Much like recursion, to properly understand audits we must first understand the scope and usage of audits. Audits are used to determine compliance against a benchmark. Without said benchmark, then the auditor has nothing to measure against. In some cases your benchmark may be a deeply technical document describing programming practices or operating system configurations. In other cases your benchmark may be as lose as "follow best practices as determined by $RANDOM_DEPT".

Thinking of them in this light, using your labels, audits should be classified strictly as 'detective'. So, this means that 'preventative' measures would be the benchmarks/standards/policies/whatever.

Consider the following:

In order to avoid unauthorized access by ex-employees all accounts are disabled upon separation.

In this scenario the policy to disable accounts is your preventative measure. During the course of an audit, your auditor would attempt to determine whether or not the policy is followed.

Much like recursion, to properly understand audits we must first understand the scope and usage of audits. Audits are used to determine compliance against a benchmark. Without said benchmark, then the auditor has nothing to measure against. In some cases your benchmark may be a deeply technical document describing programming practices or operating system configurations. In other cases your benchmark may be as loose as "follow best practices as determined by $RANDOM_DEPT".

Thinking of them in this light, using your labels, audits should be classified strictly as 'detective'. So, this means that 'preventative' measures would be the benchmarks/standards/policies/whatever.

Consider the following:

In order to avoid unauthorized access by ex-employees all accounts are disabled upon separation.

In this scenario the policy to disable accounts is your preventative measure. During the course of an audit, your auditor would attempt to determine whether or not the policy is followed.