By Dollawat Promchinavongs | Risk Consulting Partner
Building a Prevention-First Approach to Internal Controls
Every business faces risks errors in financial reports, fraud, data breaches, or regulatory penalties. Internal controls are the tools organizations use to manage these risks. There are three types: preventive controls that stop problems before they happen, detective controls that find problems after they occur, and corrective controls that fix problems once they are found.
All three types are important. But this article argues that organizations should invest in prevention first because stopping a problem is almost always cheaper, faster, and more effective than finding and fixing it afterward.
What Are the Three Types of Controls?
| Item to consider | Preventive | Detective | Corrective |
| When? | Before the problem | After the problem | After detection |
| Goal | Stop errors from happening | Find errors that already happened | Fix errors and prevent repeat |
| Examples | Approval limits, access controls, segregation of duties, input validation | Bank reconciliation, inventory counts, audit reviews, exception reports | Error correction, disciplinary action, system patches, process redesign |
| Think of it as… | A guardrail on a mountain road | A camera recording the accident | The ambulance arriving after the crash |
Why Should Prevention Come First?
1. It Costs Less
Fixing a problem is almost always more expensive than preventing it. Quality management research describes this as the “1-10-100 Rule”: it costs 1 unit to prevent a defect, 10 units to detect it, and 100 units to correct it after it reaches the customer.
A simple example: if a company has no approval limits on purchase orders, staff might overspend. By the time a monthly budget review catches the problem, the money is already spent. Investigating, negotiating with suppliers, and adjusting budgets all cost time and money. A system-enforced approval limit would have blocked the overspending in the first place at a fraction of the cost.
2. It Closes the Time Gap
Detective controls have a built-in weakness: the delay between when a problem happens and when it is found. A monthly reconciliation means errors could go unnoticed for 30 days. A quarterly audit extends that to 90 days. During this gap, damage grows.
Preventive controls remove this gap entirely. A dual-signature requirement on bank transfers does not catch fraud after it happens, it stops the unauthorized transfer from going through at all. No waiting, no accumulating damage.
3. Some Damage Cannot Be Undone
Certain risks produce consequences that no corrective action can reverse. Once personal data is leaked under Thailand’s PDPA or the EU’s GDPR, it cannot be un-leaked. The regulatory fine is triggered, and the reputational damage is done. In safety-critical industries like manufacturing or petrochemicals major sectors in Thailand, a safety failure can result in injury or death. No detective or corrective control can undo that outcome. For these risks, prevention is the only acceptable primary strategy.
4. It Shapes a Stronger Culture
The controls you emphasize send a message about your organization’s values. Heavy reliance on detective controls says: “We expect mistakes to happen and will catch them later.” A prevention-first approach says: “We design our work so mistakes are hard to make.”
This matters because of the fraud triangle fraud requires three conditions: pressure, rationalization, and opportunity. Preventive controls directly reduce opportunity by making fraud structurally difficult, regardless of an individual’s motivation. Detective controls only deter people who believe they will be caught a weaker defense.
5. Frameworks and Regulators Agree
The preference for prevention is supported by the major frameworks that guide internal control practice:
COSO (2013) places the control environment including integrity, ethics, and competence as the foundation of all controls. This foundation is inherently preventive.
J-SOX and SOX (applicable to subsidiaries of Japanese-listed and U.S.-listed companies operating in Thailand) require management to assess control design and effectiveness. Preventive controls that are well-designed typically receive higher assurance ratings than detective controls, because they address risks before they enter the financial statements.
The IIA’s International Professional Practices Framework emphasizes evaluating controls that address root causes not just symptoms. Detection, by definition, addresses symptoms.
You Still Need All Three
Prevention-first does not mean prevention-only. A strong control environment uses all three types in a clear order of priority:
| Priority 1 | Prevent Design processes so errors are hard to make. |
| Priority 2 | Detect Verify that prevention is working. Catch what slips through. |
| Priority 3 | Correct Fix what detection finds. Feed lessons back into prevention. |
Even the best preventive controls can fail. Detective controls (like reconciliations and audits) confirm that prevention is working. Corrective controls (like error correction procedures and incident response plans) ensure the organization can recover and learn when something does go wrong.
What Can You Do Today?
- Map your existing controls. Classify each one as preventive, detective, or corrective. Most organizations find they rely too heavily on detective controls like reconciliations and reviews.
- Focus on high-risk areas. Start prevention investment where errors carry the biggest impact: procurement, payroll, revenue recognition, and data handling.
- Automate where possible. System-enforced controls approval workflows, input validation, automated segregation of duties are more reliable than manual controls because they cannot be bypassed through carelessness or pressure.
- Build a feedback loop. Every time a detective control catches an error, ask: “Could a preventive control have stopped this?” If yes, build that preventive control. Over time, your prevention layer gets stronger.
The Bottom Line
Organizations that rely mostly on detection and correction are choosing to accept problems and deal with them afterward. That approach is slower, more expensive, and powerless against damage that cannot be reversed.
Organizations that invest in prevention first are choosing to design problems out of their processes from the start. They spend less on remediation, face fewer surprises, and build a culture where quality is built in not inspected in.
The guardrail is always cheaper than the ambulance. Build the guardrail first.
References
COSO. (2013). Internal Control, Integrated Framework.
The Institute of Internal Auditors (IIA). International Professional Practices Framework.
Financial Services Agency of Japan. Financial Instruments and Exchange Act (J-SOX).
U.S. SEC. Sarbanes-Oxley Act of 2002, Section 404.
Personal Data Protection Act B.E. 2562 (2019), Thailand.
We provides risk advisory and internal audit services to domestic and multinational organizations in Thailand. Our services include J-SOX/SOX internal control testing, internal audit outsourcing, SOP development, PDPA compliance, and enterprise risk management.