Official Site of The State of New Jersey

Internal controls are the processes and safeguards that help prevent errors, protect resources, and keep operations running effectively. The goal of an internal control system is to mitigate risk from fraud, errors, and loss while supporting organizational objectives. Managers and staff execute these internal controls as part of routine processes. 

There are three main types of internal controls – preventive, detective, and corrective. Each serves a distinct purpose and is equally important.

1. Preventive Controls - Stop Problems Before They Start

Preventive controls are designed to reduce the likelihood that errors, fraud, or other issues occur in the first place. They are proactive and built into processes to act as the first line of defense.

Examples include:

• Approval Requirements - Authorization before transactions are finalized.
• Segregation of Duties - Ensuring no single individual has control over all phases of a transaction.
• Access Restrictions - Limiting system permissions based on job necessity.

2. Detective Controls - Identify Problems After They Occur

Detective controls help identify issues after they happen. They help organizations determine whether processes are working as intended and identify risks that may need attention.

Examples include:

• Reconciliations: Comparing different data sets to ensure accuracy (e.g., bank statements).
• Exception Reporting: Automated flags for unusual or high-risk activity.
• Management Reviews: Periodic oversight of performance metrics and reports.

3. Corrective Controls - Fix and Prevent Recurrence of Problems

Corrective controls come into play once an issue has been identified. Their focus is not only on fixing the issue, but also on preventing it from happening again by addressing root causes.

Examples include:

• Policy Updates - Revising procedures to close gaps.
• Follow-Up Monitoring - Verifying corrective actions were implemented.
• Additional Staff Training - Ensuring teams understand new or existing protocols.

Internal Audit does not fall within any of these internal control categories. Instead, Internal Audit evaluates whether preventive, detective, and corrective controls exist where needed, are appropriately designed, and are operating effectively. Internal Audit provides an independent and objective assessment of the organization’s overall control framework.

While internal controls are embedded within daily operations and executed by management and staff, Internal Audit functions independently from those activities. This independence allows Internal Audit to objectively assess risks, identify control gaps, evaluate governance processes, and provide recommendations for improvement.

By remaining separate from day-to-day control activities, Internal Audit strengthens organizational oversight and accountability. Ultimately, Internal Audit provides assurance that risks are being managed appropriately, controls are functioning as intended, and opportunities for improvement are identified before issues become larger problems.

An agency purchases goods from an outside vendor. Requiring supervisory approvals before the purchase is made is a preventive control. Before the payment is processed, accounting staff reconcile the purchase order, vendor invoice, and receiving records as a detective control. When discrepancies are identified, actions taken to correct them are a corrective control.

Internal Audit assesses whether these controls are functioning effectively throughout the process.

A well-functioning organization does not simply implement controls; it understands how preventative, detective, and corrective controls work together, and how Internal Audit provides assurance within the overall governance structure. 

Consider the following in your organization:

• Do the preventive, detective, and corrective controls operate together as an integrated system?
• Are control responsibilities clearly owned within the organization?
• Is Internal Audit positioned to evaluate controls rather than perform them?

To learn more or discuss your organization’s approach, contact EACO at EACO@osc.nj.gov.