A controls matrix can be flawless on paper and still let a $1.2 million payroll scheme run for four years. The reason is usually the same: nobody above the scheme wanted to hear about it, and nobody below it could act without collusion.
Fraud controls split into two families by timing. Preventive controls act before the transaction, blocking the opportunity leg of the fraud triangle. Detective controls act after, surfacing what slipped through. The exam expects you to classify a control by when it operates, not by how strong it feels.
Tone at the top is the behavior senior management and the board actually model, not the ethics policy they publish. It is preventive because it attacks incentive and rationalization, the two fraud-triangle legs that segregation of duties cannot touch. An employee who sees the chief executive expense a personal vehicle has been handed a rationalization.
Tone at the top shows up in testable artifacts:
- Code of conduct: Written, distributed, and acknowledged annually, including by executives.
- Ethics training: Delivered to all levels, with completion tracked and exceptions escalated.
Common mistakes
- Calling a hotline preventive. It is detective. Its deterrent side effect does not reclassify it; the exam classifies by when the control operates.
- Answering "more segregation" after collusion. Collusion already defeated segregation. The correct response is rotation, mandatory vacation, or independent reconciliation.
- Accepting a performed reconciliation as effective. If the preparer also reviewed it, the control is null, exactly the $738,000 failure above.
Bottom line
- Preventive controls act before the transaction (tone at the top, segregation of duties, authority levels); detective controls act after (hotlines, reconciliations, supervisory reviews); corrective controls recover losses.
- The four incompatible functions are authorization, custody, recording, and reconciliation; holding any two enables fraud.
- Segregation of duties is defeated by collusion, so mandatory vacation, job rotation, and independent reconciliation are the standard compensating controls.
- Authority levels are dollar and category limits enforced in the system; structuring transactions just under a limit is the classic evasion pattern.
Exam shortcut
Classify first, then answer. Ask one question of every control in the options: does it operate before the transaction executes? Yes means preventive, no means detective. That single sort eliminates half the choices on most fraud-control stems. Stem signals to read fast: "two employees conspired" means collusion, so reject any segregation answer and pick rotation, mandatory vacation, or third-party reconciliation.
The full lesson (about 1,984 words, 13 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 4
Browse all free CIA Part 1 lessons or jump into free CIA Part 1 practice questions.