Actually both are correct. Preventive action might be taken in response to a risk assessment or seeing a performance trend, both of which are not related to corrective action (e.g., there is no problem, but might be if no action is taken). Preventive action is also taken towards the end of the corrective action process by implementing the solutions not only where the problem occurred, but in other areas (products, processes, facilities, ...) where there is the potential for it to occur. This is one reason for the term CAPA used in the medical device industry.