# Provision 29 Needs an Evidence Calendar, Not a Year-End Scramble

**Category:** GRC
**Author:** John Hotham, CEO, Simplif-i
**Published:** 2026-10-11
**Read Time:** 5 min read

## Summary
Build the material-controls review into the year. Assign evidence owners, review exceptions and give the board a traceable basis for its conclusion.

## Full Content
# Provision 29 Needs an Evidence Calendar, Not a Year-End Scramble

A board cannot make a credible annual conclusion from a last-minute collection of screenshots and assurances. The evidence has to be produced as controls operate, reviewed as issues emerge and brought together in a way directors can challenge.

For companies applying the UK Corporate Governance Code 2024, Provision 29 requires the board to monitor and review the risk management and internal control framework, and to make a declaration about the effectiveness of material controls in the annual report. The provision applies to financial years beginning on or after 1 January 2026. [FRC, UK Corporate Governance Code 2024](https://www.frc.org.uk/library/standards-codes-policy/corporate-governance/uk-corporate-governance-code/) [FRC, Corporate Governance Code Guidance](https://www.frc.org.uk/library/standards-codes-policy/corporate-governance/corporate-governance-code-guidance/)

![Material control evidence gathered into an auditable framework](https://static.prod-images.emergentagent.com/jobs/sched-2866d31f-92d1-431d-ac9f-1a8d77fdfd4c-1791705660033/images/882fe296da73b67a2117493c85f0861960a9c8b9534502a6b6c0c5c951bcf5e0.jpeg)

## Define the material controls and owners

Start with the risks that matter to this organisation. Record why each selected control is material, what risk it addresses, who operates it, who reviews it, how often it runs and what evidence should exist. The scope should reflect the company, not a generic checklist copied without challenge.

A policy statement is not proof that a control operated. Define the evidence in advance: a review record, reconciliation, access log, approval, exception report or other artefact appropriate to the control. State the period covered and who is responsible for retaining it.

## Schedule evidence and challenge through the year

Set an evidence calendar linked to control frequency and board reporting. Allow time to review results, test samples where appropriate, investigate gaps and escalate issues. Record late or missing evidence as an exception rather than silently treating it as complete.

Bring together control-owner attestations with relevant monitoring, incidents, assurance findings and remediation updates. Challenge stale evidence and self-certification that has no corroboration. The board needs a concise account of how the framework was monitored and reviewed, not an unfiltered file dump.

![Board review of control effectiveness and open exceptions](https://static.prod-images.emergentagent.com/jobs/sched-2866d31f-92d1-431d-ac9f-1a8d77fdfd4c-1791705660033/images/6e09c82c10097422cd630776aee30f97d6ea5b9994a697bd48318580547ee242.jpeg)

## Make exceptions decision-ready

For each material control that did not operate as expected, record the issue, period, impact assessment, interim safeguards, accountable executive, corrective action and target date. Show what evidence will demonstrate closure. Escalate repeat failures and overdue actions.

Do not hide a weakness behind an optimistic status label. The FRC Code’s reporting expectation includes disclosure of material controls that were not operating effectively and action taken or proposed. Confirm the exact reporting approach against the Code and guidance applicable to the company. [FRC, UK Corporate Governance Code 2024](https://www.frc.org.uk/library/standards-codes-policy/corporate-governance/uk-corporate-governance-code/)

![Traceable assurance path from a control owner to board conclusion](https://static.prod-images.emergentagent.com/jobs/sched-2866d31f-92d1-431d-ac9f-1a8d77fdfd4c-1791705660033/images/01cc590c38405955cea5834849f8b9c35b19835f4ef58eda73d5c4f8e39741e9.jpeg)

## Give the board a reviewable conclusion

Before the annual report is drafted, present the scope, monitoring performed, evidence reviewed, exceptions, remediation and proposed declaration in one traceable pack. Make clear what was effective at the relevant date and what was not. Record challenge, decisions and actions.

Provision 29 is not a wording exercise. It is a test of whether the organisation can show how its material controls worked, where they did not and what leadership did about it. Start the evidence process early, keep ownership explicit and let the conclusion follow the facts.

---
Source: https://simplif-i.com/api/blog/readable/grc/grc-provision29-evidence-calendar-20261011
Web Version: https://simplif-i.com/blog/grc/grc-provision29-evidence-calendar-20261011
© Simplif-i - Unified Business Management Platform