# Provision 29 Starts With Testable Controls, Not Better Wording

**Category:** GRC
**Author:** John Hotham, CEO, Simplif-i
**Published:** 2026-10-07
**Read Time:** 4 min read

## Summary
A board declaration is only as sound as the management evidence behind it. Define material controls, test operation and expose exceptions before the annual report is drafted.

## Full Content
# Provision 29 Starts With Testable Controls, Not Better Wording

A polished annual report cannot repair a weak control review. If management cannot explain what a material control is, who operates it and what evidence shows it worked, the board has little to challenge beyond assurance language.

The Financial Reporting Council's UK Corporate Governance Code 2024 applies Provision 29 to accounting periods beginning on or after 1 January 2026. It asks the board to monitor and review the risk management and internal control framework and make a declaration about the effectiveness of material controls at the balance sheet date. Read the Code and FRC guidance for the precise scope and reporting expectations. [FRC, UK Corporate Governance Code](https://www.frc.org.uk/library/standards-codes-policy/corporate-governance/uk-corporate-governance-code/) and [FRC, Code guidance](https://www.frc.org.uk/library/standards-codes-policy/corporate-governance/corporate-governance-code-guidance/)

![Material risks connected to control owners, test evidence and remediation](https://static.prod-images.emergentagent.com/jobs/sched-2866d31f-92d1-431d-ac9f-1a8d77fdfd4c-1791360060030/images/2c10eddf5a8b01a3c489b87db9a0b0c785abdc9e7eb765b74ad6d5e3184c548d.jpeg)

## Define what makes a control material

Start with the risks that could materially affect the organisation's strategy, operations, reporting or compliance. Identify the controls that address those risks and document why they are in scope. Record the control objective, owner, frequency, evidence source, reviewer and escalation route.

Do not confuse a long control inventory with a good control framework. Scope should be clear enough for management to explain and for the board to challenge. Where a control depends on another team, system or third party, name that dependency.

## Test operation, not policy language

A policy demonstrates intent. It does not prove that a control operated. Select evidence that matches the control design: approvals, reconciliations, access reviews, exception records or other relevant artefacts. Record the period tested, method, reviewer, outcome and any limitations.

For automated controls, document the system dependency and the evidence that the configuration and relevant access remained appropriate. For manual controls, define what good performance looks like and retain proof of review. Testing should be proportionate to the risk, but never invented after the event.

![Control testing chain showing operation, review and retained evidence](https://static.prod-images.emergentagent.com/jobs/sched-2866d31f-92d1-431d-ac9f-1a8d77fdfd4c-1791360060030/images/794f66a66f2219dc38f1cd37142e63b3eb0818cd821e09f873ad22f1ad48bd11.jpeg)

## Put exceptions on the record

When evidence is missing or a control fails, record the exception plainly. Assess its significance, assign an accountable owner, set remediation steps and agree a retest date. Escalate material weaknesses through the established governance route. A green status that hides an unresolved issue is not assurance.

Keep the evidence trail connected from risk to control, test result, issue and action. That makes it possible to see whether management has addressed the underlying cause or merely closed a ticket.

![Board assurance view of controls, open exceptions and corrective actions](https://static.prod-images.emergentagent.com/jobs/sched-2866d31f-92d1-431d-ac9f-1a8d77fdfd4c-1791360060030/images/21195868f864e08b198e5a02133e673d34119a2f324ceb3d411402b4e950c6f9.jpeg)

## Give the board a conclusion it can challenge

Before the annual report is finalised, assemble the scope, review activity, evidence, exceptions and remediation status. Explain changes in material risks and controls during the period. Make clear what remains unresolved and what the board is being asked to conclude.

Provision 29 is not solved by adding a sentence to the report. It requires a disciplined review that management can evidence and the board can challenge. Technology can organise ownership and records. It cannot make the judgement for directors.

---
Source: https://simplif-i.com/api/blog/readable/grc/grc-provision-29-testable-controls-evidence-20261007
Web Version: https://simplif-i.com/blog/grc/grc-provision-29-testable-controls-evidence-20261007
© Simplif-i - Unified Business Management Platform