Which term describes an internal control used to avoid undesirable events that could have a negative material effect on a process?

Which term describes an internal control used to avoid undesirable events that could have a negative material effect on a process?

• A. IT risk register
• B. Preventive control
• C. Qualitative risk analysis
• D. Risk analysis

Answer: (B)

Preventive controls are designed to stop problems before they occur, reducing the likelihood that an undesirable event will happen and cause material damage to a process. This proactive approach fits the idea of an internal control used to avoid negative outcomes, with examples such as access controls to prevent unauthorized actions, input validation to catch errors before processing, and separation of duties to reduce opportunities for fraud. In contrast, an IT risk register is simply a record of risks, not a control; qualitative risk analysis and risk analysis are methods for assessing risk, not mechanisms that prevent harm. So the term described is preventive control.