ACCT20007 Chap.4 Control Types and Assertions
Control Types and Assertions
Control classification depends on timing and purpose. Preventive controls narrow what may happen, detective controls compare independent evidence and corrective controls restore a reliable state.
This chapter connects those roles to occurrence, completeness, accuracy, valuation, rights and obligations, cut-off, classification and presentation without turning an answer into an assertion list.
Preventive controls act before or during processing. Authorisation, access restriction, segregation, approved master data and input validation can stop an unwanted transaction.
Their design must include a governed exception route, because staff will bypass rigid controls that cannot handle legitimate unusual work. Prevention therefore combines a rule with authority and evidence.
Detective controls operate after a deviation becomes observable. Reconciliations, exception reports, sequence checks, physical counts and log reviews compare independent populations.
They need an accountable reviewer, a clear threshold, timely investigation and documented resolution. Producing a report without ownership simply creates a list of known but untreated problems.
Corrective controls restore the record or process. They can reverse an error, reprocess a rejected transaction, recover from a reliable backup or change the root cause.
Corrections should preserve history so later reviewers can see the original, the reason and the authorised repair. Significant risks often need all three timings rather than one familiar control name.
Assertions provide a reporting lens. Fictitious events threaten occurrence, omitted events threaten completeness, wrong values threaten accuracy or valuation and wrong timing threatens cut-off.
Lead with the assertion most directly supported by the facts, then explain any secondary effect. Finish with a testable control sentence naming actor, evidence, timing, criterion, exception action and retained proof.
Control strength should match consequence and concealment opportunity.
A routine low-value difference may use authorised tolerance and review, while a bank-detail change needs independent verification before payment.
Consider collusion and compromised credentials without claiming that one control removes all risk.
Independent channels, retained history and outside review reduce reliance on a single actor and make residual exposure visible.
Operating effectiveness is separate from design. A well-described reconciliation fails if it is late, incomplete or not investigated. State frequency, population, reviewer and evidence of exception clearance.
Where the control is automated, include configuration and change authority.
A reliable rule today can fail after a threshold, interface or program is altered without approval and testing.
Preventive design should not force staff to choose between compliance and completing essential work. A controlled override with stronger approval, reason and later review is safer than an unofficial bypass.
Corrective action should address the affected population.
If one bank change redirected several payments, reversing a single entry is insufficient; linked transactions and credentials also need investigation.
For revision, write each response in two linked sentences. The first identifies the leading assertion and explains the misstatement direction or process consequence. The second specifies actor, timing, independent evidence, criterion, exception action and retained proof.
Finally label the control preventive, detective or corrective from what it actually does, and note the remaining exposure that another control must address.
What this chapter covers
- 01
Preventive controls
- 02
Detective controls
- 03
Corrective controls
- 04
Control evidence
- 05
Financial statement assertions
- 06
Exception ownership
Worked example · free
Layer supplier-master controls
- 1Separate master maintenance from invoice approval.
- 2Verify bank changes independently using established contact details.
- 2Send a complete change report to an independent reviewer and retain resolution.
- 1Freeze and investigate affected suppliers when exceptions arise.
Key terms
- Preventive Control
- A preventive control acts before or during processing to stop a risky event.
- Detective Control
- A detective control reveals an exception through independent comparison or review.
- Corrective Control
- A corrective control repairs the record and root cause after detection.
Control Types and Assertions FAQ
Can one risk need all three control types?
Yes. Access restrictions may prevent common errors, reconciliation may detect residual exceptions and a governed correction may restore the record and process. Explain the distinct timing and purpose of each rather than naming three controls that perform the same function.
Why is an exception report sometimes ineffective?
Producing a report does not establish review or follow-up. An effective detective control needs a complete population, clear threshold, independent owner, timely investigation, documented resolution and escalation for unresolved items. Missing any of these features can leave exceptions visible but untreated.
How should assertions be used in an answer?
Choose the assertion closest to the fact pattern and explain the connection. A fictitious payment threatens occurrence, a missing transaction threatens completeness and a wrong amount threatens accuracy or valuation. Secondary assertions can be added after the primary one is justified.
Exam move
Draw a timeline around each risk and place possible controls before, after and during correction. Rewrite vague controls into a sentence that names actor, evidence, timing, criterion, action and retained proof. Then select the closest statement assertion and explain why it is threatened.
Working through Control Types and Assertions in ACCT20007? Sia is AskSia’s AI Accounting tutor — ask any ACCT20007 Control Types and Assertions question and get a clear, step-by-step explanation grounded in how ACCT20007 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.
