I'm studying for the CISSP exam and one of the video lecture points didn't quite make sense to me. The instructor was discussing access control administration areas and began categorizing certain things as "preventative" and "detective". For example, data encryption: preventative... data integrity checks: detective... backup power systems: preventative... user training: preventative AND detective....
When the topic came to audits, he labelled them as "detective". To a certain extent, I understand why this would be this way -- since we're looking for vulnerabilities, if we find them... we're detecting them.
At the same time though, I can't help but wonder if audits can also be considered as preventative in nature -- because we're looking for vulnerabilities ahead of time in an effort to prevent them from being exploited later.
What are your thoughts? Perhaps I'm over-thinking this?