Which of the following is a detective control?

Question

Options

• AAn organization requires certain employees who occupy sensitive positions to sign attestation to
• BA compliance specialist carries out quarterly reviews of an organization's compliance with
• CA front desk officer in an organization requires that visitors are identified by the host before access
• DAn internal audit activity deploys audit management policies and procedures for team members.

• A
  86% (18)
• C
  10% (2)
• D
  5% (1)

Explanation

Signing an attestation requires employees to formally declare their compliance with policies or their conduct during a specific period - this is detective because it surfaces existing violations or non-compliance that has already occurred. When an employee cannot truthfully sign the attestation, the control has detected a problem after the fact, fitting the definition of a detective control (one that identifies issues that have already taken place).

Option B is a monitoring control, and depending on context, may be corrective or preventive - quarterly compliance reviews proactively measure ongoing adherence rather than identifying a specific past violation, placing it closer to a monitoring/corrective category in many frameworks.

Option C is preventive - requiring visitor identification before granting access stops unauthorized entry before it happens, not after.

Option D is directive/preventive - deploying audit management policies establishes the rules and standards teams must follow; it creates the framework to prevent problems rather than detecting ones that already exist.

Memory tip: Think of detective controls like a detective arriving after the crime - they identify what already went wrong. An attestation forces employees to declare "what happened," which can expose past violations. Preventive controls are the locked door that stops the crime; detective controls are the investigation that finds it happened.

No community discussion yet for this question.