Skip to main content
Governance Authority
Category: Privacy and Cybersecurity

Detect

Also known as: Detection, Detective activity
Simply put

To detect means to discover or notice the presence of something that is hidden, unclear, or not otherwise obvious, often by using a special method, equipment, or investigation. In a governance, risk, and compliance setting, the term generally refers to identifying issues, errors, or misconduct that have already occurred or are underway.

Formal definition

In general usage, to detect is to discover or observe the existence of something partly hidden or not clearly apparent, typically through a deliberate method, test, or investigation rather than by chance. Within governance, risk, and compliance practice, 'detect' commonly describes the class of activity aimed at identifying events, control failures, or noncompliance after they have begun, and is generally distinguished from preventive activity intended to stop such events from occurring. The precise application of the term depends on the framework, control taxonomy, and context in use, and this entry addresses the word's general meaning rather than any single defined regulatory or framework term.

Why it matters

In governance, risk, and compliance practice, detection is one of the core lines of protection against issues that preventive measures fail to stop. No control environment eliminates every error, control failure, or instance of misconduct at the point of occurrence, so the capacity to discover problems that are already underway or have already happened is generally what limits the duration and severity of harm. Detective activity is what surfaces the issue so it can be escalated, investigated, and remediated.

Because detection concerns identifying something that is partly hidden or not otherwise apparent, its effectiveness typically depends on deliberate methods, tests, or investigation rather than chance discovery. A weak detection capability can allow problems to persist and compound before anyone notices, while a well-designed one shortens the window between an event and its identification. This is why detective activity is generally treated as complementary to, not a substitute for, preventive activity.

This entry addresses the general meaning of the word rather than any single defined regulatory or framework term. How detection is designed, who owns it, and what standard applies will depend on the framework, control taxonomy, jurisdiction, and facts in a given organization, and this material is educational rather than legal, audit, or compliance advice.

Who it's relevant to

Internal auditors and assurance functions
Detective activity is central to assurance work that identifies issues, errors, or control failures that have already occurred or are underway. Practitioners generally distinguish detective from preventive activity when evaluating a control environment, and the relevant taxonomy will depend on the framework in use.
Compliance officers
Detection supports the identification of noncompliance after it has begun, complementing preventive measures designed to stop it from occurring. How detection is structured and what standard applies typically varies by jurisdiction, sector, and entity type.
Risk and control owners in management
Those responsible for operating controls generally rely on detective activity to surface events and control failures so they can be escalated and remediated. Because detection often depends on deliberate methods, tests, or investigation, its design and operating effectiveness are matters for professional judgment in context.
Board members and oversight bodies
Those exercising oversight generally take an interest in whether the organization can identify problems that preventive measures fail to stop, without themselves owning the operational detective activity. The precise allocation of accountability depends on the governance structure and applicable requirements.

Inside Detect

Detective controls
Controls designed to identify errors, irregularities, or control failures after they have occurred, in contrast to preventive controls that aim to stop them from happening. Examples typically include reconciliations, exception reporting, and monitoring activities. Detection is generally an operational responsibility owned by management (the first and second lines), not the board.
Continuous monitoring and periodic testing
Detection may occur through ongoing, often automated monitoring embedded in processes, or through periodic testing and review. The two approaches serve different purposes: continuous monitoring supports near real-time identification, while periodic testing assesses control operating effectiveness over a defined period.
Escalation and reporting pathways
Mechanisms that route detected issues to the appropriate owner and level of authority, such as compliance monitoring findings, internal audit observations, or whistleblowing and speak-up channels. Effective detection depends on clear routing so that identified matters reach those accountable for response.
Detection as a phase within a broader lifecycle
In many risk and security frameworks, detection sits between preventive measures and response/recovery activities. Under certain frameworks, detection is one function among several; it identifies events but does not itself remediate them, so it should not be conflated with response, correction, or oversight functions.

Common questions

Answers to the questions practitioners most commonly ask about Detect.

Is detection the same as prevention within a control framework?
No. Detective controls and preventive controls serve distinct purposes and are generally treated as separate categories in control frameworks. Preventive controls are designed to stop an error, failure, or unwanted event from occurring in the first place, while detective controls are designed to identify such events after they have occurred so that they can be investigated and corrected. A control environment typically relies on a combination of both, because neither category alone provides complete assurance. Treating detection as a substitute for prevention, or vice versa, can leave gaps in the overall control design.
Does having a detective control in place mean the associated risk has been eliminated?
No. A detective control identifies that an event has occurred; it does not remove the underlying risk. Even where detection operates effectively, some level of residual risk generally remains, because detection typically happens after the fact and depends on the control being designed appropriately and operating effectively. The distinction between inherent risk (before controls) and residual risk (after controls) is relevant here: detective controls may reduce residual risk by limiting the duration or consequences of an event, but they do not reduce it to zero. Whether residual risk is acceptable is a judgment made against the entity's risk appetite and tolerance.
How can an organization test whether a detective control is operating effectively, not just well designed?
Testing typically distinguishes control design from operating effectiveness. Assessing design considers whether the detective control, if it works as intended, would identify the relevant event on a timely basis. Assessing operating effectiveness considers whether the control actually functioned as designed over a period, which commonly involves examining evidence such as records of exceptions identified, timeliness of detection, and follow-up actions taken. The specific methods, sample sizes, and standards applied vary by framework, sector, and the assurance function involved, and the appropriate approach depends on facts and professional judgment. This is educational information, not audit advice.
Who is generally accountable for designing, operating, and providing assurance over detective controls?
Accountability typically depends on the function involved. In many organizations that apply a three-lines model, management (the first line) generally owns and operates detective controls as part of running the business; a risk or compliance function (the second line) may design monitoring activities and set expectations; and internal audit (the third line) generally provides independent assurance over whether controls are designed and operating effectively. The board or a relevant committee generally holds an oversight role rather than an operational one. The precise allocation of responsibilities varies by entity type, size, and the framework adopted.
How should the timeliness of detection be considered when implementing detective controls?
Timeliness is generally a key attribute of a detective control's usefulness, because the value of detection often depends on how quickly an event is identified relative to when it occurred and how much harm can accumulate in the interim. Organizations commonly calibrate detection frequency and speed against the significance of the risk, aligning more frequent or continuous detection with higher-impact exposures. What counts as sufficiently timely is a matter of judgment that depends on the nature of the risk, the entity's risk tolerance, and any applicable requirements, which vary by jurisdiction and sector.
How do detective controls connect to the response and correction that follow?
Detection is generally only effective when it is linked to a defined process for investigating and responding to what is identified. An event that is detected but not escalated, analyzed, and remediated may not meaningfully reduce residual risk. For this reason, detective controls are often implemented alongside corrective controls and clear escalation and reporting paths, so that identified exceptions are routed to the appropriate owner for action. The design of these linkages, and the thresholds for escalation, generally depends on the organization's structure, risk appetite, and any applicable framework or requirements.

Common misconceptions

Detection and prevention are the same thing, so strong detective controls make preventive controls unnecessary.
Detective and preventive controls serve distinct purposes. Preventive controls aim to stop an issue before it arises; detective controls identify issues after the fact. Most control environments generally rely on a combination, because neither category alone typically addresses inherent risk to an acceptable level of residual risk.
If a detective control is well designed, it is working effectively.
Control design effectiveness and operating effectiveness are separate assessments. A control may be designed appropriately yet fail in operation because it is not performed consistently, timely, or by a competent party. Both dimensions generally require evaluation.
Detection is an oversight duty that belongs to the board or audit committee.
Executing detective controls and monitoring is typically an operational responsibility of management. The board and its committees generally provide oversight of whether adequate detection arrangements exist and function, rather than performing detection activities themselves. Assurance functions such as internal audit provide independent evaluation but do not own the underlying controls.

Best practices

Map detective controls to specific risks and to their corresponding preventive controls, so that detection gaps and over-reliance on any single control layer are visible.
Assess detective controls for both design adequacy and operating effectiveness, and document the basis, period, and evidence for each conclusion.
Define clear escalation and reporting pathways that route detected issues to the accountable owner and, where warranted, to the relevant committee, distinguishing operational response from oversight.
Match the detection approach to the risk profile, using continuous monitoring where timeliness matters and periodic testing where point-in-time assurance is sufficient.
Clarify roles across the lines of defense so that responsibility for performing detection, for independent assurance over it, and for board oversight of it are not conflated.
Treat detection as one phase connected to response and remediation, and confirm that identified issues are tracked through to resolution rather than simply logged.