A computer system automatically locks a user's account after three unsuccessful attempts to log on. Which type of control does this scenario represent?

The primary purpose of an account lockout mechanism is to prevent an undesirable event—specifically, unauthorized access—from occurring. After detecting a pattern of behavior that suggests a potential brute-force attack (three failed attempts), the system takes a proactive step to block any further attempts. This action of stopping a potential threat before it can succeed is the defining characteristic of a preventive control. While it is triggered by a detective element (counting failed logins), its ultimate function is to avert a security breach.

A. Corrective control. This is incorrect because a corrective control is enacted after an undesirable event has occurred to fix the damage. The account lockout happens before a breach to prevent it.
C. Detective control. This is incorrect because the control's main function is not simply to identify and report that failed attempts occurred. Its primary purpose is to act on that information to prevent access.
D. Compensating control. This is incorrect because the scenario does not describe this control as a backup or alternative for another weak or missing control; it is a primary security feature.

1. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2013). Internal Control – Integrated Framework: Framework and Appendices.

Reference: Principle 11: The organization selects and develops general control activities over technology to support the achievement of objectives.

Content: The framework discusses control activities that can be preventive or detective. Logical access controls, such as automated account lockouts, are classic examples of general controls over technology designed to prevent unauthorized access to information systems, thereby mitigating security risks before they are realized.

2. The Institute of Internal Auditors (IIA). (2017). Sawyer's Guide for Internal Auditors, 7th Edition.

Reference: Chapter 13, "Information Technology Auditing," Section on Application Controls.

Content: This guide explains that preventive controls are designed to stop errors or irregularities from happening. Controls over logical access, including password policies and system responses to failed login attempts like account lockouts, are categorized as preventive because they are intended to stop unauthorized individuals from gaining access to systems and data.

3. University of California, Office of Ethics, Compliance and Audit Services. Internal Controls - Basics.

Reference: Section on "Types of Internal Controls."

Content: University guidance on internal controls defines preventive controls as those that "keep errors and irregularities from happening in the first place." An account lockout is a direct application of this principle, designed to proactively secure a digital asset (the user account) from unauthorized use.