Risk Control and Loss Prevention
Control and loss prevention
Risk control changes the likelihood or impact of a risk. Candidates must distinguish preventive, detective, and corrective controls, and apply the hierarchy of controls: eliminate, substitute, engineer, administer, and personal protective equipment. Prevention is generally preferred over detection because detection only limits damage after an event. Controls need owners, design standards, operating evidence, and testing. Key controls are those that materially reduce a significant risk; test them more often. Segregation of duties, authorization limits, reconciliation, physical safeguards, training, and business continuity arrangements are common examples. Control cost must be proportionate to expected loss reduction, and residual risk must be reassessed after implementation.
Traps: calling insurance a control (it is financing), assuming a detective control prevents loss, and treating a documented procedure as an operating control. Questions often show a control that is duplicated or unowned; weak answers add more controls without addressing the root cause. Also watch for overreliance on human vigilance and for controls that create new risks, such as excessive approvals slowing response.
Worked example: a warehouse faces theft. Elimination is impractical; substitution might mean removing high-value stock from the site. Engineering includes locked cages and access control. Administrative controls include background checks and rotation. Detection includes CCTV and inventory counts. Insurance transfers part of the loss but does not stop it. The best answer combines layers, assigns owners, tests access logs, and measures residual loss frequency. If theft continues, revisit root cause rather than adding another camera.
Rule of thumb: controls either reduce likelihood or reduce impact; state which, prove operation, and re-measure residual risk.