Glossary term
Detective Controls
Subject: Risk Management, Controls and Risk Treatment
Also known as: Detective control
Detective controls are checks that find an error, loss or breach after it has happened, so it can be corrected, investigated and reported. Examples are reconciliations, exception reports and audits.
Explanation
Detective controls work on the assumption that some problems will get through, and aim to spot them quickly. Common types are reconciliations of accounts to external records, review of exception reports, physical stock counts, monitoring of unusual transactions, CCTV, and audit. They depend on speed and follow-up: a report no one reads is not a control. Their strength is that they can catch things nobody anticipated. Their weakness is that the damage is already done by the time they act, so they limit loss rather than prevent it. Most processes pair them with preventive controls, and a detective check can also deter wrongdoing, because people who know they will be checked are less likely to try. Each hit is also a prompt to ask which preventive control was missing.
Example
A distributor reconciles its bank account to its ledger every day. One morning the reconciliation shows a payment of 8,000 to a supplier that is not on the approved list. The finance team traces it to a spoofed email, asks the bank to recall the funds, and adds a callback check before changing supplier details in future.
Not to be confused with
- Preventive Controls
- Preventive controls stop the event from happening. Detective controls find it once it has happened.