A preventive control is a control that stops an error or a fraud before it enters the books or before money leaves the company, while a detective control is one that identifies an error or a fraud after it has occurred so that it can be corrected. Both families belong in any internal control system, in different places.
Preventive and detective controls take different forms in finance:
The two families are complementary, not interchangeable. Preventive controls cost less per error, because nothing has to be reversed, but they add friction to the flow. Detective controls add no friction, but every error they find has already happened: a duplicate payment found months later must be claimed back from the supplier. A third family, corrective controls, restores the situation after detection.
A mature control environment puts preventive controls where the loss is irreversible, such as outgoing payments and supplier bank details, and detective controls where volume makes prevention impractical, such as thousands of low-value card transactions. The type of each control is recorded in the risk and control matrix.
Phacet moves controls upstream. Pre-payment controls check every invoice before the payment run, turning checks that used to be detective into preventive ones, while reconciliation agents keep the detective layer for what prevention cannot catch.
