Prevent beats detect beats correct
- Rule
- Prevent beats detect beats correct
- Exam
- CISA & CISM
- What it means
When controls are otherwise similar, a preventive, automated control is generally preferred over a detective or manual one.
- The trap answer looks like
A manual review after the fact when an automated preventive control is available.
- The winning answer looks like
The control that stops the problem from happening, consistently and automatically.
- Worked example
Which control BEST prevents a single employee from creating a vendor and paying it?
- ❌ Monthly review of the vendor file
- ✅ Segregating vendor maintenance from payment approval
The review detects. Segregation prevents.