Provision 29, evidenced control by control: a material controls declaration every director can defend
A declaration every director can defend: each claim cited, dated and signed by its owner.
See one case, screen by screen ↓Provision 29 Compliance evidences the board's declaration on material controls under Provision 29 of the UK Corporate Governance Code 2024. Seven agents scope the material controls, date every piece of evidence to the balance sheet date, read the whole population when a sample fails and draft the declaration with every sentence cited. The Head of Risk classifies each control with a reason code, and five people sign in order before the board approves the declaration.
How to choose AI solutions for back-office and enterprise work →
Updated
For financial years beginning on or after 1 January 2026, the board of a company reporting against the UK Corporate Governance Code is asked, on a comply-or-explain basis, to describe how it monitored and reviewed its risk management and internal control framework, declare whether its material controls were effective at the balance sheet date, and describe any that were not, with the action taken or proposed. The FRC gives no template, defines no material control and requires no external assurance. The board relies on its own evidence.
Today that evidence is a spreadsheet of 30 to 60 controls, owner self-certifications chased by email, second-line reviews in Word and internal audit workpapers in the audit tool. Nobody checks systematically that each piece is dated near the year end and covers the right entities and period. A sample of 25 out of 1,126 payments is about 2%, so a control that fails three times in a year can look like one failure. And the paragraph itself is written late, with “throughout the year” wording that over-claims.
Estimated split from the year-end evidence cut-off to a signed audit committee paper, for a first-year declaration on about 40 material controls, by hand and with the solution.
Seven agents scope, evidence, test whole populations and draft the declaration; people classify and sign.
Kestrel & Vane Group plc is a London-listed group with a 31 December year end, in its first Provision 29 year. It is Monday 1 February 2027, 09:40. The audit committee meets on Thursday 18 February and the board approves the annual report on 4 March. Here is the morning, screen by screen, in the working solution.
Imogen opens one screen. On the left, the thread of what seven agents read, found and need from her. On the right, the assurance map: 38 material controls under 12 principal risks, each a tile with three bars (owner, second line, internal audit) filled to its latest evidence. Above the map sits the declaration in one sentence, drawn from paragraphs 4 to 6 of the draft, which changes as gaps close.
“As at 31 December 2026, the group's material controls operated effectively, except two: dual authorisation of treasury payments (MC-07) and recovery of critical systems (MC-21), described below with the action taken or proposed.”
The evidence agent has read the owners' Q4 self-assessments, the second-line reviews, internal audit's workpapers and system records, dated each one against the balance sheet date and checked it covers the right entities and period. 36 of 38 controls have all three lines in date. Two do not. Every statement carries a citation, and “Plan and sources” shows what the agent read.
“The 36 include MC-33, whose second-line review is dated 12 Jan: it counts only if you accept it.”
Internal audit's May test of MC-07 sampled 25 treasury payments and found one released by a single approver: £1,840,000 on 12 May through the banking platform's emergency route. Under evidence rule 5, the testing agent read every payment over £250,000 in 2026 and found two more, on 9 and 23 November, £412,000 and £1,058,000. All three went to known suppliers for the right amount; no loss arose. The route still existed at 31 December, so the agent proposes not effective at the balance sheet date (CL-02).
Caroline Whitlock, audit committee chair, 26 Nov 2026: “After the May exception, I want every treasury payment checked, not a sample, before we declare.”
MC-21 needs the six critical systems restored in a test at least once a year, within their recovery targets. The 2026 test, set for 18 November, was postponed during the finance system change freeze; the last tested restore was 9 October 2025. The agent proposes CL-03, not evidenced. The ERP has since been restored in 7 h 40 m against its 8-hour target, which is action taken, not evidence at the date. Marcus Odhiambo, the CISO, confirms the other five systems are booked for Thu 25 Feb.
MC-33's second-line review, from the data protection office, is dated 12 January 2027 but describes the position at 31 December: 14 breaches assessed, 3 reported, all within 72 hours. Only the Head of Risk can accept evidence dated after the year end. Imogen accepts it with reason code EV-01 and a comment; had she declined, the count would drop to 35 and the declaration would name MC-33.
“Only you can accept evidence dated after the year end.” — the evidence agent
Imogen opens “Classify MC-07 at 31 December 2026” and confirms CL-02, not effective at 31 Dec: failed. The classification and her reason go on the audit trail and into the declaration. She then confirms MC-21 as CL-03. Every other material control stays CL-01, effective at 31 December.
In the classify dialog: “CL-04 needs a retest before 31 December; none exists for MC-07.”
Each control not effective at the balance sheet date is set out in plain terms. MC-07: three payments, £3,310,000 in all, no loss, a daily review of single-approved payments since 2 June, the route removed by 15 March 2027 and an internal audit retest by 30 April. MC-21: the finance system restored on 26 January, the other five by 25 February and a quarterly restore schedule by 31 March. The Q2 backlog in serious-incident investigations (MC-15) was cleared and retested before 31 December, so it is not reported as a weakness; the FRC passage that allows this is cited.
“A failure counts only if it was still open at 31 December.”
The declaration agent drafted seven paragraphs, 485 words, with 31 citations. The reviewer agent checked every sentence against the evidence and the FRC's guidance: six of seven checks pass. Paragraph 4 said the controls “operated effectively throughout the year”, but the Code asks for the position at the balance sheet date and MC-07 failed in May and November. Its rewrite says “as at 31 December 2026”. Imogen accepts it (RW-01): declaration v0.4, seven of seven checks pass.
The reviewer agent never rewrites without approval: every rewrite is a proposal.
Imogen signs as preparer with SO-01, approved as drafted. Next is Tomasz Brenner, Head of Internal Audit, for the internal audit opinion; then Daniel Ashcombe for the CFO sign-off, Rupert Lindgren for the wording, Caroline Whitlock for the audit committee's recommendation on 18 February, and the board on 4 March, recorded by the company secretary. Each step opens only after the one before it.
Every agent step and every decision — the late evidence accepted, both classifications, the rewrite, the signature — is an entry linked to the one before by its hash. The audit committee chair's challenge is kept as evidence of the board's oversight. Anyone with access can verify the chain and export the evidence pack for the audit committee or the external auditor.
Audit trail filters: Agent steps · Decisions · Evidence · Challenges · Sign-offs.
The same declaration, seen by the five people who prepare, test, sign and recommend it — what the first Provision 29 year looks like without it, and with it.
Seven agents scope, evidence, test whole populations and draft the declaration; people classify and sign.
Proposes the material controls each year from the principal risks, the risk appetite and the materiality criteria, and explains additions and retirements.
Maps each material control to its principal risk and type, and shows principal risks with no material control and duplicated assurance.
Collects evidence from each line, dates every item against the balance sheet date and checks it covers the right entities and period.
Re-reads test results; when a sample fails, checks the whole population; proposes a classification against the balance sheet date.
Tracks the actions that close each weakness, chases owners on the SLA, asks for evidence of completion and books retests.
Drafts the board's statement: how the framework was monitored and reviewed, the declaration, and each ineffective control with the action taken or proposed, citing every claim.
Checks the draft sentence by sentence against the evidence and the FRC guidance: point in time, no over-claim, under two pages, nothing sensitive, public issues covered, consistent with the principal risks.
Classify, sign and declare. The agents propose; a named person decides.
Ask about any material control, piece of evidence or sentence of the declaration, or tell the agents what to do. Every answer points to its source, and questions from the board and the committee are kept as evidence of their oversight.
Why is the treasury control not effective if no money was lost?
Because the Code asks whether each material control worked at 31 December, not whether money was lost. MC-07 needs two approvers. Three payments went out with one (12 May, 9 Nov and 23 Nov, £3,310,000 in all), and the emergency route still existed at the year end. No loss arose.
What changed since last year's dry run?
Scope went from 35 to 38: four added (MC-20, MC-24, MC-27, MC-37) and depot stock counts retired. MC-07 and MC-21 are no longer effective; MC-19 patching now is. Two dry-run lessons are rules now: late evidence needs a named person, and a failed sample triggers a full check.
Can MC-21 count as effective if the restore tests pass before 4 March?
No. The declaration is about the position at the balance sheet date, and no restore was tested in 2026. The finance system restore of 26 January (7 h 40 m against 8 h) is action taken, which paragraph 6 reports. The FRC sets a failure aside only when it was fixed by the balance sheet date.
Who still has to sign before the audit committee?
The order is Imogen Hale, Tomasz Brenner, Daniel Ashcombe, Rupert Lindgren, then Caroline Whitlock for the committee on Thu 18 Feb; the board approves on 4 March. Each signer opens only after the one before.
13 screens from the working solution, on its sample data. Pick one to see it large.
The thresholds every control is judged against are settings, approved, versioned and logged; a change to the materiality criteria needs the audit committee's approval again.
| Setting | Default | Choose from |
|---|---|---|
| Profit impact threshold | £20M of operating profit (about 5% of £412M) | Any whole amount in £M, and the share of operating profit |
| Always material | Regulatory sanction or licence loss · serious harm to people · sustained loss of customer or investor trust | Each criterion on or off |
| Owner self-assessment | Within 3 months before the date | Any whole number of months |
| Second-line review | Within 12 months before the date | Any whole number of months |
| Internal audit test | Within 24 months (rotation), or second-line testing relied on | Any whole number of months |
| Full population check when a system-evidenced control fails a sample | On | On · Off |
| Minimum agent confidence to propose a classification | 90% | Any whole percentage up to 100 |
| Every rewrite needs a person | Always on | Cannot be switched off |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (FRC, UK Corporate Governance Code 2024, Provision 29, and Provision 29 Mythbuster, Jan 2026 — most companies identify 30 to 50 material controls; FRC Annual Review of Corporate Governance Reporting 2025, November 2025 — only 40% of the companies reviewed gave meaningful detail on what their review covered or who did it). People, companies, controls, payments and dates named on this page are fictional — characters and sample data in the working solution.
Provision 29 Compliance evidences the board's declaration on material controls under Provision 29 of the UK Corporate Governance Code 2024. Seven agents scope the material controls, date every piece of evidence to the balance sheet date, read the whole population when a sample fails and draft the declaration with every sentence cited. The Head of Risk classifies each control with a reason code, and five people sign in order before the board approves the declaration.
For financial years beginning on or after 1 January 2026, the board is asked, on a comply-or-explain basis, to describe how it monitored and reviewed its risk management and internal control framework, declare whether its material controls were effective at the balance sheet date, and describe any that were not, with the action taken or proposed. The FRC gives no template and requires no external assurance, so the board relies on its own evidence.
The scoping agent proposes the list each year from the principal risks, the risk appetite and the materiality criteria — in the demo, a profit impact of £20M or more, a regulatory sanction or licence loss, serious harm to people, or a sustained loss of customer or investor trust — and explains each addition and retirement. It never changes the scope itself: the audit committee approves the list.
For controls evidenced by system records, the testing agent reads the whole population, not the sample. In the demo, internal audit's sample of 25 treasury payments found one exception; the agent read all 1,126 payments over £250,000 and found two more in November. With the emergency route still open at 31 December, it proposed not effective at the balance sheet date; a person decides.
The evidence agent dates every item against the balance sheet date. Evidence dated after it counts only if it describes the position at the date and the Head of Risk accepts it with a reason code; if not, the agent asks for earlier evidence and the declaration says so. A failure fixed and retested before the date need not be reported as a weakness, and the agent cites the FRC passage that says so.
The declaration agent drafts it from the assurance record, citing every claim, and never publishes, signs or includes commercially sensitive detail. A separate reviewer agent checks each sentence against the evidence and the FRC guidance — point in time, no over-claim, under two pages — and proposes rewrites that a person accepts or keeps with a reason. The company secretary owns the wording.
Yes. Agents never classify a control, accept late evidence, change scope or due dates, change the declaration without a person's approval, or sign. Every decision carries a named person's reason code, and the preparer, internal audit, CFO, company secretary and audit committee chair sign in order before the board declares. Every step is on a hash-linked audit trail.
The Agentic Solution Engine builds and deploys Provision 29 Compliance from your requirements and documents — your principal risks, control library, materiality criteria, owners and evidence systems — and it goes live once every quality gate has passed. A five-step set-up guide starts from your last annual report and your own risk register and can be run again for the next year.
Every sample cited, re-performed and signed before your auditor asks.
1-min demoAudit Evidence CollectionEvidence checked before the auditor sees it, and the request list closed before fieldwork.
1-min demoContinuous Controls MonitoringControl failures found in a day, not at year-end, and every fix proved by a re-test.
1-min demoWe'll run Provision 29 Compliance on a sample of your own control library, evidence and last year's wording.