Why implement corrective controls on a financial system?

An organization has a new regulatory requirement to implement corrective controls on a financial system. Which of the following is the most likely reason for the new requirement?

To defend against insider threats altering banking details
To ensure that errors are not passed to other systems Source Reference Answer
To allow for business insurance to be purchased
To prevent unauthorized changes to financial data

Community Votes

75%

25%

75% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests the candidate's understanding of corrective controls versus preventive controls, with the common trap being confusing corrective (fix after the fact) with preventive (stop before it happens).

Corrective controls are designed to remediate and fix issues after they occur, preventing errors or incidents from propagating across interconnected systems. Community consensus strongly supports option B, emphasizing that corrective controls focus on containment and resolution rather than prevention.

Option D is the most common wrong answer because candidates confuse corrective controls with preventive controls; preventing unauthorized changes is a preventive control, not a corrective one.

Community Discussion (3 comments)

Nahidwin 👍 2 Selected: B

It says corrective the only option that matches with corrective is B

test_arrow 👍 4 Selected: B

B. To ensure that errors are not passed to other systems Explanation: ✔ Corrective controls are designed to identify and fix issues after they occur, ensuring that errors do not propagate to other systems. ✔ In a financial system, errors can lead to incorrect transactions, misstatements, or compliance violations. ✔ Regulatory requirements often mandate corrective controls to detect, log, and rectify mistakes before they cause widespread issues. Why not the other options? A. To defend against insider threats altering banking details – This relates more to preventive and detective controls rather than corrective controls. C. To allow for business insurance to be purchased – Compliance may influence insurance policies, but corrective controls are primarily implemented for operational and regulatory integrity. D. To prevent unauthorized changes to financial data – Preventing changes is a preventive control, whereas corrective controls focus on identifying and fixing errors post-occurrence.

AriGarcia 👍 2 Selected: D

Corrective controls in this context are designed to rectify errors or unauthorized modifications after they have occurred, ensuring the integrity and reliability of financial data. This aligns with regulatory goals to maintain accurate financial reporting and compliance with laws that protect against fraud, mismanagement, or other forms of financial data tampering.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Corrective controls are specifically designed to address and remediate issues after they have been identified, such as rolling back erroneous transactions or correcting data inconsistencies. Option B directly aligns with this definition by focusing on ensuring errors are not passed to downstream systems, which is a core corrective function. Regulatory frameworks often require corrective controls to maintain data integrity across interconnected financial platforms.

Why the Other Options Are Wrong

Option A describes a detective or preventive control aimed at insider threats, not a corrective action taken after an incident. Option C relates to risk transfer through insurance, which is a financial risk management strategy rather than a technical corrective control. Option D describes a preventive control designed to stop unauthorized changes before they occur, which is fundamentally different from corrective controls that act after the fact.

Community Comment Notes

Comment [1] correctly identifies that corrective controls focus on identifying and fixing issues to prevent error propagation, which is the key distinction. Comment [2] reinforces this by noting that among all options, only B truly matches the definition of corrective controls. Comment [3] incorrectly argues for D by conflating corrective controls with integrity protection, failing to recognize that preventing unauthorized changes is a preventive, not corrective, measure.

Official Reference

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf

Exam Strategy

When encountering control type questions, first identify whether the scenario describes an action taken before, during, or after an event. Preventive controls stop incidents before they occur, detective controls identify them as they happen, and corrective controls fix the aftermath—matching the control type to the timing is key to answering correctly.

Related Analysis

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide