What are the three fundamental control types?

• A. Preventive, Detective, Corrective.
• B. Administrative, Technical, Physical.
• C. Compensating, Detective, Preventive.
• D. Reactive, Proactive, Administrative.

Answer: (A)

The main concept here is how controls are categorized by their action: prevention, detection, and correction. Preventive controls are designed to stop errors or unauthorized actions before they occur, such as strong access controls or input validation. Detective controls monitor for issues after they happen, enabling timely identification through logs, monitoring systems, and reconciliations. Corrective controls address the problem and restore normal operations, like backups and restoration, patching, or incident remediation.

This trio—preventive, detective, and corrective—captures the essential ways controls mitigate risk by preventing, identifying, and fixing issues. Other terms describe different aspects of control programs, such as administrative/technical/physical domains or compensating controls, but they do not constitute the fundamental three-type classification.