Preventive, Detective and Corrective AI Controls

1. Why This Topic Matters

Controls are the mechanism through which an AI risk program actually changes outcomes. Identifying and assessing AI risk is only valuable if the organization can reduce the likelihood of an undesirable event, discover it quickly when it occurs, and restore normal, safe operation afterward. In the ISACA Advanced in AI Risk (AAIR) body of knowledge, the AI Risk Program Management domain expects you to understand how controls are selected, layered, implemented, monitored and reported. The preventive / detective / corrective classification is the foundational vocabulary used to do this.

The topic is especially important for AI systems for several reasons:

• AI failures are often silent. A model can drift, become biased, or be manipulated through prompt injection or data poisoning without producing an obvious error. This makes detective controls far more critical than they are in deterministic software.
• Harm can scale quickly. An AI decision engine may make thousands of decisions per minute, so the window between a failure starting and a failure causing material harm is short. Timely detection and rapid correction are essential.
• Regulators expect demonstrable control. Frameworks such as the EU AI Act, the NIST AI Risk Management Framework, ISO/IEC 42001 and ISO/IEC 23894 all require organizations to show risk treatment, monitoring and incident handling. Those requirements map directly onto preventive, detective and corrective controls.
• No single control is sufficient. The exam repeatedly tests the principle of defense in depth: a balanced portfolio of control types is needed because every preventive control can be bypassed, every detective control has latency, and every corrective control is only useful once something has already gone wrong.

If you understand how these three categories complement each other, you can answer a large portion of control-related scenario questions in the AAIR exam.

2. What It Is: Defining the Three Control Categories

A control is any policy, procedure, practice, technical mechanism or organizational structure designed to provide reasonable assurance that objectives are achieved and undesirable events are prevented, detected or corrected. Controls are classified by their timing relative to the risk event:

Preventive controls act before an event occurs. Their purpose is to stop an error, failure, misuse or attack from happening at all, or to make it significantly less likely. They reduce the likelihood of a risk.

Detective controls act during or after an event to identify that something has gone wrong, is going wrong, or is about to go wrong. They do not stop the event; they make it visible so that someone or something can respond. Detective controls reduce the time to discovery and therefore limit the duration and spread of impact.

Corrective controls act after an event has been detected. Their purpose is to limit damage, restore the system to a known-good state, and prevent recurrence. They reduce the impact of a risk and often feed lessons learned back into preventive controls.

Two related categories frequently appear alongside these three and are worth knowing:

• Deterrent controls discourage a threat actor from attempting an action (for example, visible acceptable-use warnings or logged accountability). Many frameworks fold these into preventive controls.
• Compensating controls are alternative controls used when the primary or ideal control is not feasible. A compensating control can itself be preventive, detective or corrective.

You should also distinguish the timing classification (preventive / detective / corrective) from the nature classification (administrative, technical and physical) and from the function classification (manual versus automated). A single control can be described on all three axes; for example, an automated bias-threshold alert is a technical, automated, detective control.

3. AI-Specific Examples of Each Control Type

Preventive AI controls
• AI acceptable use policy and prohibited use cases
• Risk tiering and mandatory impact assessments before development or procurement
• Data governance: provenance checks, consent verification, data quality gates, de-identification before training
• Secure model development practices, adversarial robustness testing and red teaming prior to release
• Pre-deployment fairness and bias testing with defined go / no-go thresholds
• Input validation, prompt filtering and guardrails on generative AI systems
• Access controls on training data, model weights, pipelines and APIs; segregation of duties between data scientists, validators and deployers
• Model validation by an independent second line before production approval
• Vendor due diligence and contractual requirements for third-party AI
• Training and awareness for developers, users and decision-makers
• Human-in-the-loop approval gates for high-stakes decisions

Detective AI controls
• Continuous performance monitoring against baseline metrics (accuracy, precision, recall, error rates)
• Data drift and concept drift detection
• Ongoing fairness monitoring across protected groups in production
• Logging of inputs, outputs, confidence scores and human overrides, with audit trails
• Anomaly detection on model behavior, usage patterns and API traffic
• Hallucination, toxicity and policy-violation scanning on generative outputs
• Key Risk Indicators (KRIs) and dashboards reported to AI governance committees
• User feedback and complaint channels, including appeal mechanisms
• Internal audit and independent model review
• Shadow AI discovery tools that identify unapproved AI usage
• Reconciliation and sampling of AI decisions against human judgment

Corrective AI controls
• AI incident response plan and playbooks
• Kill switches, circuit breakers and the ability to disable or throttle a model
• Model rollback to a previously validated version
• Fallback to rule-based processing or manual human processing
• Retraining, fine-tuning or recalibration when drift or bias is confirmed
• Reversal or remediation of harmful automated decisions and customer notification
• Root cause analysis and post-incident review, with updates to the risk register
• Regulatory and stakeholder breach or incident notification
• Backup and recovery of models, datasets and pipelines
• Updating policies, thresholds and training based on lessons learned

4. How It Works: Applying the Control Types in an AI Risk Program

4.1 The control cycle
The three categories form a continuous loop. Preventive controls reduce likelihood. When they fail or are bypassed, detective controls surface the event. Corrective controls then contain and remediate, and the root cause analysis produces new or strengthened preventive controls. A mature AI risk program treats this as a cycle, not three disconnected lists.

4.2 Linking controls to risk response
In ISACA risk terminology, risk responses are avoid, mitigate (reduce), transfer (share) and accept. Controls are the primary means of mitigation. Preventive controls mainly reduce likelihood; detective and corrective controls mainly reduce impact by shortening the time the event persists and limiting its consequences. When a question asks how to bring residual risk within appetite, the answer is usually a combination of control types, not just one.

4.3 Mapping controls to the AI lifecycle
• Plan and design: predominantly preventive (use case approval, impact assessment, requirements for explainability and fairness)
• Data collection and preparation: preventive (provenance, quality, consent) with some detective (data profiling, anomaly checks)
• Build and validate: preventive (testing, red teaming, independent validation)
• Deploy: preventive (change management, approval gates) and detective (baseline capture)
• Operate and monitor: predominantly detective (drift, performance, fairness, logging) with corrective readiness (incident plans, rollback)
• Retire: corrective and preventive (decommissioning, data disposal, replacement validation)

4.4 Defense in depth and control balance
Because AI models are probabilistic, preventive controls cannot guarantee correct output. The program must therefore invest proportionally in detection and correction. A common exam theme is an organization that has strong pre-deployment testing but no production monitoring; the correct recommendation is almost always to add detective controls, because the preventive control cannot catch post-deployment drift.

4.5 Control selection and cost-benefit
Control selection should be driven by the risk assessment, the organization's risk appetite, legal obligations and cost-effectiveness. Preventive controls are generally considered the most cost-effective because they avoid the cost of an incident altogether; however, they can impede innovation if excessive. Detective controls carry ongoing operational cost and depend on timely response to be useful. Corrective controls are the most expensive per use but are indispensable for high-impact scenarios. The goal is a proportionate, risk-based mix.

4.6 Key controls, automation and monitoring
A key control is one whose failure would materially increase risk and that is relied upon for assurance. Automated controls are generally more reliable and consistent than manual ones, which is why AI risk programs push for automated monitoring and automated circuit breakers. Control effectiveness itself must be tested and reported, typically through KRIs, control self-assessments and independent audit.

4.7 Roles and the three lines
• First line (AI product owners, data scientists, operations) designs and operates most controls.
• Second line (AI risk, compliance, model risk management) sets control requirements, independently validates and monitors.
• Third line (internal audit) provides independent assurance on control design and operating effectiveness.
Exam questions may ask who is accountable for a control; the answer is typically the risk or control owner in the first line, with oversight from the second line.

5. How to Answer Exam Questions on This Topic

Step 1: Apply the timing test. Ask: when does this control act relative to the bad event? Before = preventive. Discovers it = detective. Fixes or recovers from it = corrective. This single test resolves most classification questions.

Step 2: Watch for signal words.
• Preventive: prevent, prohibit, block, authorize, approve, validate before, restrict, segregate, train, require, filter, gate
• Detective: monitor, log, alert, audit, review, reconcile, detect, identify, report, dashboard, KRI, flag
• Corrective: respond, remediate, restore, rollback, retrain, recover, disable, fix, notify, lessons learned, root cause

Step 3: Read the question stem carefully. Distinguish between what type of control is this (classification), which control is MOST important or BEST (judgment), and what is missing (gap analysis). For gap questions, identify which of the three categories is absent in the scenario.

Step 4: Apply ISACA judgment principles. Prefer answers that are risk-based, proportionate, aligned to business objectives, and that address root cause rather than symptoms. Prefer preventive over detective when both are feasible and cost-effective, but prefer detective when the scenario involves post-deployment behavior that prevention cannot address.

Step 5: Eliminate distractors. Common distractors include controls that are the wrong timing category, controls that address a different risk than the one in the scenario, responses that are technically true but not the BEST or FIRST action, and answers that accept risk without justification.

6. Exam Tips: Answering Questions on Preventive, Detective and Corrective AI Controls

Tip 1: Logging is detective, not preventive. A log does not stop anything; it enables discovery and investigation. Many candidates mistakenly choose logging as a preventive measure.

Tip 2: Testing before deployment is preventive; monitoring after deployment is detective. The same metric (for example, a fairness measure) can be a preventive control when used as a release gate and a detective control when tracked in production. Timing determines the category.

Tip 3: A kill switch is corrective. Even though it is implemented in advance, it is activated after a problem is detected to limit impact. Likewise, rollback, retraining and fallback to manual processing are corrective.

Tip 4: Human-in-the-loop can be any type. A human approving a decision before it is executed is preventive; a human reviewing a sample of decisions afterward is detective; a human reversing a harmful decision is corrective. Read the scenario to see when the human acts.

Tip 5: When a scenario describes silent failure (drift, bias emerging over time, hallucination), the gap is usually detective. Preventive controls cannot see changes that happen after deployment.

Tip 6: When a scenario describes a confirmed incident, the FIRST action is corrective containment, such as disabling or isolating the model, followed by root cause analysis and then improvement of preventive controls. Do not jump to retraining before containing harm.

Tip 7: Root cause analysis and lessons learned are corrective, but their output (updated policies, new thresholds) becomes preventive. If a question asks how to prevent recurrence, look for the answer that changes the preventive control, not one that merely restores service.

Tip 8: Policies, training and awareness are preventive administrative controls. Internal audit and independent review are detective controls.

Tip 9: Balance beats strength. If asked about the MOST effective overall approach, choose the answer that reflects a layered combination of preventive, detective and corrective controls aligned to risk appetite, rather than maximizing a single type.

Tip 10: Residual risk language. Preventive controls primarily lower likelihood; detective and corrective controls primarily lower impact. Use this when a question asks which control reduces which component of risk.

Tip 11: Compensating controls are a category of purpose, not timing. If the ideal preventive control is infeasible, a detective compensating control plus a corrective response may be an acceptable answer, provided residual risk stays within appetite.

Tip 12: Think like a risk manager, not an engineer. The AAIR exam values governance, accountability, documentation and proportionality. Answers that embed controls in an ongoing program with ownership and reporting are generally preferred over isolated technical fixes.

7. Practice Questions

Question 1. An organization requires all machine learning models to pass an independent bias assessment against defined thresholds before being approved for production. This is BEST classified as which type of control?
A. Detective
B. Corrective
C. Preventive
D. Compensating
Answer: C. The assessment occurs before deployment and acts as a gate that stops a biased model from entering production. It reduces the likelihood of harm, which is the defining characteristic of a preventive control.

Question 2. A credit decisioning model has been in production for eight months. Management is confident in the pre-deployment testing but has recently received customer complaints suggesting inconsistent outcomes. Which control is MOST likely missing?
A. Stronger access controls on training data
B. Continuous monitoring of model performance and fairness in production
C. Additional pre-deployment red teaming
D. A documented AI acceptable use policy
Answer: B. The scenario describes a post-deployment problem that preventive testing cannot catch. The gap is detective: ongoing monitoring that would have surfaced drift or emerging bias before customers noticed.

Question 3. Monitoring has confirmed that a generative AI assistant is producing outputs that disclose confidential information. What should the AI risk team do FIRST?
A. Retrain the model on a sanitized dataset
B. Update the acceptable use policy
C. Disable or restrict the assistant to contain the exposure
D. Perform a root cause analysis
Answer: C. Once an incident is confirmed, the first corrective priority is containment to stop ongoing harm. Root cause analysis, retraining and policy updates follow.

Question 4. Which of the following BEST describes the primary purpose of maintaining a complete audit log of AI model inputs, outputs and human overrides?
A. To prevent unauthorized model use
B. To enable detection and investigation of anomalous or harmful behavior
C. To automatically correct erroneous outputs
D. To eliminate the need for human review
Answer: B. Logging is a detective control that supports monitoring, investigation and accountability. It does not by itself prevent or correct anything.

Question 5. An organization cannot implement real-time input filtering on a third-party AI service because the vendor does not support it. Which approach BEST addresses the resulting risk?
A. Accept the risk without further action
B. Implement output monitoring with alerting and a documented response procedure as compensating controls
C. Discontinue all third-party AI use
D. Rely on the vendor's assurance that the service is safe
Answer: B. When the ideal preventive control is infeasible, a combination of detective (monitoring and alerting) and corrective (response procedure) compensating controls is the appropriate risk-based response, provided residual risk remains within appetite.

8. Quick Recap

• Preventive = before the event, reduces likelihood. Examples: policies, approval gates, pre-deployment testing, access controls, input guardrails, training.
• Detective = identifies the event, reduces time to discovery. Examples: monitoring, drift detection, logging, audits, KRIs, complaint channels.
• Corrective = after detection, reduces impact and prevents recurrence. Examples: incident response, kill switch, rollback, retraining, fallback, root cause analysis.
• Use the timing test and signal words to classify.
• For silent AI failures, the missing control is usually detective; for confirmed incidents, the first action is corrective containment; for preventing recurrence, strengthen preventive controls.
• The AAIR exam rewards a balanced, risk-based, layered control portfolio with clear ownership, monitoring and reporting, integrated across the entire AI lifecycle.