Give Each Control a Purpose
A preventive control tries to stop an unwanted event before it happens. A detective control identifies an event or discrepancy. A corrective control addresses what was found and its cause. A process often needs all three, with clear owners and evidence. A policy document alone does not show that any control operated.
Read the procurement policy discussion for the surrounding purchase process. This page follows one fictional purchase rather than supplying a universal approval matrix.
Trace One Fictional Payment
An invented NGO orders materials for 800 currency units. Its internal procedure requires an authorized order, confirmation of receipt, an invoice match and separate payment authorization. A supplier sends an invoice for 880. No tax, exchange-rate or contract explanation for the extra 80 is provided in the exercise.
| Point in the Cycle | Example Control and Purpose | Evidence and Owner |
|---|---|---|
| Before ordering | Check need, budget and authorized order to prevent unauthorized commitment | Approved order retained by purchasing role |
| Before payment | Match invoice with order and goods receipt to prevent an unsupported payment | Dated match and exception decision by a role with appropriate authority |
| After posting/payment | Reconcile ledger, bank and supplier records to detect an unexplained difference | Reconciliation and separate reviewer record |
| After an exception | Investigate, obtain authorized correction and fix the process cause | Traceable correction, responsible owner and follow-up |
The 80 difference is a question, not automatically fraud or an error. The reviewer first checks the order, invoice and goods receipt. If an authorized price change exists, record it. If goods or authority are missing, do not invent their existence to clear the exception.
Distinguish Absence, Failure and Missing Evidence
A missing control means the required check has not been designed or assigned. A failed control means a specified check did not operate as intended. An incomplete record means the reviewer cannot establish what happened from available evidence. These diagnoses can overlap, but they are not interchangeable.
Suppose no invoice-matching step exists: that is a design gap. Suppose matching is required but an identified reviewer paid 880 without doing it: that is a demonstrated execution failure. Suppose a reviewer says a match occurred but no supporting record can be located: the operation is unverified until evidence is investigated. A missing signature does not, on its own, prove the goods were absent or the payment dishonest.
Correct the Cause Without Erasing the Trail
If the extra 80 is confirmed as an erroneous invoice and remains unpaid, the supplier can issue a corrected invoice under the relevant procedure. If already paid, responsible finance and contract owners determine the proper recovery, credit or other response. Preserve the original transaction and authorized correction trail. Changing a spreadsheet number to make totals agree is not a control.
A tiny team may lack enough people for ideal separation. That does not make self-approval safe; accountable owners need a proportionate permitted arrangement, perhaps independent review or stronger restrictions. Collusion, override and poor source records can defeat multiple controls. Do not claim a checklist eliminates risk.
Continue with reconciliation diagnosis and audit, examination and internal review.
Sources and Limits
CC8, November 2024, sections 2.6-2.7, 4.1 and 6.1, gives England and Wales control guidance. GovS 015 grants guidance, September 2026, Controls paragraphs 39-42, names preventive, detective and corrective purposes among others. Its requirements apply to specified UK government general grants, not all NGOs. Consulted October 29, 2026. The purchase and proposed responses are fictional teaching, not authorization or accounting/legal advice.