Skip to content

FRM Part II · FRM Exam Part II · Risk Mitigation

Which feature best distinguishes a preventive control from a detective control in operational risk mitigation?

A preventive control acts before an event to stop it from happening, such as dual authorization, while a detective control identifies an event after it has occurred, such as a reconciliation or exception report. The distinction concerns timing, not automation or whether the risk is internal or external.

  1. AA preventive control operates before an event to stop it occurring, while a detective control identifies an event after it has occurredCorrect
  2. BA preventive control is always automated, while a detective control is always manual
  3. CA preventive control reduces severity, while a detective control reduces frequency
  4. DA preventive control is used only for external risks, while a detective control is used only for internal risks

Explanation

Preventive controls, such as access restrictions or dual authorization, act before an error or breach to stop it. Detective controls, such as reconciliations or exception reports, find issues after the fact. Automation level and risk origin do not define the distinction.

Did you get it right without looking?

One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.

Practise Risk MitigationFree diagnostic mock

More Risk Mitigation questions