The foundational triad of internal controls consists of Preventive, Detective, and Corrective (Repressive) controls. When expanded into a four-part operational taxonomy for comprehensive governance and risk management, Directive controls are added as the fourth pillar.
- The Core Triad vs. The Four Basics:
- Preventive, Detective, and Corrective: Historically derived from standard auditing and quality control theory, these three represent the complete chronological lifecycle of risk management (stopping a risk before it happens, finding it if it bypasses the barrier, and fixing the damage afterward).
- Addition of Directive Controls: Regulatory frameworks and modern internal audit standards (such as COSO and Institute of Internal Auditors guidance) formally include Directive controls as a foundational baseline because policies, training, and behavioral guidelines establish the mandatory rules that make preventive and detective mechanisms enforceable.
References
Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2013). Internal Control — Integrated Framework: Framework and Appendices. AICPA.
Institute of Internal Auditors (IIA). (2024). Global Internal Audit Standards: Guiding Principles and Standards for the Professional Practice of Internal Auditing. The Internal Audit Foundation.
Whittington, O. R., & Pany, K. (2021). Principles of Auditing and Other Assurance Services (22nd ed.). McGraw-Hill Education.
Repressive (Corrective) Controls
Objective: Fix, correct, or recover from errors, losses, or security breaches that have been detected, and prevent their recurrence.
Mechanism: Designed to remediate damage and update control frameworks following a failure.
Examples: Restoring data from secure backups, patching software vulnerabilities post-exploit, revising failed standard operating procedures (SOPs), and processing adjustment journal entries for accounting errors.
Comments
Post a Comment