Explain the difference between corrective action and preventive action in incident management.

• A. Corrective actions address broader system improvements; preventive actions address the specific incident.
• B. Corrective actions are only about paperwork; preventive actions involve hardware changes.
• C. Corrective actions address the specific incident to prevent recurrence; preventive actions address broader system improvements to reduce future risk.
• D. Corrective actions eliminate the need for future investigations.

Answer: (C)

In incident management, corrective actions and preventive actions serve different aims. Corrective actions fix what happened and stop this exact incident from recurring by addressing the root cause tied to that event. They’re a reactive response that makes targeted changes—like patching a software bug, replacing a failed component, or adjusting the specific process step that led to the incident.

Preventive actions, by contrast, look beyond the single incident and aim to reduce the chance of future problems across the system. They’re proactive improvements to processes, controls, monitoring, training, redundancy, and risk management practices that lower overall risk and make similar incidents less likely in the future.

So, the best description is that corrective actions address the specific incident to prevent recurrence, while preventive actions address broader system improvements to reduce future risk.