1. Determine if the ITGC listed is a preventive or a detective and corrective control. 2. For each identified ITGC riak, Indicate if the risk is an access, change or operations risk and which ITGCs would mitigate the risk. \begin{tabular}{|l|l|l|} \hline \multicolumn{1}{|c|}{ IIGC risk } & Type of risk (access, change, operations) & IIGC to mitigate the risk \\ \hline Personnel with access beyond what is necessary & & \\ \hline Reliance on faully IT programs or systems & & \\ \hline \end{tabular}