Detective controls identify issues after they occur; corrective controls address and rectify those issues to prevent recurrence.

Detective controls are only manual, while corrective controls are only automated.

Detective controls prevent errors, while corrective controls detect them

Detective controls are used for compliance, while corrective controls are used for fraud.

Improve customer satisfaction.

Reduce fraud-related losses from online banking transactions by 20% within the next year.

Increase profits as soon as possible.

Eliminate all fraud immediately.

Market Expansion

Risk Assessment

Report the issue to external stakeholders before internal review.

Immediately update all policies without investigation.

Ignore the spike as a temporary anomaly.

Conduct a root cause analysis, adjust the fraud detection system, and retrain staff if necessary.

A single employee is responsible for both initiating and approving wire transfers.

Employees are trained annually on fraud risks, but no transaction-level controls exist.

All wire transfers are automatically approved by the system without human intervention.

Two different employees are required: one to initiate a wire transfer and another to approve it.

Cyber resilience replaces the need for operational resilience

Cyber resilience is unrelated to operational resilience

Operational resilience focuses only on IT systems

Operational resilience includes cyber resilience as a key component

To satisfy auditors only

To identify weaknesses and improve organizational response to disruptions

To increase sales

To reduce staff workload

Annual staff parties

Only physical security controls

Increasing marketing budget

Regular data backups and offsite storage

It is the total cost of a cyber incident

It refers to the time required to notify stakeholders

It defines the point in time to which data must be recovered after an incident

It is the maximum downtime allowed for a service

The minimum time needed to detect a cyber incident

The total duration of a business impact analysis

The maximum acceptable amount of data loss measured in time

The maximum time allowed to restore a process after a disruption