How do preventive and mitigative controls complement each other?

• A. They are redundant and never needed together.
• B. Mitigative controls replace preventive controls when budgets are tight.
• C. Preventive controls stop risks; mitigative controls reduce impact or likelihood, together reducing overall risk.
• D. Preventive controls always outweigh mitigative controls.

Answer: (C)

Preventive and mitigative controls work together to reduce risk by addressing both the chance that something will go wrong and the impact if it does. Preventive controls aim to stop events from occurring in the first place, lowering the likelihood. Examples include strong access controls, input validation, and proper separation of duties. Mitigative controls are activated when prevention fails or is insufficient, and they limit the damage or reduce the likelihood of continued loss—think backups, disaster recovery plans, incident response, and insurance.

Since risk is a function of both probability and impact, combining these controls lowers overall risk more effectively than relying on one type alone. They create defense in depth: prevention reduces the probability of an incident, while mitigation minimizes consequences and speeds recovery if an incident happens. They’re not replacements for each other, and there isn’t a universal rule that one always outweighs the other; the best approach uses both to achieve a lower residual risk.