The Proof is in the Control of the Current Reporting Period. It’s a year since the Economic Crime and Corporate Transparency Act (ECCTA) created criminal liability for failing to prevent fraud.
As a result, the UK Corporate Governance Code’s Provision 29 now requires large corporates to comply or explain the effectiveness of their risk management and internal control frameworks.
For Groups whose financial year began in January 2026, the first declarations will be prepared early in 2027.
Rather than inventing new controls, Provision 29 changes the standard of proof. Are you ready to comply or explain based on your current reporting period? Boards of UK-listed companies now have to report on how they have monitored and reviewed the effectiveness of the company’s risk management and internal control framework. They will have to make a declaration on the effectiveness of the company’s material controls as at the balance sheet date, describing any material controls that have not operated effectively and the action taken¹.
The proof is in the controls that live in the monthly and periodic financial close. Most of the commentary so far has treated this as a governance and risk topic, focussing on frameworks, risk registers, board committees. Less discussed is where a substantial share of those material controls are happening. For example, in account justification, analytical review and the control of manual journal entries. If these financial controls cannot be shown to operate effectively, the declaration has a gap. And it is a gap in the part of the framework closest to the published numbers.
So, what does Provision 29 actually ask of boards?
Three features of the provision matter for finance teams¹:
- It is a declaration, not just a description. It’s not enough to merely describe the control environment. Boards must take a position on whether material controls were effective at the balance sheet date.
- Financial reporting controls are squarely in scope. The framework covers material controls across financial, operational, reporting and compliance domains. Whatever else a board designates as material, the controls that assure the reliability of the financial statements are the hardest to argue.
- It works on a comply-or-explain basis, but with an uncomfortable asymmetry. A company can explain a departure. But investors and audit committees will not respond very charitably to an explanation that it cannot yet evidence the effectiveness of its financial reporting controls.
The Code does not prescribe a list. Boards must define for themselves which controls are material; a flexibility which cuts both ways. It allows a proportionate approach, but it means that the audit committee’s first question is likely to be: which of our close controls are material, and what evidence do we hold that they operated?
The close is where financial reporting controls live
The review layer of the close is where the numbers are assured. It happens in: account analysis and justification, analytical review of the balance sheet and income statement, and in the checking and validation of manual journal entries.
UK CFOs already identify these three as the closing activities most in need of strengthening. They were cited by 53%, 50% and 50% respectively in the Sixthfin × Odoxa survey of 303 UK CFOs². These are precisely the controls a board will be asked to stand behind, turning the process from efficiency to assurance
The evidence gap: a declaration needs more than effort
A control is only as good (declarable) as its evidence. And our survey data describes an evidence base that would trouble any audit committee²:
- Account analysis and reconciliation run on Excel in 67% of companies and on collaborative tools (like Teams and email) in 61%; only 15%manage without either, and just 3% use a dedicated solution
- 34% of CFOs cite difficulties with traceability and account documentation among the main factors complicating their close
- 35% cite dependence on certain key individuals, and 38% the proliferation of Excel files
Translate those numbers into Provision 29 terms and they don’t come up as evidence. A justification filed in an inbox is a control performed but not evidenced. A review whose method lives in one person’s head is a control that cannot be shown to operate consistently. A workbook with uncontrolled versions cannot establish which review, by whom, on what data, supported the balance the board is declaring on. None of this means the controls failed; it means their effectiveness cannot be demonstrated, which for a declaration made as at the balance sheet date is the operative problem.
What “effective” means, operationally, for close controls
For the review layer of the close, an audit committee preparing a Provision 29 declaration will want four properties, each of them checkable:
- Defined— a work programme that states which accounts are reviewed, at what depth, against which materiality thresholds, for every entity in scope; not a practice that varies by subsidiary or by individual
- Performed consistently— statuses per account and per cycle (to review, in progress, validated) that show the programme was executed each period, group-wide, not asserted after the fact
- Evidenced— justification, analytical commentary and supporting documents attached to the account concerned, timestamped and attributed, retrievable months later without reconstruction
- Reviewable— a native audit trail answering the question every reviewer, internal or external, will ask: who did what, when, on what basis
These four properties are the condensed version of what a standardised review process provides. And the exact inverse of what spreadsheets and inboxes can attest to. The point is structural, not moral: Excel remains a legitimate analysis tool; it is simply incapable of being the system of record for a control framework a board must declare on.
From here to the declaration: a realistic sequence
The current reporting period is the evidence base. For Groups whose financial year began in January 2026, the first declarations will be prepared in early 2027, so they need to be sure of their controls now.,. A workable sequence for the close perimeter is:
- Designate— agree with the audit committee which close controls are material: typically account justification on significant balances, analytical review, manual journal validation
- Standardise— create one work programme, one set of materiality thresholds, one documentation standard, deployed across entities rather than re-interpreted by each
- Instrument— put the programme on a platform that produces statuses, timestamps and an audit trail as a by-product of the work, so that evidence accumulates period by period instead of being assembled retrospectively
- Rehearse— run the effectiveness review internally on a live period before the first external declaration, and fix what it surfaces
Groups that treat 2026 as the rehearsal year will make their first declaration on the strength of accumulated evidence. Groups that leave it to the annual reporting cycle will be working under deadline pressure that 96% of companies already say is a source of stress for their teams and is a mode of working flagged by 34% of UK CFOs as a principal difficulty2.
Conclusion: an assurance question with an operational answer
Provision 29 does not ask finance departments to invent new controls. For the close, the controls already exist (account justification, analytical review, journal validation) and CFOs already rank them as their top strengthening priorities. What the provision changes is the standard of proof: from “we do this” to “we can demonstrate this operated, entity by entity, as at the balance sheet date”.
That is an operational gap before it is a governance one, and it closes the same way the close itself is mastered: through a standardised programme, shared thresholds, a visible workflow and centralised, attributable documentation. Boards will sign the declaration. Whether they sign it comfortably is decided in the month-end close.
The post Provision 29 is Coming for Your Month-End Close appeared first on The Fintech Times.
