Practical guide · Stage: Ownership
Material controls effectiveness: evidence for Provision 29
By Tim Buckley, Founder of Beyond the Lines™ ·
Evidence of material controls effectiveness should help the board explain why it considers a control effective at the relevant date. Start with the risk, identify what the control must achieve, and connect the conclusion to evidence of design, implementation and operation. Make gaps, contradictory evidence and unresolved weaknesses visible.
A completed control register is a useful starting point. Confidence depends on the quality of the reasoning behind each conclusion.
What Provision 29 covers
Under the 2024 UK Corporate Governance Code, Provision 29 addresses board monitoring and at least annual review of the risk management and internal control framework. It covers material financial, operational, reporting and compliance controls. Annual reporting includes the monitoring and review approach, a declaration about material controls effectiveness at the balance sheet date, and ineffective material controls with remedial action, including progress on previously reported issues. The Code operates on a comply-or-explain basis.
The Code applies to companies in the commercial companies and closed-ended investment funds listing categories. Other organisations may adopt relevant practices voluntarily; Provision 29 is not a blanket requirement for every UK business.
Provision 29 applies to financial years beginning on or after 1 January 2026. The FRC expects reporting from 2027 onwards, depending on the company’s reporting period. There is no universal December 2026 publication deadline.
Build a usable evidence map
For each material control, connect five things: the exposure, the required behaviour, the evidence, the judgement and the accountable owner. The following is a practical BTL working approach, not an FRC template.
Illustrative example only. This fictional access-control scenario is not a client case or a prescribed material control.
| Evidence question | Illustrative working record |
|---|---|
| Why could this matter? | Inappropriate privileged access could enable unauthorised changes to a critical payments system. |
| What must the control achieve? | The designated reviewer identifies inappropriate access, challenges exceptions and ensures removal within agreed timeframes. |
| What supports the conclusion? | A reconciled account population, completed reviews, recorded challenges, removal records and checks on overdue exceptions. |
| What could weaken confidence? | Missing service accounts, retrospective sign-off, unexplained exclusions or access remaining active after removal was requested. |
| Who resolves the gaps? | A named technology owner, supported by the relevant business owner, with clear escalation and completion evidence. |
A signed review file does not answer all five questions. The reviewer might have received an incomplete population. Exceptions might have been recorded without being resolved. The evidence map helps expose those dependencies before a favourable conclusion is escalated.
Separate the control conclusion from the evidence gap
Record what is known and what remains untested. “No evidence received” and “control failed” describe different situations, although either may prevent a supported effectiveness conclusion.
In the example, discovering omitted service accounts should trigger a review of the population and the effect on the assessment. Asking the owner to upload another signed form would not resolve that uncertainty. Equally, identifying one exception does not remove the need to evaluate its significance, cause and consequences.
Define acceptable evidence before testing starts. Agree the relevant period, systems, locations, dependencies and evaluation criteria. Explain the sampling approach and its limits. If remediation occurs close to year end, consider what evidence can support operation at the balance sheet date and what further work is needed.
The FRC’s guidance recognises that conclusions depend on the work and evidence available. It also recognises that some relevant procedures may occur after the balance sheet date. This does not turn a remediation plan into proof that a control was effective at that date.
Keep ownership and challenge clear
Give management ownership of controls, evidence and remediation. Make the contribution and limitations of each assurance source visible. Where internal audit provides assurance, preserve its ability to challenge management’s conclusions and explain the scope of its work. The board needs a coherent basis for judgement, with disagreements and coverage gaps brought forward. How that reaches the committee is covered in the guide on internal audit reporting to the Audit Committee.
Questions about Provision 29 evidence
How many material controls should we identify?
There is no prescribed target. The board determines materiality in its company’s circumstances. Start with consequential exposures and the controls relied upon, rather than a desired register length.
Is external assurance mandatory?
No. Provision 29 does not mandate external assurance. The board and management decide whether it is useful and where. Buying assurance does not remove the need to understand the evidence and its limitations.
Does a completed evidence map demonstrate compliance?
No. It supports assessment and discussion. It cannot establish effectiveness without appropriate work or replace company-specific judgement about scope, reporting and applicable obligations. This guide addresses practical evidence design, not a complete compliance assessment.
Explore Material Controls Confidence for support connecting material controls, evidence, ownership and board confidence.