Strong audit programs do not rely on one type of control. They need both preventive controls and detective controls to manage risk effectively.