Plain definition
A detective control looks for an error, irregularity, or failed preventive control after the fact or after an attempt. Reconciliations, exception reports, management reviews, and inventory counts are common examples. Its value depends on how quickly it is performed, who investigates the exception, and whether the response is completed.
It does not stop the original event. It produces evidence that something needs attention. A monthly review may be suitable for a low-risk balance, while a daily payment exception may need same-day investigation because the opportunity to stop or recover money disappears quickly.
Illustrative example
Suppose a bank-reconciliation analyst matches the payment file to the bank statement and finds two payments for one supplier invoice. The analyst records the exception, pauses the supplier’s next payment run, and gives the duplicate references to treasury. Treasury asks the bank whether a recall is possible; the controller corrects the ledger and investigates whether a file import created the duplication.
The reconciliation did not prevent the duplicate payment. It made the problem visible while the company still had a practical chance to contain the loss and stop the same cause from affecting more payments.
A report that nobody reviews is not a working detective control. Ageing exceptions and missed reviews are evidence about the control itself.
Why it matters
It finds risks that a preventive check cannot remove, including system defects, later changes, and deliberate circumvention.
It prevents management from mistaking an unexplained cash difference for a routine collection problem or a harmless timing item.
Practical consequence
Set the review frequency from the risk and the time available to act, then name an investigator and completion date for each exception.
Review whether repeat findings should lead to a preventive block or a corrective change, rather than simply closing the same alert every period.