ITPEC FE Morning April 2021 Question 60
When IT controls are classified into preventive controls and detective controls, which of the following is to be classified as a detective control?
Explanation
Cross-checking the output list against the input form — a detective control finds errors after they have happened.
Preventive controls reduce the chance that an error or irregularity occurs at all; detective controls find the ones that got through, so they can be corrected. Comparing the list produced from the entered data with the original input forms can only take place after entry, and its purpose is to discover entry mistakes, so it is detective.
Answer (d)
Why not others:
- •(a) — a data entry manual and training make staff less likely to make mistakes: preventive
- •(b) — a screen designed so that operation errors are unlikely stops errors at the point of entry: preventive
- •(c) — giving access rights only to the person in charge stops unauthorised entry before it happens: preventive
Key rule: Ask when the control acts: before the event to stop it is preventive, after the event to find it is detective, and fixing what was found is corrective.
System Audit · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.