Preventive and detective controls in an audit
How to tell a client's preventive controls from its detective controls, test each for operating effectiveness, and judge a small client's reviews.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Ask a client's finance manager what controls they have and the answer usually mixes two different kinds of thing. Some controls stop a problem from happening: the system will not accept an invoice without an order number. Others notice a problem after it has happened: the monthly bank reconciliation shows a payment nobody recognises.
Both matter, but they operate at different moments, leave different evidence and give the auditor different kinds of comfort. Sorting them properly at the walkthrough stage saves a good deal of confused testing later.
Stopping errors versus catching them
Investopedia explains that internal controls are broadly divided into preventative controls, which aim to stop errors or fraud happening, and detective controls, which are backup procedures to catch items missed by the first line of defence. Its explainer on internal controls sets out both types with everyday examples.
Three questions usually settle which kind a control is:
- When does it act? Before the transaction is recorded or the asset leaves, or afterwards?
- What happens to an error? Is it blocked, or flagged so someone can correct it?
- What does it leave behind? An approval on a document, or a report with differences on it?
Examples from authorisation, access and reconciliations
Investopedia gives the authorisation of invoices, the verification of expenses, and limiting physical access to equipment, inventory, cash and other assets as examples of preventative controls. ACCA lists common control procedures as physical controls, authorisation and approval limits, segregation of duties, management controls such as variance analysis, arithmetic and accounting controls such as reconciliations and trial balances, and human resources controls such as reference and qualification checks.
Sorted by type, a typical client's controls might look like this:
| Control | Type | What it does |
|---|---|---|
| Purchase orders approved within limits | Preventive | Stops unauthorised purchases being placed |
| Locked stores and restricted system access | Preventive | Stops assets being removed or records being changed |
| System refuses a repeated supplier invoice number | Preventive | Stops the same invoice being paid twice |
| Reference and qualification checks on new staff | Preventive | Stops unsuitable people getting access |
| Monthly bank reconciliation, reviewed | Detective | Finds unrecorded or incorrect bank transactions |
| Budget against actual review | Detective | Finds unusual costs or missing income |
| Stock counts compared with records | Detective | Finds losses and recording errors |
| Review of exception reports | Detective | Finds transactions outside expected limits |
Reconciliation as the key detective control
Investopedia identifies reconciliation, the comparison of data sets, as the most important detective control, with corrective action taken when material differences are found. The second half of that sentence is what turns a reconciliation into a control. A reconciliation that is prepared, filed and left with unexplained differences is a report, not a control.
When assessing one, look for the evidence that it did its job: who prepared and reviewed it, when, how reconciling items were investigated, how long old items stayed open, and which corrections were posted as a result.
Testing operating effectiveness
ACCA explains that ISA 330 defines a test of control as an audit procedure designed to evaluate the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements at the assertion level. Both types qualify, but notice the wording: a detective control only counts if it corrects as well as detects.
The testing differs:
- Preventive controls. Inspect a sample of transactions for evidence that the control operated, such as an approval within the approver's limit. For system controls, check how the control is configured and who can change it, and ask the client to demonstrate it rather than testing it on live records yourself.
- Detective controls. Select instances of the control, for example several monthly reconciliations, and confirm each was performed on time, reviewed by the right person, investigated where differences arose and followed by corrections. Reperform at least one.
Detective controls also raise a question of precision. A high-level review of total expenses against budget is unlikely to catch a material error in a single account. If the review would not have noticed a misstatement of the size that matters, it cannot be relied on, however diligently it was done.
Recording controls and walkthroughs in Achekam
In Achekam, the Controls & Walkthrough Studio saves its work on the server for the chosen engagement. Record each control in the cycle, whether it is preventive or detective, who operates it, what evidence it leaves and what the walkthrough showed. The ISA numbers on the module's badges are labels, not evidence of compliance; the substance is what the team writes down. Walkthroughs and controls covers how to run the walkthrough itself.
For the tests, Audit Intelligence risk-scores a loaded population and proposes a sample, a reviewer who did not prepare the plan approves it before it is drawn, and the draw can be reproduced from its stored seed. The population differs by type: the year's approved orders for a preventive approval control, the months of the year for a monthly reconciliation.
When a detective control is all a small client has
Small clients often have little in the way of preventive control, because one or two people do almost everything. What many do have is an owner who reads the bank statement and the monthly management accounts. Those are detective controls, and they can be meaningful.
Judge them on four questions. Is the review precise enough to notice an error of the size that matters? Is it done consistently, every month? Does it leave evidence, such as initials, notes or queries? And does it lead to correction when something is wrong? If the answers are yes, the review may support some reliance. If not, the audit stays substantive and the management letter says why.
For a framework that places these controls within the wider system of internal control, see the COSO framework for auditors. Whatever the framework, the first question at each control stays the same: does this stop the problem, or tell someone it has happened?
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
