Charta is on Google Play: practise on the go. Get the app
Charta

Contrast the kinds of internal control and illustrate each kind with examples.

FRM® Part II · Operational Risk and Resilience · Risk Mitigation · FRM2.ORR.5.b

The idea

Internal controls are usually classified by when and how they act. Preventive controls stop an error or fraud before it happens, for example segregation of duties, access restrictions, approval limits and system hard stops. Detective controls find problems after they occur, for example reconciliations, exception reports, internal audit and surveillance. Corrective controls limit the damage and restore the position once a problem is found, for example reversing an erroneous entry, restoring from backup or compensating a client. Directive controls guide behaviour towards the desired outcome, for example policies, procedures, mandates and training. Controls can also be manual or automated. A detective control does not stop a loss, so its value depends on how quickly the finding is acted upon. Exam questions give an example and ask you to classify it, so ask what the control does and at what moment.

A practice question

From the question bank, with the reason each wrong option is wrong.

A bank ensures that the staff who capture trades cannot also settle them. What type of control is segregation of duties?

  1. DetectiveWhy not: A detective control finds errors after they happen, such as a reconciliation; segregation of duties acts before the event.
  2. Preventive - correct
  3. Corrective (post-event repair)Why not: A corrective control repairs damage after discovery; segregation of duties operates beforehand.
  4. DirectiveWhy not: A directive control sets expectations through policy; segregation is structural and blocks the action itself.

Splitting incompatible tasks makes it harder for one person to commit or hide an error or fraud, so the control acts before the event: it is preventive.

A harder one

Which of the following is best described as a directive control?

  1. A written policy setting approval thresholds, plus mandatory training - correct
  2. A system rule that rejects any order above a trader's limitWhy not: A system block that stops the action is a preventive control.
  3. A daily report listing every limit breach for management review and follow-upWhy not: Reporting breaches after the fact is a detective control.
  4. Restoring corrupted records from the latest backupWhy not: Restoring data after damage is a corrective control.

Directive controls tell people what is expected through policies, procedures and training. System blocks are preventive, breach reports are detective and restoration is corrective.

The hardest tier

Four controls are in place: (1) access to the settlement system is granted only after manager approval, (2) existing user access rights are reviewed each quarter, (3) an erroneous booking is automatically reversed and rebooked once identified, (4) a desk mandate sets which products traders may use. Which classification is correct, in the order (1) to (4)?

  1. Preventive, preventive, corrective, directiveWhy not: Quarterly review of rights that already exist looks back at what has been granted; it is detective, not preventive.
  2. Detective, preventive, directive, correctiveWhy not: Approval before access is granted acts in advance, so it is preventive, and the reversal repairs the booking, so it is corrective.
  3. Directive, detective, corrective, preventiveWhy not: Mixes up the mandate and the access approval: the mandate is a statement of what is allowed, a directive, while the approval stops access.
  4. Preventive, detective, corrective, directive - correct

Approval before access is granted is preventive; the periodic access review finds inappropriate rights already granted, so it is detective; reversing a wrong booking is corrective; a mandate states permitted activity and is directive.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Risk Mitigation