PERDIZO, MILJANE P.

BSA III

The Preventive–Detective–Corrective Internal Control Model

It illustrates that the internal control shield is composed of three levels of control:
preventive controls, detective controls, and corrective controls. This is the preventive–detective–
corrective (PDC) control model.
PREVENTIVE CONTROLS. Prevention is the first line of defense in the control structure.
Preventive controls are passive techniques designed to reduce the frequency of occurrence of
undesirable events. Preventive controls force compliance with prescribed or desired actions and
thus screen out aberrant events. When designing internal control systems, an ounce of prevention
is most certainly worth a pound of cure. Preventing errors and fraud is far more cost-effective
than detecting and correcting problems after they occur. The vast majority of undesirable events
can be blocked at this first level. For example, a well- designed source document is an example
of a preventive control. The logical layout of the document into zones that contain specific data,
such as customer name, address, items sold, and quantity, forces the clerk to enter the necessary
data. The source documents can therefore prevent necessary data from being omit- ted. However,
not all problems can be anticipated and prevented. Some will elude the most comprehen- sive
network of preventive controls.

DETECTIVE CONTROLS. Detective controls form the second line of defense. These are
devices, techniques, and procedures designed to identify and expose undesirable events that
elude preventive controls. Detective controls reveal specific types of errors by comparing actual
occurrences to pre-established standards. When the detective control identifies a departure from
standard, it sounds an alarm to attract

attention to the problem. For example, assume a clerk entered the following data on a customer
sales order:

Quantity Price Total

10 $10 $1,000

Before processing this transaction and posting to the accounts, a detective control should
recalculate the total value using the price and quantity. Thus, the error in total price would be
detected.

CORRECTIVE CONTROLS. Corrective controls are actions taken to reverse the effects of
errors detected in the previous step. There is an important distinction between detective controls
and corrective controls. Detective controls identify anomalies and draw attention to them;
corrective controls actually fix the problem. For any detected error, however, there may be more
than one feasible corrective action, but the best course of action may not always be obvious. For
example, in viewing the error above, your first inclination may have been to change the total
value from $1,000 to $100 to correct the problem. This presumes that the quantity and price
values on the document are correct; they may not be. At this point, we cannot determine the real
cause of the problem; we know only that one exists.