Learning objective
By the end of this lesson, you can distinguish preventive and recovery barriers and test whether a listed control deserves credit.
Why it matters
A policy, training slide or human approval can look reassuring in a risk register. It is not automatically a barrier. A barrier needs a mechanism on a specific path, an operating standard, an owner and evidence that it is available and effective.
Core concept: position, performance, degradation
Ask three questions for every barrier:
- Position: does it act before or after the top event?
- Performance: what must it do, under which conditions, and how is that verified?
- Degradation: what can weaken it, and what protects or detects that weakness?
Also test common dependencies. Two controls using the same identity data or operator can fail together.
Visual explanation
Worked example
An AI assistant creates payment instructions. “Human review” is listed as prevention, but the reviewer sees only the generated summary. The control shares the same corrupted evidence path and has no comparison requirement.
The team replaces the claim with a deterministic match against authorised supplier data and blocks changed bank details before approval. An independent confirmation and payment hold act after a suspicious instruction enters the queue. Access review protects against permission degradation.
Common mistake
Mistake: counting boxes rather than testing independence.
Several labels do not create defence in depth if one failure disables them all.
Quick check
A transaction hold activates only after a suspect instruction enters approval. Where does it belong?
A. Threat.
B. Preventive barrier.
C. Recovery barrier.
D. Hazard.
Answer: C. It acts after loss of control to prevent or limit consequence.
Practical prompt
Choose one critical control. Write its path, position, performance threshold, evidence, owner, degradation factor and degradation control.
Summary
- One diagram needs one top event.
- Prevention and recovery are different.
- A barrier needs mechanism, standard, owner and evidence.
- Shared dependencies and degradation must be visible.
Next lesson
Use RACI Matrix to validate control ownership, then connect the barrier standard to operational monitoring and incident learning.