Material Controls Declaration Template (UK Code Provision 29)

Material Controls Declaration Working Paper: [Company name], [Financial year]

Board working paper that supports the annual statement on the risk management and internal control framework and the declaration on the effectiveness of material controls under the UK Corporate Governance Code 2024, Provision 29, which applies to financial years beginning on or after 2026-01-01 (the rest of the 2024 Code applies from years beginning on or after 2025-01-01). It covers the framework description, how the board defines material controls, the inventory of material controls, sources of assurance, monitoring through the year, the assessment at the balance sheet date, controls that did not operate effectively, and the draft annual report wording. The FRC Code and its Guidance are cited by name and provision number only; the GAO Green Book 2025 (US public domain) is used as the reference model for internal control components, and COSO is named only. Replace every [bracketed] value and every row marked Example. This is a document format, not legal, audit or accounting advice. Obtain the Code and its Guidance for the normative text.

Document control

Approvals

Revision history

Contents

1. Purpose, scope and basis
2. Governance and responsibilities
3. Risk management and internal control framework
4. How the board defines material controls
5. Material controls inventory
6. Sources of assurance
7. Monitoring and review during the year
8. Effectiveness assessment at the balance sheet date
9. Material controls not operating effectively
10. Draft annual report disclosure
11. Board approval and evidence pack
12. Improvement plan for next year
13. Glossary and references

1. Purpose, scope and basis

This working paper supports the board's annual report statement on how it has monitored and reviewed the company's risk management and internal control framework, and its declaration on whether the material controls were effective at the balance sheet date. The Code works on a comply or explain basis: a company that does not follow Provision 29 explains why in its corporate governance statement. This file assumes the company intends to comply.

Scope is the group as a whole. A control at a subsidiary, a shared service centre or an outsourced provider is in scope when it is a material control for the group.

Other regimes the group may also be under:

Example: Corvid Commerce Group plc applies the Code and is also an SEC foreign private issuer (Form 20-F) subject to SOX 404, so its ICFR assessment (compliance/icfr-management-assessment) supplies the evidence for the financial reporting material controls. The severity scale for financial reporting deficiencies is the SEC scale, documented in compliance/control-deficiency-evaluation, and the board reads the same ratings in both reports.

2. Governance and responsibilities

The board owns the framework and the declaration. Committees review in depth and recommend; management designs, operates and self-assesses the controls; internal audit gives independent assurance.

R = responsible, A = accountable, C = consulted, I = informed.

The audit committee's terms of reference should state its role in reviewing the internal control and risk management systems (UK Code Provision 25) and in reviewing this working paper before the board meeting. Where a separate risk committee oversees operational and compliance risk, split the inventory review between the two committees by control category and record the split in section 5.

3. Risk management and internal control framework

Describe the framework the board monitors. Keep the description factual and short enough to reuse in the annual report.

Example: Corvid describes its framework as five components that follow the public-domain Green Book 2025 model, which is structurally aligned with the COSO Internal Control framework the external auditor refers to. Principal risks are reviewed quarterly by the risk committee; each principal risk names the key controls that mitigate it; material controls are a subset of those key controls.

The link to principal risks is the backbone of the declaration. A material control that does not mitigate any principal risk is a sign that either the risk register or the inventory is incomplete. The reverse also matters: a principal risk with no material control needs an explanation (for example, the risk is accepted, transferred or managed by strategic choices rather than controls).

4. How the board defines material controls

Write the criteria the board approved. Each criterion should be testable: a reviewer must be able to say whether a given control meets it.

Record how the criteria were applied:

1. Start from every key control linked to a principal risk.
2. Apply CRIT-01 to CRIT-06; a control meeting at least one is a candidate.
3. Group candidates that work together into a single material control where they share an objective (for example "user access to financial systems" rather than twelve separate access controls).
4. Challenge the list with internal audit and the executive committee.
5. Present the list to the committees and the board for approval.

Example: Corvid's board approved six criteria in March 2026, applied them to 146 key controls (the 46 ICFR key controls in the risk and control matrix plus 100 operational and compliance key controls in the group control library), and approved 12 material controls (some grouped from several key controls). The board confirmed that operational and compliance controls (cyber, data protection, supplier continuity) are included alongside financial reporting controls.

5. Material controls inventory

Use one control ID convention across the ICFR and the wider control library (CTL-<process>-NNN, ITG-<domain>-NNN, ELC-NNN, as set in compliance/risk-control-matrix), so that a deficiency, a test and a material control can be joined without a mapping table. ICFR key controls come from the risk and control matrix; operational and compliance controls (security, continuity, third parties, data protection, sanctions, investor reporting) come from the group control library.

Keep a change log of the inventory. Additions, removals and regroupings during the year are approved by the overseeing committee and reported to the board in the year-end paper.

6. Sources of assurance

Set a minimum: every material control has at least first-line self-assessment and one independent source (second line, internal audit or external) during the year. Where the map shows "Low", either add a test before the balance sheet date or explain to the board why reliance on management evidence is enough.

The assurance map is also a planning tool. Reading across a row shows whether the same control is being tested three times by three teams while another control has no independent view at all. Agree with internal audit and the second line who tests what, and let the external auditor know, so that the work can be relied on rather than repeated.

Outsourced controls deserve particular care. When a service provider runs part of a material control, obtain its assurance report, check the period it covers against your year end, and confirm that the complementary controls the provider expects you to run are themselves tested.

7. Monitoring and review during the year

Monitoring should also catch change. When the business changes (a new system, an acquisition, a reorganisation, a new market), ask whether a material control is affected and whether the inventory needs updating. The Green Book 2025 added a stronger emphasis on assessing change in its risk assessment component, which is a useful reminder for any entity.

8. Effectiveness assessment at the balance sheet date

Rate each material control as at the balance sheet date using the scale below. A control remediated during the year is "effective" at year end only if the corrected control operated for a sufficient period and was retested before that date.

The rating is a judgement, not a count of test exceptions. Consider how close the failure is to the control's objective, whether other controls covered the same risk during the gap, how long the gap lasted, and whether the evidence is strong enough to support a conclusion at all. A control that could not be tested because records were missing is not "effective by default": insufficient evidence leads to "Not effective" unless other reliable evidence fills the gap. Record the reasoning for every rating other than a plain "Effective", and record who challenged it. Where the committee and management disagree, the committee's view and the reasons go to the board.

For financial reporting material controls, link the rating to the severity scale in compliance/control-deficiency-evaluation. A material weakness or an unremediated significant deficiency in the underlying key controls normally means "Not effective" for the material control.

Record the overall conclusion for the board in one paragraph. Example: "Eleven of the twelve material controls were effective as at 2026-12-31. MC-009 (assessment of critical third parties) was not operating effectively at that date because two annual assessments were overdue. No financial reporting material control was found ineffective. One significant deficiency in revenue controls identified in Q3 was remediated, and the corrected controls were tested and found to have operated in the final months of the year."

9. Material controls not operating effectively

Prior-year issues (from the second year of Provision 29):

Do not omit an issue because it was fixed shortly after the balance sheet date. The rating speaks to that date; later remediation can be mentioned as an action taken.

10. Draft annual report disclosure

Structure the annual report section in four parts and keep the evidence reference beside each paragraph while drafting. Remove the references before publication.

Example draft wording (Corvid, FY2026; original illustrative text, not a model required by any rule):

Risk management and internal control. The board is responsible for the group's risk management and internal control framework. During 2026 the audit committee and the risk committee reviewed the framework at each scheduled meeting on the board's behalf, drawing on quarterly certifications by control owners, testing by the finance and risk teams, five internal audit reviews and the external auditor's reports. In March 2026 the board approved the criteria it uses to identify material controls and an inventory of twelve material controls covering financial reporting, treasury, tax, information technology, cyber security, data protection, sanctions, third parties and investor reporting.

Declaration. Having considered this work, the board concludes that the group's material controls were effective as at 31 December 2026, with the exception described below.

Control not operating effectively. Annual reassessments of two of our fourteen critical suppliers were not completed by the year end, so the control over the security and continuity of critical third parties was not operating effectively at that date. No incident resulted. Interim assurance has been obtained, the full reassessments are due by 31 March 2027, and overdue assessments will be reported to the risk committee each quarter. During the year we also identified and fixed weaknesses in the review of deferred subscription revenue, in our US business and in the group review; the corrected controls were tested and found to have operated in the final months of the year.

Coordinate the wording with the audit committee report (finance/audit-committee-report) and with the viability and going concern statements, so that the same issue is not described differently in two places.

11. Board approval and evidence pack

Management certification to the board (Example wording, original): "To the best of our knowledge, after appropriate enquiry, the material controls listed in section 5 operated as described in section 8 as at the balance sheet date, and all known deficiencies and issues have been disclosed to the audit committee." Signed [CEO], [CFO], YYYY-MM-DD.

12. Improvement plan for next year

Revisit the criteria in section 4 each year. Strategy changes, acquisitions and new regulation can make a control material that was not before, or the reverse.

13. Glossary and references

References (obtain current versions):

• UK Corporate Governance Code 2024 (Financial Reporting Council), Provisions 25, 26 and 29; FRC Corporate Governance Code Guidance (names and numbers only).
• GAO, Standards for Internal Control in the Federal Government (Green Book), GAO-25-107721, 2025-05-15, effective from fiscal year 2026.
• COSO Internal Control, Integrated Framework (2013) (name only).
• SEC Regulation S-X Rule 1-02(a)(4), Regulation S-K Item 308 and Form 20-F Item 15 (for dual-listed groups), eCFR and sec.gov.
• Related templates: Control Deficiency Evaluation (compliance/control-deficiency-evaluation), ICFR Management Assessment (compliance/icfr-management-assessment), Risk and Control Matrix (compliance/risk-control-matrix), Audit Committee Report (finance/audit-committee-report), Risk Register (compliance/risk-register), Fraud Risk Assessment (compliance/fraud-risk-assessment), Internal Audit Charter and Plan (compliance/internal-audit-charter-and-plan), Board Pack (business/board-pack).

Standard and licence note

Structure aligned with the UK Corporate Governance Code 2024, Provision 29 (Financial Reporting Council), which is cited by name and provision number only: no Code or Guidance text is reproduced or paraphrased, and the criteria, inventory and wording here are original. Based on the GAO Green Book 2025 (a US government work) for the internal control component model. The COSO framework is named only. This template is not affiliated with or endorsed by the FRC, GAO or COSO. All names and figures in the examples are fictional. This template is original text written for this collection. Check the current official version of the Code and its Guidance before use. Template licence: MIT.