Question

1. Describe the difference between preventative and detective controls and discuss the strengths and weaknesses of each.

Answer 1

Preventive controls are used to keep errors and irregularities from occurring. They occur on a regular basis. Detective controls are are the controls that are used to find errors that may have occurred. They detect errors or irregularities. Difference between preventive and detective control are:

Preventive control	Detective Control
These are the controls that are placed to keep the errors from happening	These controls are used to detect any errors or irregularities.
They are placed for the problems that might occur in future	They identify the problems that already exist
Usually occurs on a regular basis	Usually occurs irregularly
Examples are backing up computer data, employee screening and training programs, etc.	Examples are review and approval of accounting work, audit, cash counts, etc.
They operate before the fact.	They operate after the fact.

Strengths of preventive control are:

• It helps to control risk.
• It includes security mechanisms that can mitigate errors.
• It helps to decrease the amount and impact of unintentional errors.
• It prevents unauthorized intruders.

Weakness of Preventive controls are:

• They operate before the fact that might prevent some problems in day today working.
• It is difficult to analyze which controls will be required to prevent errors.
• It can be defined as hit and trial method. As we try different controls that will be perfect for the organization.
• In case if it fails which means there is serious flaws in the entire control which will lead to deficiencies in the sub-components which will further open make organization vulnerable to risks.

Strengths of Detective errors:

• They detect undesired events are taking place.
• They uncover existing errors.
• They detect those who are violators of internal control .
• A random check is performed to validate transactions.

Weakness of Detective errors:

• Any breach in internal control can only be detected after they have occurred.
• They don't prevent unforeseen events.