The Institute of Internal Auditors (IIA) classifies internal controls into four types: preventive, detective, corrective, and directive. Preventive controls are designed to prevent errors or irregularities from occurring. They are proactive controls that help to ensure departmental directives are carried out and that the organization’s objectives are achieved. Detective controls, on the other hand, are designed to find errors or irregularities that have already occurred. Corrective controls aim to correct errors that have been detected, while directive controls guide operations towards achieving the organization’s objectives. Grey’s statement accurately reflects this classification.

Choice B is incorrect. Directive controls do not aim to alert the firm if an incident occurs. Instead, they are designed to guide operations towards achieving set objectives and ensuring compliance with laws and regulations. Alerting the firm of incidents is typically a function of detective controls, which identify and report on incidents that have already occurred.

Choice C is incorrect. The examples provided are not preventive controls but rather detective controls. Preventive controls aim to prevent an incident from occurring in the first place, such as segregation of duties or authorization requirements for certain transactions. Smoke alarms and credit card notifications of potentially fraudulent transactions are examples of detective controls as they identify and report on incidents after they have occurred.