Preventative vs. Detective Controls: The Federal Accountant's Framework

Preventative controls act before a risk occurs and stop errors from entering the records. Detective controls act after the fact and find errors that have already happened. Every internal control in a federal agency is one or the other, and every control is also either manual (operated by a person) or automated (operated by a system). Those two dimensions combine into four control types, and each type has a specific role in an effective internal control system.

• Two dimensions, four control types. Every control is one row (manual or automated) and one column (preventative or detective).
• Preventative controls reduce the frequency of errors. Detective controls reduce their duration.
• Automated controls scale better and operate more consistently than manual controls, but require GITCs to be reliable.
• Most agencies need both types. Relying only on preventative controls leaves you blind when they fail. Relying only on detective controls means errors reach the records before you catch them.
• Classifying a control correctly is the first step in evaluating it. You cannot test a control effectively if you are not clear on what type it is.

Every ICFR assessment starts with a clear picture of what each control is supposed to do and how it works. That picture starts with classification. Our federal ICFR pillar post covers the broader framework. This post goes deeper on the classification question, because getting it wrong sets you up for weak testing, incomplete documentation, and audit findings that could have been prevented.

Classification is not academic. When you know whether a control is preventative or detective, you know what evidence to look for during testing. When you know whether it is manual or automated, you know who to interview and what system logs to request. The classification determines your entire testing approach.

Federal internal controls have two independent classification dimensions. The column dimension is timing: does the control act before or after the risk. The row dimension is operator: is it a person or a system.

	Preventative	Detective
Manual	Supervisor approves before it posts	Supervisor reviews after it posts
Automated	System blocks the transaction	System flags the exception

A preventative control acts as a gate. The transaction cannot pass unless the control conditions are met. If the control works, the error never enters the records in the first place.

• System edit checks. Financial systems reject transactions that violate configured rules. An obligation that would exceed the available allotment gets rejected before it posts. An invalid vendor code triggers an error message. These are automated preventative controls.
• Supervisor approval before posting. A budget analyst reviews and signs each contract obligation before the contracting officer records it. The approval is required before the transaction reaches the accounting system. This is a manual preventative control.
• Segregation of duties. No single person can initiate, approve, record, and reconcile the same transaction. This is a structural preventative control that operates through role design rather than a specific check on each transaction.
• Required training before system access. A new employee cannot receive credentials until they complete required training. Access management is preventative because it stops unauthorized activity before it can occur.
• Configured system limits. Purchase card thresholds, transaction dollar limits, and mandatory second-signer requirements are automated preventative controls that constrain what can happen without additional approval.

Think of a preventative control as a gate the transaction has to pass through. If the transaction meets the rules, it passes and posts to the records cleanly. If it does not meet the rules, the gate stops it. The error never enters the records. This is the ideal outcome, which is why preventative controls are usually the first line of defense in a well-designed system.

Detective controls do not stop errors from occurring. They find errors that have already happened. This may sound less valuable than preventative controls, but detective controls exist because no set of preventative controls is complete. Something will get through. Detective controls are how you find out.

• Monthly reconciliations. Reconciling the subsidiary ledger to the general ledger monthly is the classic detective control. Discrepancies get investigated. Errors get corrected. This is a manual detective control.
• Variance analysis. Comparing budget to actual, comparing this month to last month, comparing current year to prior year. Unexpected variances get flagged and investigated. This is a manual detective control that catches errors preventative controls missed.
• Exception reports. System-generated reports listing transactions that meet specific criteria (over a dollar threshold, from a specific vendor, in unusual accounts) get reviewed by managers. This is an automated detective control paired with manual review.
• Internal audit testing. Internal audit conducts periodic reviews of transactions, controls, and processes. Findings identify control failures after the fact. This is a manual detective control operating at a higher level of the organization.
• Automated fraud detection. Systems that flag transactions matching fraud patterns (rapid small transactions, transactions just below approval thresholds, unusual timing) are automated detective controls.

Every preventative control has a scope. It stops the specific error it was designed to stop. Errors outside that scope pass through. System updates can silently disable preventative controls, as the SBR example in our pillar post shows. People can find ways around manual controls. Detective controls exist to catch what preventative controls miss. Faster discovery means smaller impact.

The preventative/detective dimension tells you when the control acts. The manual/automated dimension tells you who or what operates it. Both dimensions matter for testing and for understanding what could go wrong with the control itself.

Manual controls are operated by people. A supervisor reviewing a transaction, a reconciliation performed by an analyst, a monthly certification signed by a manager. Manual controls are flexible and can adapt to unusual situations, but they depend on the operator doing the work correctly and consistently. When testing manual controls, you interview the operator and inspect evidence of the control operating (signatures, dates, review notes).

Automated controls are operated by systems. System edits, workflow routing rules, automated matching, calculated tolerances. Automated controls scale better than manual controls: they operate on every transaction, not just a sample. They are more consistent: they do not have off days. But they only work if the underlying IT environment is trustworthy. When testing automated controls, you verify the configuration, test the control on sample transactions, and separately test the IT general controls that keep the configuration intact.

The GITC connection. An automated control is only as reliable as the IT environment it runs on. If access to the system configuration is not controlled, someone could disable the control. If code changes are not tested before deployment, an update could break the control. If backup and recovery is weak, a system failure could bypass the control. General IT Controls (GITCs) are what make the IT environment trustworthy. Weak GITCs can invalidate reliance on automated controls throughout an entire assessment. GITCs will be covered in a future post.

The 2025 Green Book resource. The 2025 revision of the Green Book (GAO-25-107721) adds Appendix II, "Examples of Preventive and Detective Control Activities and Sources of Data." If you are building or evaluating a control library at your agency, this appendix is the authoritative federal source for common control examples. It also aligns with the 2025 revision's emphasis on preventive control activities where practical.

Example: a budget analyst reviews and signs each contract obligation over $100,000 before the contracting officer records it. A person makes the judgment, and the judgment happens before the transaction posts. This type of control is strong when the operator is skilled and the workload is manageable, but breaks down when volume overwhelms the reviewer or the operator changes and training is not maintained.

Example: the financial system rejects any obligation that would exceed the available allotment. The system enforces the rule, and enforcement happens before the transaction posts. This is often the highest-value control type because it operates on every transaction, is consistent, and cannot be forgotten. But it is only as good as the configuration and the IT environment.

Example: the CFO reviews a monthly reconciliation between the subsidiary ledger and the general ledger. A person reviews, and the review happens after transactions have posted. This is the workhorse detective control at most agencies. It catches errors that automated preventative controls missed and errors that manual preventative controls let through.

Example: the system generates an exception report of transactions posted outside normal business hours, which the CFO reviews weekly. The system detects the exception, but a person still has to act on it. Automated detective controls have grown rapidly with data analytics and continuous monitoring tools, and they are increasingly common in federal agencies.

Read each scenario. Classify each control by row (manual or automated) and column (preventative or detective) before checking the answer.

Answer: Automated / Preventative. The system enforces the rule (automated), and enforcement happens before the transaction posts (preventative). This is the strongest type of control when the underlying system configuration and GITCs are reliable.

The CFO reviews a monthly reconciliation between the subsidiary ledger and the general ledger.

Answer: Manual / Detective. A person performs the review (manual), and the review happens after transactions have already posted (detective). This is the classic month-end control that catches errors preventative controls missed.

Answer: Manual / Preventative. A person performs the review (manual), and the review happens before the transaction is recorded (preventative). This is a common control at agencies where high-dollar obligations warrant a second set of eyes but volume is manageable.

• Confusing "system-supported" with "automated." A supervisor reviewing a system-generated report is still a manual control. The system helps, but the operator is a person. The control is manual.
• Calling supervisory review "preventative" when it happens after posting. If the transaction has already posted, the review is detective, even if it happens quickly. Timing relative to the risk is what determines classification.
• Assuming automated controls need no human oversight. Automated controls need configuration reviews, exception handling procedures, and GITC testing. The automation reduces the operational burden, but it does not eliminate the need for supervision.
• Treating segregation of duties as a separate category. Segregation of duties is a structural preventative control that operates through role design. It fits the framework; it does not sit outside it.
• Classifying a compensating control the same as the missing primary control. A compensating control may cover a different type of risk and often has a different classification than the control it is compensating for.

A preventative control acts before a risk occurs and stops errors from entering the records. A detective control acts after the risk occurs and finds errors that have already happened. Preventative controls reduce the frequency of errors; detective controls reduce their duration. Effective internal control systems use both types together, because no set of preventative controls catches everything and no detective control eliminates errors entirely.

Not automatically. Automated controls operate on every transaction, are consistent, and scale well. But they only work if the IT environment is trustworthy, and they only catch the specific rules they were configured to enforce. Manual controls can adapt to unusual situations and apply judgment that automated controls cannot. Most effective agencies use both types together, with automated controls handling volume and manual controls handling exceptions.

No, though a well-designed process may include both types running in sequence. A single control acts at one point relative to the risk: either before (preventative) or after (detective). What looks like a dual-purpose control usually turns out to be two distinct controls, sometimes operated by the same person or system. Classify each control individually based on when it acts.

Segregation of duties is a manual preventative control. It operates through the design of roles rather than a specific check on each transaction, but it fits the framework: it stops errors and fraud before they occur (preventative) and depends on people occupying the correctly separated roles (manual). Automated enforcement of segregation of duties through system role management is an automated preventative control layered on top.

Classification determines what evidence you look for and where you look. For manual controls, you interview the operator and inspect physical or electronic evidence of the control operating (signatures, dates, review notes, checklists). For automated controls, you verify the system configuration, test the control on sample transactions, and rely on GITCs for the integrity of the underlying environment. For preventative controls, you look for evidence that errors were stopped before posting. For detective controls, you look for evidence that errors were identified and addressed after posting.

• Internal Controls Over Financial Reporting (ICFR) in the Federal Government: A Complete Guide 

• FMFIA, OMB A-123, and the GAO Green Book: The Legal Foundation of Federal Internal Controls

• The Federal ICFR Assessment Cycle: A Quarter-by-Quarter Guide

• GAO Standards for Internal Control in the Federal Government (Green Book), 2025 Revision, GAO-25-107721 (Appendix II includes examples of preventive and detective control activities)
• OMB Circular A-123
• COSO Internal Control - Integrated Framework