An organization should establish a mix of preventative and corrective controls, policies and procedures to address risks and other program objectives. Management should indicate specific accountability and criteria for successful operation of the controls. These controls should be implemented, managed and monitored.

There are two primary types of controls:

> Preventive Controls deter or prevent undesirable events from occurring and should be designed to discourage errors or irregularities. These are proactive controls that help to prevent a loss.

> Detective Controls detect undesirable events which have occurred and should be designed to identify an error irregularity after it has occurred. These controls do not typically prevent a loss from occurring.

There are several other types of controls that management may define or employ:

> Directive Controls cause or encourage a desirable event or behavior to occur and typically include written policies, procedures, training, job descriptions, compensation plans, performance evaluations and the like.

> Corrective Controls correct undesirable events after they occur. These controls are designed to return the system to a trustworthy state after a loss has occurred.

> Compensating Controls are internal controls that are intended to reduce the risk of an existing or potential control weakness when duties cannot be appropriately segregated.

Principles
> Mix of preventative, detective and corrective controls
> Monitored and updated for continued relevance
> Understandable
> Multi-dimensional