.
Thinking a control belongs to only one type in every case.
Students memorise fixed lists.
Fix: Judge by the purpose in the scenario. Some controls, such as supervision, can prevent and detect.

Worked examples

Example 1

A company requires all purchase orders over $5,000 to be approved by a senior manager before being sent to suppliers. Which type of control is this? A) Preventive B) Detective C) Corrective D) Directive only

Show the solution

Identify what it does: approval is required before the order is sent.
It acts before the event, so it stops unauthorised or excessive purchasing.
A control that stops a problem occurring is preventive.
It is not detective, as nothing is found afterwards, and not corrective, as nothing is being fixed.

Answer: A) Preventive

Example 2

A retailer carries out a monthly bank reconciliation, finds a payment recorded twice, and then corrects the ledger and asks staff to check entries more carefully. Identify the detective and corrective elements.

Show the solution

The bank reconciliation compares records with the bank statement after transactions occur.
It reveals the duplicate payment, so it is the detective control.
Correcting the ledger repairs the error, so it is corrective.
Asking staff to check entries more carefully aims to avoid repeats, which is also corrective, as it responds to a known problem.

Answer: Detective: the bank reconciliation. Corrective: correcting the ledger and the instruction to staff to check entries more carefully.

Exam tips

Classify by timing and purpose, not by how the control sounds.
In multiple response questions, check every option separately and select exactly the stated number.
Learn two or three examples of each type, as questions often give a scenario and ask you to label it.
Read for the word 'after': it rules out preventive.
Do not overthink one-mark questions. Use stop, find, fix and move on.

Practice questions from Internal controls

Types of Control: Preventive, Detective and Corrective in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Types of Control: Preventive, Detective and Corrective: frequently asked questions

What is the difference between preventive and detective controls?

Preventive controls act before an event to stop errors or fraud, such as authorisation limits. Detective controls act afterwards to find problems, such as reconciliations. Preventive is cheaper per error avoided, but detective controls catch what slips through.

What are examples of corrective controls in ACCA BT?

Restoring lost data from a backup, correcting an accounting error, investigating and fixing a control weakness, and disciplinary action or retraining are all corrective. They respond after a problem has been found.

Are financial and non-financial controls different from preventive and detective?

Yes. They are a separate way of grouping controls, by subject area rather than timing. A single control can be both, for example payment authorisation is financial and preventive.

Can a control be both preventive and detective?

Sometimes. Supervision can deter mistakes and also spot them. In an exam, choose the type that best matches the main purpose described in the question.