Fundamentals of Risk Management

TAbLE 
16.1
Description of types of hazard controls
1
Preventive 
(terminate)
These controls are designed to limit the possibility of an 
undesirable outcome being realized. The more important
it is to stop an undesirable outcome, then the more 
important it is to implement appropriate preventive controls.
2
Corrective
(treat)
These controls are designed to limit the scope for loss 
and reduce any undesirable outcomes that have been 
realized. They may also provide a route of recourse to 
achieve some recovery against loss or damage.
3
Directive
(transfer)
These controls are designed to ensure that a particular 
outcome is achieved. They are based on giving directions 
to people on how to ensure that losses do not occur.
They are important, but depend on people following 
established safe systems of work.
4
Detective
(tolerate)
These controls are designed to identify occasions when 
undesirable outcomes have been realized. Their effect is, 
by definition, ‘after the event’ so they are only appropriate 
when it is possible to accept that the loss or damage has 
occurred.

---

Risk response
188
arises. Sometimes crisis management will involve the use of alternative facilities
that have been put in place before the crisis arose. It could be argued that these are 
corrective controls.
In all cases, crisis management will involve directions to the involved parties as to 
how they should behave if the crisis arises. It could be argued that these are directive 
controls. Normally, detective controls relate to identification of circumstances where 
a risk has materialized at a fairly low level with limited impact and consequences. 
Clearly, DRP and BCP relate to circumstances where risks have materialized at crisis 
level. Therefore, it is inappropriate to classify DRP and BCP as detective controls.
The bow-tie representation of the risk management process is a convenient way of 
illustrating the role of the four types of controls. Preventive controls are relevant to 
actions that are taken before the event occurs. The nature of detective controls means 
that they relate to circumstances after the event has occurred. Corrective and directive 
controls can be relevant to loss prevention, damage limitation and cost containment. 
These are the three phases of loss control. The relevance of the types of controls