Preventive Controls

Preventive controls act before the event. A password stops an unauthorised user, a purchase limit stops an oversized order, a pre-approval step stops an unchecked payment, and a safety guard stops a hand reaching a moving blade. Many are built into processes, including automated ones in software, and others rest on policies and training. They are usually cheaper than fixing a loss afterwards, but they can slow work down, can be bypassed if badly designed, and cannot foresee every situation. For that reason organisations rarely rely on prevention alone and add detective controls behind it. When risks are assessed, preventive controls are normally the first choice for severe events, because a loss that cannot be undone is better stopped than found. Their usual failure is staleness: an access list or limit that nobody updates blocks the wrong things.

A pharmaceutical manufacturer stores finished stock in a warehouse where only badge-holders from the logistics team can enter. The inventory system also refuses to release a batch for shipping unless quality assurance has signed it off. Both measures stop wrong or unauthorised movements before they occur, instead of relying on later stock counts to find them.