# Provision 29: Build the Evidence Trail Before the Board Signs

**Category:** GRC
**Author:** John Hotham, CEO, Simplif-i
**Published:** 2026-10-06
**Read Time:** 3 min read

## Summary
For companies reporting against the UK Corporate Governance Code, a board declaration needs a defensible view of material controls, evidence and remediation.

## Full Content
# Provision 29: Build the Evidence Trail Before the Board Signs

A board declaration is the end of a control review, not the start of one. For companies reporting against the UK Corporate Governance Code 2024, Provision 29 requires the board to monitor the risk management and internal control framework and make a declaration about the effectiveness of material controls at the balance sheet date. The Code applies to accounting periods beginning on or after 1 January 2026. Read the Code and FRC guidance for the exact reporting expectations and scope. [FRC, UK Corporate Governance Code](https://www.frc.org.uk/library/standards-codes-policy/corporate-governance/uk-corporate-governance-code/) and [FRC, guidance](https://www.frc.org.uk/library/standards-codes-policy/corporate-governance/corporate-governance-code-guidance/)

This is not a claim that every control must be declared effective, or that the Code creates a new civil penalty regime. The board needs a supportable view of material controls, the review performed and any material weaknesses and actions disclosed in line with the Code and guidance.

![Material controls workflow from risk identification through evidence and board assurance](https://customer-assets-jai6qajn.emergentagent.net/wingman/26992fe9-5faf-46a6-964a-18031c56d2c1/attachments/4e118ee5239f41a38b26b80ac1e0b11f_grc-1.png)

## Define the scope before collecting evidence

Start with the risks that could materially affect the company's strategy, operations, reporting or compliance. Identify the controls that address those risks. Record the control objective, accountable owner, frequency, evidence source and escalation route. Keep the scope clear enough that management and the board can understand what is included and why.

Avoid a control catalogue built only to satisfy a spreadsheet. A control is useful when its operation can be tested against a defined risk and a real evidence source. Where a control relies on another team, system or external provider, make the dependency explicit.

![Evidence chain linking control owner, operation, testing and assurance](https://customer-assets-jai6qajn.emergentagent.net/wingman/26992fe9-5faf-46a6-964a-18031c56d2c1/attachments/fd48159ac4de4e4ea91253718176c5ca_grc-2.png)

## Test operation, not policy wording

A policy proves that a document exists. It does not, by itself, prove that a control operated. Collect evidence that matches the control design: approvals, reconciliations, access reviews, incident records, exception logs or other appropriate artefacts. Set a testing approach that matches the risk and retain the reviewer, period, sample and conclusion.

When evidence is absent or a control fails, record the issue without polishing it into a green status. Assign an owner, assess the impact, agree remediation and set a date for retesting. Escalate material issues through the governance route. Keep the board's review connected to the underlying evidence and management actions.

![Risk-to-assurance map showing material controls, exceptions and remediation](https://customer-assets-jai6qajn.emergentagent.net/wingman/26992fe9-5faf-46a6-964a-18031c56d2c1/attachments/00cb548fc3e64b72844cea28bd99e2c9_grc-3.png)

## Make the declaration a decision supported by records

Before the annual report is finalised, bring together the scoped control inventory, testing results, known exceptions, remediation status and board or committee review. The board should be able to challenge what is material, what evidence supports the conclusion and what remains unresolved. Document the discussion and the basis for the declaration.

Simplif-i's [GRC platform](https://simplif-i.com/grc) describes governance, risk and compliance support. Technology can organise evidence and ownership; it cannot make the board's judgement for it. The practical objective is simple: a clear line from material risk to control, evidence, review and action.

---
Source: https://simplif-i.com/api/blog/readable/grc/provision-29-evidence-before-board-signs-20261006
Web Version: https://simplif-i.com/blog/grc/provision-29-evidence-before-board-signs-20261006
© Simplif-i - Unified Business Management Platform