Internal controls ITGCs Part 3: Evaluating ITCCs 1. Determine if the ITCC listed is a preventive or a detective and corrective control. 2. For each identified ITGC risk, indicate if the risk is an access, change or operations risk and which ITCCs would mitigate the risk. \begin{tabular}{|l|l|l|} \hline \multicolumn{1}{|c|}{ ITec risk } & Type of risk (access, change, operations) & ITeC to miligate the risk \\ \hline Personnel with access beyond What is necessary & & \\ \hline Rellance on faully IT programs or systems & & \\ \hline \end{tabular}