The most common situation in which a control point is needed is when an innocent error is made in the processing of a transaction. For example, a payroll clerk incorrectly calculates the number of hours worked by a nonexempt employee, resulting in a paycheck that is substantially larger than would normally be the case. This type of action may be caused by poor employee training, inattention, or the combination of a special set of circumstances that were unforeseen when the accounting processes were originally constructed. There can be an extraordinary number of reasons why a transactional error arises, which can result in errors that are not caught, and which in turn lead to the loss of corporate assets.

Controls act as review points at those places in a process where these types of errors have a habit of arising. The potential for some errors will be evident when a process flow expert reviews a flowchart that describes a process, simply based on his or her knowledge of where errors in similar processes tend to occur. Other errors will be specific to a certain industry; for example, the casino industry deals with enormous quantities of cash and so has the potential for much higher monetary loss through its cash-handling processes than do similar processes in other industries. Also, highly specific circumstances within a company may generate errors in unlikely places. For example, a manufacturing company that employs mostly foreign-born workers who do not speak English well or at all will experience more errors in any processes where these people are required to fill out paperwork, simply due to a reduced level of comprehension of what they are expected to do. Consequently, the typical process can be laced with areas in which a company has the potential for loss of assets.

The need for controls is also driven by the impact of their cost and interference in the smooth functioning of a process. If a control requires the hiring of an extra person, then a careful analysis of the resulting risk mitigation is likely to occur. Similarly, if a highly efficient process is about to have a large and labor-intensive control point plunked down into the middle of it, it is quite likely that an alternative approach should be found that provides a similar level of control, but from outside the process.

The controls installed can be of the preventive variety, which are designed to spot problems as they occur (such as flagging excessive hourly amounts for the payroll data entry staff), or of the detective variety, which spot problems after they occur, so that the accounting staff can research the associated problems and fix them after the fact (such as a bank reconciliation). The former type of control is the best, since it prevents errors from ever happening, whereas the second type results in much more labor by the accounting staff to research each error and correct it. Consequently, the type of control point installed should be evaluated based on its cost of subsequent error correction.

All of these factors—perceived risk, cost, and efficiency—will have an impact on a company's need for control systems, as well as the decision to use the preventive or detective type of each control.