Control evidence page: each control's evidence by period for the chosen quarter, worst first, with one button to request what is missing.
One quarter shows every state: overdue, came in late, requested, evidence in, reviewed, and a yearly control not due this quarter.
An evidence request is a Jira work item for one control and period, assigned to the owner and due on the evidence due date.
The Control evidence panel on a control lists its periods with status, files, dates and request work items.
Control setup: ID, how often it runs, days to provide evidence after each period, first period to track, evidence needed.
One click created four requests, one per control and period, assigned to the control owners.
The Tickmark agent in Rovo lists the overdue periods for Q3 2026, with links to the controls and the requests.
Requesting evidence is an UPDATE action, so Rovo asks for confirmation before Tickmark creates the work item.
After confirmation, Tickmark created the October 2026 request for FIN-02 and assigned it to the control owner.

Try it

Install Tickmark on a Jira Cloud site.
Open a project (a business project works well), choose Control evidence in the project's navigation (it may sit under More) and press Load sample controls.
Open one of the controls, then its Control evidence panel from the apps button under the title.

Inspiration

In a SOX or ITGC program, every control needs evidence for every period: a signed user access review each quarter, a bank reconciliation each month. At quarter end, testers chase owners for files, and when the auditor asks for the Q3 evidence of a control, someone has to find what came in, when, and what is still missing. Teams that already keep their controls as Jira work items have the owners, the files and the dates in one place, but no view of them by period.

What it does

Control evidence page in every Jira project: pick a quarter and see each control's evidence for the periods that end in it, worst first: overdue, came in late, not requested, requested, still running, evidence in, reviewed. Each period shows its due date, the files with their dates and uploaders, and the request work item. One button requests the evidence for every open period.
Control evidence panel on a work item: set it up as a control (control ID, monthly, quarterly or yearly, the days after each period to provide evidence, the evidence needed, key control, first period to track). The panel then lists the recent periods with their status and a Request evidence button.
Evidence requests: one work item per control and period, assigned to the control owner, due on the evidence due date, linked to the control and saying what is needed. Owners attach the files there; marking the request done records the evidence as reviewed.
Rovo agent "Tickmark" with three actions, evidence-status, control-evidence and request-evidence. Requesting evidence is an UPDATE action, so Rovo asks the user to confirm before it creates the work item. A rovo:mcp module exposes the same actions as tools on the Atlassian MCP server, and an open-source SKILL.md tells third-party agents how to use them.
Load sample controls creates eight controls of a fictional company, with evidence files and requests timed so that the last completed quarter shows every state.

Tickmark records when evidence arrived and whether its request was closed. It does not judge whether a control works, whether the evidence is sufficient or what an auditor would conclude.

How we built it

Forge with UI Kit: a jira:projectPage, a jira:issuePanel, two jira:entityProperty indexes, and action, rovo:agent and rovo:mcp modules. A control's setup is an issue property (tickmark), and each request carries the control and period it is for (tickmark-request), so both are found with JQL. The core is plain JavaScript with no network access: periods and due dates in UTC calendar months, quarters and years, period tokens in file names (2026-09, Sep 2026, Q3 2026, 2026Q3, FY2026), the status of each period and the quarter overview, with unit tests. Jira calls run as the current user. The app makes no calls outside Atlassian, stores nothing outside Jira and calls no language model.

Challenges we ran into

A file uploaded in mid-October could be late evidence for September or early evidence for October. Rather than guess from the upload date, Tickmark ties evidence to a period through the request work item, or through a period written in the file name.
Creating requests one at a time (create, property, link) could run past the 25 seconds a resolver may take. Requests are now created in one bulk call that carries the property, and the links are added in parallel; the sample loader works the same way.
Evidence uploaded today cannot be backdated, so the sample sets each control's days to provide evidence from today's date. Whenever it is loaded, the last completed quarter shows evidence reviewed, in, requested, late and overdue.
A control set up today should not list last year's months as overdue, so each control has a first period to track.

Accomplishments that we're proud of

The question an auditor asks, "show me the Q3 evidence for this control", has an answer on one page, with dates.
Requests go to the control owner with the due date and what is needed, and the overview updates as files come in.
The status of each period is computed in one place and is the same in the page, the panel, Rovo and the MCP tools.

What we learned

Most of the work is in deciding which period a piece of evidence belongs to; once that is explicit, the status follows from dates.
Bulk creates, with properties set at creation, cut the calls a resolver makes, which matters under Forge's 25-second limit.

What's next for Tickmark

An evidence index page in Confluence for the auditor, generated per quarter.
Reminders to owners before evidence is due, from a scheduled trigger.
Evidence kept in linked Confluence pages, and samples for controls that run many times a period.