Controls get classified along several axes at once, and each classification changes what "working" means and what evidence proves it. Understanding the axes is what lets you build a control set with no blind spots - and explain it credibly to an auditor.
By function: preventive, detective, corrective
- Preventive stops something happening. MFA, firewall rules, input validation, segregation of duties, encryption. Evidence is usually configuration.
- Detective identifies that something happened. Logging and alerting, access reviews, reconciliations, vulnerability scanning, anomaly detection. Evidence is usually output plus proof someone looked at it.
- Corrective restores after the fact. Backups and recovery, incident response, patching, disciplinary processes. Evidence is usually a test or a real event with a record.
Also referenced in some frameworks: deterrent controls (warning banners, visible cameras) and compensating controls, which substitute for a required control you cannot implement.
The practical value of this axis is spotting imbalance. Programmes skew heavily preventive because prevention feels like security. But if you cannot detect a failure and cannot recover from it, one bypassed preventive control becomes an unbounded incident.
By nature: administrative, technical, physical
- Administrative - policies, procedures, training, background checks, risk assessment. People and process.
- Technical - the controls implemented in systems: authentication, encryption, logging, network segmentation.
- Physical - locks, badges, cameras, environmental protections, secure disposal.
HIPAA uses exactly this split for its safeguards, and most frameworks cover all three even when they do not name them this way. Physical is the one most often under-evidenced by cloud-native organisations, who assume it is entirely their provider's problem - it is not, for offices and endpoints.
See your control coverage across every axis
GRC Copilot maps your controls by function and type, links each to evidence, and shows where coverage is thin before an auditor points it out.
Try GRC Copilot free Generate an AI-powered assessment Download checklist Book a demo
Design versus operating effectiveness
This is the distinction that decides how you are tested, and the one most often misunderstood:
- Design effectiveness - if the control operated as described, would it achieve its objective? A control can be well designed and never actually run.
- Operating effectiveness - did it actually operate, consistently, throughout the period?
A SOC 2 Type I tests design at a point in time. A Type II tests operation across a window. ISO 27001 Stage 1 leans toward design; Stage 2 toward operation.
The evidence differs accordingly. Design evidence is the documented process and configuration. Operating evidence is the population of instances across the period - every access review performed, every change approved, every scan run.
Frequency: continuous, periodic, event-driven
- Continuous controls run automatically and constantly - encryption, firewall enforcement. Sampling is easy; a snapshot of configuration usually suffices.
- Periodic controls run on a schedule - quarterly access reviews, annual training. Auditors check whether every occurrence in the period happened, on time.
- Event-driven controls trigger on something - offboarding, incident response, change approval. Auditors take the population of events and sample.
Periodic controls generate the most findings, because a missed quarter is unrecoverable. Automating the reminder and the record is worth more than automating the control itself.
Compensating controls
When a required control is genuinely not feasible, a compensating control can substitute - but only with three things documented: the constraint preventing the original, why the alternative provides equivalent protection, and approval by someone with authority. PCI DSS is the most explicit about this; most frameworks accept the principle.
An undocumented workaround is not a compensating control. It is a gap.
Frequently asked questions
Which control type is most important?
Balance matters more than any single type. A programme with strong prevention, no detection and untested recovery fails badly the first time prevention is bypassed.
Why do auditors care about design and operation separately?
Because they fail differently. A poorly designed control never works; a well-designed one can simply not be performed. Both are findings, with different remediation.
Can one control be several types?
Yes, commonly. Access review is administrative in nature, detective in function, and periodic in frequency. The axes are independent.
How many controls should we have?
As many as your risks require and you can genuinely operate. A smaller set that all work beats a large set where half are aspirational - auditors sample, and unoperated controls surface quickly.
Key takeaways
- Function (preventive/detective/corrective) reveals coverage imbalance.
- Nature (administrative/technical/physical) reveals whole categories left out.
- Design and operating effectiveness are tested differently and need different evidence.
- Periodic controls cause the most findings - automate the reminder and the record.