Question

1. Provide examples of business concerns describing the Preventive, Detective and Corrective Action with reference to Internal Control.

Answer 1

Detective Internal Controls

Detective internal controls are those controls that are used after the fact of a discretionary event. Think of Sherlock Holmes, walking onto the scene of an event, trying to piece together what happened.

• What caused the event to occur?
• What process failed that allowed the event to occur?
• Is there a policy that can be implemented to keep the event from happening again in the future?

Some examples of detective controls are internal audits, reviews, reconciliations, financial reporting, financial statements, and physical inventories.

Preventive Internal Controls

Preventative internal controls are those controls put in place to avert a negative event from occurring. For example, most applications have checks and balances built-in to avoid or minimize entering incorrect information. There are also physical controls or administrative preventive controls, such as segregation of duties that are routinely performed by companies.

Assigning one person to write checks, and another staff member to authorize the payments, are segregation of duties that fall under the umbrella of preventative controls from an administrative standpoint. Others, like video surveillance or posting security guards at entry points verifying ID credentials and restricting access, are illustrative of physical safeguards.

Training programs, drug testing, firewalls, computer and server backups are all types of preventive internal controls that avoid asset loss and undesirable events from occurring.

Corrective Internal Controls

Corrective internal controls are typically those controls put in place after the detective internal controls discover a problem. These controls could include disciplinary action, reports filed, software patches or modifications, and new policies prohibiting practices such as employee tailgating. They are usually put into place after discovering the reasons why they occurred in the first place.

Limitations of internal controls

Unfortunately, processes and control activities are not perfect, and mistakes and problems will be found. An ongoing review and analysis of the internal controls should be part of any organization’s regular processes.

When a problem occurs, it should be documented and reviewed by those who can take the corrective actions discussed above and improve the system. There will always be limitations with humans involved. People make mistakes and will often find weaknesses in the control procedures, whether by accident or with in.