Preventive, Detective and Corrective Controls for AI

Overview
Within the ISACA Advanced in AI Security Management (AAISM) body of knowledge, the domain AI Technologies and Controls expects candidates to understand how traditional control categories apply to artificial intelligence systems. The three classic control timings, preventive, detective and corrective, form the backbone of any AI security and risk program. This guide explains why this topic matters, what each control type means in an AI context, how the controls work together across the AI lifecycle, and how to reason through exam questions on the subject.

Why This Topic Is Important
AI systems introduce risks that conventional IT controls were not designed to handle: training data poisoning, prompt injection, model inversion, adversarial examples, model drift, hallucination, bias, and opaque decision-making. An AI security manager cannot rely on a single safeguard. ISACA emphasizes defense in depth, meaning layers of controls that operate at different points in time. Preventive controls stop problems before they occur, detective controls identify problems that slip through, and corrective controls restore the system and limit damage after an incident. Understanding this layering is essential for designing AI governance frameworks, mapping controls to risk registers, satisfying regulators (for example the EU AI Act, NIST AI RMF and ISO/IEC 42001), and demonstrating accountability to boards and auditors. On the exam, this topic also underpins many scenario questions because the examiner wants to see that you can classify a control correctly and select the most appropriate control for a given risk and lifecycle stage.

What the Three Control Types Are
1. Preventive controls are proactive measures designed to stop an undesirable event from happening in the first place. They are generally the most cost-effective because they avoid loss altogether. In AI, preventive controls include:
- Data governance and provenance verification before training (validating sources, lineage tracking, data quality gates)
- Secure development practices for models (secure coding, dependency scanning, model supply chain verification, signed model artifacts)
- Access control and least privilege for training data, model weights, feature stores and inference APIs
- Input validation, prompt filtering and content guardrails to block prompt injection or malicious inputs
- Adversarial training and robustness techniques that harden the model against manipulation
- Differential privacy, data minimization and anonymization to prevent leakage of personal data
- Policies, acceptable use standards, and staff training on responsible AI
- Model cards, impact assessments and approval gates before deployment
- Rate limiting and authentication on model endpoints to prevent extraction attacks

2. Detective controls identify and alert on undesirable events that have already occurred or are in progress. They do not stop the event but reduce the time to discovery. In AI, detective controls include:
- Model performance monitoring and drift detection (data drift, concept drift, accuracy degradation)
- Logging and auditing of training runs, model changes, prompts, outputs and API calls
- Anomaly detection on inference traffic to spot extraction or evasion attempts
- Bias and fairness monitoring across demographic groups in production
- Output monitoring for toxic, hallucinated or policy-violating content
- Red teaming, adversarial testing and penetration testing of deployed models
- Integrity checks and hashing of model files and datasets to detect tampering
- Human review sampling and user feedback channels
- Independent audits and compliance reviews

3. Corrective controls respond to a detected problem by restoring normal operation, fixing the root cause and limiting damage. In AI, corrective controls include:
- Model rollback to a previously validated version
- Retraining or fine-tuning with cleaned or updated data after poisoning or drift is discovered
- Patching vulnerabilities in model-serving infrastructure, libraries or pipelines
- Kill switches and circuit breakers that disable a model or route to a human fallback
- Incident response procedures specific to AI (containment, eradication, recovery, lessons learned)
- Updating guardrails, filters or prompts after a jailbreak is discovered
- Business continuity and disaster recovery plans covering AI services
- Remediation of biased outcomes, including notification, redress and model correction

Related Categories You May See
ISACA materials sometimes reference additional classifications. Deterrent controls discourage violations (warning banners, policies with sanctions). Compensating controls provide alternative protection when a primary control is not feasible (for example, enhanced human review when a model cannot be made fully explainable). Directive controls guide behavior through policies and procedures. On the exam, deterrent and directive controls are frequently grouped under preventive, so read the question stem carefully to see which taxonomy is being used.

How It Works: Controls Across the AI Lifecycle
Think of controls as operating along a timeline relative to a threat event:
Before the event - Preventive controls act here. Example: a data validation gate rejects an unverified dataset before training.
During or shortly after the event - Detective controls act here. Example: drift monitoring flags a sudden drop in accuracy after malicious data entered a retraining pipeline.
After detection - Corrective controls act here. Example: the team rolls back to the last known good model, purges the poisoned data and retrains.

A mature AI program maps these controls to each lifecycle phase:
- Design and data collection: preventive (data governance, privacy impact assessment), detective (data quality audits)
- Training and validation: preventive (secure pipelines, adversarial training), detective (bias testing, validation metrics), corrective (retraining)
- Deployment: preventive (access control, input filtering, approval gates), detective (logging, monitoring), corrective (rollback, kill switch)
- Operation and monitoring: detective (drift, anomaly, output monitoring), corrective (incident response, patching)
- Retirement: preventive (secure decommissioning of model weights and data)

The key principle is that no single category is sufficient. Preventive controls can fail or be bypassed, detective controls only tell you something went wrong, and corrective controls are useless without detection. The examiner expects you to recognize this interdependence and to favor a balanced, risk-based mix.

Classifying Controls: A Simple Test
When you encounter a control in a question, ask three questions:
1. Does it stop the bad thing from happening? If yes, it is preventive.
2. Does it tell you that the bad thing happened or is happening? If yes, it is detective.
3. Does it fix, recover or reduce the impact after the bad thing happened? If yes, it is corrective.
Be careful with controls that span categories. Monitoring is detective, but an automated response triggered by monitoring (for example auto-rollback) is corrective. Red teaming before deployment is often treated as detective because it finds weaknesses, even though it feeds into preventive hardening. Logging is detective, while the access control that restricts who can view logs is preventive.

Common Pitfalls
- Confusing monitoring (detective) with guardrails (preventive). Guardrails block; monitoring observes.
- Assuming retraining is always corrective. Scheduled retraining to keep a model current is preventive maintenance; retraining in response to a detected poisoning incident is corrective.
- Treating policies as detective. Policies are preventive or directive.
- Forgetting that human oversight can be any category depending on timing: pre-approval of outputs is preventive, sampling review is detective, overriding a wrong decision is corrective.
- Over-investing in one category. The exam rewards balanced, cost-effective portfolios aligned to risk appetite.

How to Answer Exam Questions on This Topic
AAISM questions are typically scenario based and ask for the best, most effective, first or primary answer. Use this approach:
1. Identify the risk or threat described (poisoning, drift, leakage, bias, extraction, injection).
2. Identify the lifecycle phase (data, training, deployment, operations).
3. Determine what the question is really asking: classify a control, select a control, or evaluate a control gap.
4. Apply the timing test above to each option.
5. Eliminate distractors that are technically correct but wrong category, wrong timing, or disproportionate to the risk.
6. Prefer the answer that reflects ISACA principles: risk-based, cost-effective, aligned to governance, with management accountability.

Worked Examples
Example 1: An organization discovers that a production model is producing increasingly inaccurate outputs. Which control type identified this issue? The answer is detective, specifically performance or drift monitoring. The fix (rollback or retraining) would be corrective, but the question asks what identified the issue.

Example 2: Which control is MOST effective at reducing the risk of training data poisoning? The best answer is a preventive control such as data provenance verification and access restrictions on the training pipeline. Hash-based integrity checks are detective, and retraining is corrective; they are valuable but do not best reduce the risk of occurrence.

Example 3: After a successful jailbreak of a customer-facing chatbot, what should the AI security manager do FIRST? The corrective priority is containment, such as activating a kill switch or disabling the affected feature, followed by root cause analysis and updating guardrails. Answers that focus on long-term policy revision are not the first step.

Example 4: A model cannot be made fully explainable due to its architecture, so the organization requires a human to review all high-impact decisions before they take effect. This is a compensating control that functions preventively because review occurs before the decision is acted upon.

Exam Tips: Answering Questions on Preventive, Detective and Corrective Controls for AI
- Anchor on timing. Before equals preventive, during or after discovery equals detective, after detection to fix equals corrective. This single rule resolves most classification questions.
- Read the verb in the question. Words like prevent, block, restrict, avoid and reduce likelihood point to preventive. Identify, monitor, log, alert, discover and audit point to detective. Restore, recover, remediate, rollback, retrain in response and contain point to corrective.
- Watch for qualifiers. MOST effective at reducing risk usually favors preventive. MOST effective at limiting impact favors detective plus corrective. FIRST action after an incident favors containment (corrective).
- Distinguish detection from response. If a control both detects and automatically responds, classify by the part the question emphasizes.
- Remember defense in depth. If an option proposes relying on a single control category, it is rarely the best answer. The exam favors layered control environments.
- Map to the AI lifecycle. Many questions hint at the phase. Data phase questions lean preventive, operations phase questions lean detective and corrective.
- Do not confuse control type with control nature. Technical, administrative and physical describe how a control is implemented; preventive, detective and corrective describe when it acts. A policy is administrative and preventive; a log review is administrative and detective; a firewall rule is technical and preventive.
- Think like a manager, not an engineer. AAISM tests governance judgment. When two options are both technically valid, choose the one that aligns to risk appetite, is cost-justified and supports accountability and audit evidence.
- Eliminate absolutes. Options promising to eliminate all risk or guarantee security are almost always distractors.
- Know the AI-specific examples cold. Expect to see drift monitoring, adversarial training, prompt filtering, model rollback, red teaming, data provenance, differential privacy and kill switches. Be able to classify each instantly.

Quick Reference Summary
Preventive: data governance, access control, input validation and guardrails, adversarial training, secure pipelines, privacy techniques, policies and training, approval gates, rate limiting.
Detective: drift and performance monitoring, logging and audit trails, anomaly detection, bias monitoring, output monitoring, red teaming and testing, integrity checks, audits.
Corrective: rollback, retraining after incident, patching, kill switches and fallback, incident response, guardrail updates, continuity and recovery, remediation and redress.

Master the timing test, memorize the AI-specific examples in each category, and always evaluate exam options through a risk-based, layered-defense lens. With these habits you will handle both direct classification questions and complex scenario questions on AI controls with confidence.