Track ITAC readiness
IT Application Controls (ICFR readiness) · Application-level IT controls for financial reporting readiness
Readiness topics for the IT controls built into or around the applications that feed financial reporting: scoping, input, processing, output, interfaces, application access and segregation of duties, change and configuration, report logic and end-user computing, and monitoring and evidence. Items are generic; add the company's own application-specific controls as custom items. Internal readiness tracker, not an auditor's opinion.
ITACWhat is ITAC?
Readiness topics for the IT controls built into or around the applications that feed financial reporting: scoping, input, processing, output, interfaces, application access and segregation of duties, change and configuration, report logic and end-user computing, and monitoring and evidence. Items are generic; add the company's own application-specific controls as custom items. Internal readiness tracker, not an auditor's opinion.
Who it applies to
Organisations that want to prepare the IT controls built into or around the applications that feed financial reporting, for example before an internal-control review or an external audit. The items are generic; the company's own application-specific controls are added as custom items.
How the control catalogue is organised
Nine groups: governance and scoping, input controls, processing controls, output and reporting, interfaces and data transfer, application access and segregation of duties, change and configuration, report logic and end-user computing, and monitoring, testing and evidence, summarised here as 72 readiness topics.
ITAC is an original Bitkosh readiness catalogue. It is not an auditor's opinion, and Bitkosh is not affiliated with the PCAOB, the SEC, COSO or ISACA. It does not mean that an external auditor will accept or rely on these controls, and using this platform does not by itself confer or guarantee any certification or assessment.
ITAC on the Bitkosh platform
The 72 ITAC controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- ITAC-OUT-04Reconciling item follow-up
Reconciling differences are listed, assigned to an owner and cleared within an agreed time.
Output and reporting - ITAC-MON-03Tester independence
People who test a control do not also perform it; where that cannot be avoided, the extra review used instead is recorded.
Monitoring, testing and evidence - ITAC-OUT-03Reconciliation to the ledger
Application balances and totals are reconciled to the general ledger on a defined schedule.
Output and reporting - ITAC-CHG-06Vendor patches and upgrades
Vendor patches and upgrades to in-scope applications are assessed, tested and applied through the change process.
Change and configuration - ITAC-RPT-07End-user computing formula and logic review
Formulas, macros and links in key spreadsheets are reviewed when built and after changes.
Report logic and end-user computing - ITAC-GOV-04Automated versus manual control split
For each key process the team records which controls run automatically in the application and which depend on people.
Governance and scoping
More information security & cybersecurity frameworks
Frequently Asked Questions
Who wrote the ITAC catalogue, and who is it for?
Is there a certificate or official assessment for ITAC?
How is the ITAC control catalogue organised?
Ready to track your ITAC readiness?
See how the Bitkosh Readiness Platform tracks your ITAC readiness — and the other 47 ready frameworks — from a single control library.