# Material Controls Declaration Working Paper: [Company name], [Financial year]

> Board working paper that supports the annual statement on the risk
> management and internal control framework and the declaration on the
> effectiveness of material controls under the UK Corporate Governance
> Code 2024, Provision 29, which applies to financial years beginning on
> or after 2026-01-01 (the rest of the 2024 Code applies from years
> beginning on or after 2025-01-01). It covers the framework description,
> how the board defines material controls, the inventory of material
> controls, sources of assurance, monitoring through the year, the
> assessment at the balance sheet date, controls that did not operate
> effectively, and the draft annual report wording. The FRC Code and its
> Guidance are cited by name and provision number only; the GAO Green
> Book 2025 (US public domain) is used as the reference model for
> internal control components, and COSO is named only. Replace every
> `[bracketed]` value and every row marked *Example*. This is a document
> format, not legal, audit or accounting advice. Obtain the Code and its
> Guidance for the normative text.

<!--
Guidance: How to use this template
- Purpose: give the board one evidence file for the Provision 29
  statement, so that every sentence in the annual report can be traced
  to a control, an owner, a test and a conclusion.
- Fill section 4 (how the board decides what is "material") before the
  inventory in section 5. The Code leaves the definition to the board;
  an inventory built without agreed criteria is hard to defend.
- Work back from the balance sheet date: the declaration speaks to that
  date, so plan the testing and remediation calendar (section 7) early
  in the year.
- The worked example is fictional: Corvid Commerce Group plc, a SaaS
  retailer listed in London with American depositary shares listed in
  New York, applying the Code, reporting under IFRS in EUR, calendar
  financial year, subsidiaries in Germany, the UK, the US and Vietnam.
  It is also an SEC foreign private issuer filing Form 20-F. FY2026 is
  its first year under Provision 29.
- Common pitfall: treating the declaration as a financial reporting
  (SOX-style) exercise only. Material controls can be operational,
  reporting and compliance controls too, for example cyber resilience,
  data protection or supplier continuity.
-->

## Document control

<!-- Guidance: This file is board evidence. Record the owner, the committee that reviews it and the board meeting that approves the annual report. Keep superseded versions. -->

| Field | Value |
|---|---|
| Document ID | [GOV-P29-2026] |
| Company | [Legal name] (*Example:* Corvid Commerce Group plc) |
| Financial year | [YYYY-MM-DD to YYYY-MM-DD] (*Example:* 2026-01-01 to 2026-12-31) |
| Balance sheet date (declaration date) | [YYYY-MM-DD] (*Example:* 2026-12-31) |
| Code edition | UK Corporate Governance Code 2024 (Provision 29 from years beginning on or after 2026-01-01) |
| First year of Provision 29 | [Yes / No] |
| Framework reference | [Internal control framework name] (*Example:* GAO Green Book 2025 component model; COSO named for comparison) |
| Version | [1.0] |
| Status | [Draft / Reviewed by committee / Approved by board] |
| Owner | [@company-secretary] with [@head-of-risk] |
| Approvers/reviewers | [@audit-committee-chair], [@risk-committee-chair], [@cfo], [@head-of-internal-audit] |
| Last updated | YYYY-MM-DD |
| Classification | Board confidential |
| Related documents | [Principal risks register], [Control deficiency evaluations], [Internal audit annual opinion], [Audit committee report] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Audit committee | [Meeting reference] | [Recommend to board / Return] | YYYY-MM-DD |
| Risk committee (if separate) | [Meeting reference] | [Recommend / Return] | YYYY-MM-DD |
| Board | [Meeting reference] | [Approve statement and declaration] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | Criteria and draft inventory for board approval |
| 0.5 | YYYY-MM-DD | [@name] | Half-year monitoring results |
| 1.0 | YYYY-MM-DD | [@name] | Year-end assessment and draft disclosure |
| 1.1 | 2026-10-25 | [@name] | Updated to Corvid's Form 20-F status, RCM control IDs, the FY2026 deficiency register (AGG-01) and internal audit coverage of revenue |

## Contents

1. [Purpose, scope and basis](#1-purpose-scope-and-basis)
2. [Governance and responsibilities](#2-governance-and-responsibilities)
3. [Risk management and internal control framework](#3-risk-management-and-internal-control-framework)
4. [How the board defines material controls](#4-how-the-board-defines-material-controls)
5. [Material controls inventory](#5-material-controls-inventory)
6. [Sources of assurance](#6-sources-of-assurance)
7. [Monitoring and review during the year](#7-monitoring-and-review-during-the-year)
8. [Effectiveness assessment at the balance sheet date](#8-effectiveness-assessment-at-the-balance-sheet-date)
9. [Material controls not operating effectively](#9-material-controls-not-operating-effectively)
10. [Draft annual report disclosure](#10-draft-annual-report-disclosure)
11. [Board approval and evidence pack](#11-board-approval-and-evidence-pack)
12. [Improvement plan for next year](#12-improvement-plan-for-next-year)
13. [Glossary and references](#13-glossary-and-references)

## 1. Purpose, scope and basis

<!-- Guidance: Say which companies and which entities the declaration covers, and how this regime sits beside others the group is subject to. Pitfall: forgetting that subsidiaries' controls are in scope when they are material to the group. -->

This working paper supports the board's annual report statement on how
it has monitored and reviewed the company's risk management and internal
control framework, and its declaration on whether the material controls
were effective at the balance sheet date. The Code works on a comply or
explain basis: a company that does not follow Provision 29 explains why
in its corporate governance statement. This file assumes the company
intends to comply.

Scope is the group as a whole. A control at a subsidiary, a shared
service centre or an outsourced provider is in scope when it is a
material control for the group.

| Item | Position as of 2026-10 (check the current Code and listing rules) |
|---|---|
| Who applies the Code | Companies whose equity shares are listed in the commercial companies category (and certain other categories) under the UK Listing Rules, and others that choose to apply it; check the current listing rules |
| Code edition | UK Corporate Governance Code 2024 |
| Provision 29 effective | Financial years beginning on or after 2026-01-01 |
| Rest of the 2024 Code effective | Financial years beginning on or after 2025-01-01 |
| First annual reports with the declaration | Calendar-year companies: annual reports for FY2026, published in 2027 |
| External assurance on the declaration | Not required by the Code itself; the board decides whether to seek assurance |
| Supporting guidance | FRC Corporate Governance Code Guidance (name only; obtain the current version) |

Other regimes the group may also be under:

| Regime | Relationship to this paper |
|---|---|
| US SOX sections 302 and 404, SEC Item 308 or Form 20-F Item 15 (dual-listed groups; Corvid: yes, Form 20-F) | Covers financial reporting controls only, with defined severity levels. Reuse the testing; do not assume it covers operational or compliance material controls |
| EU or UK sector rules (banking, insurance, payments) | Supervisors may already require internal control reports; map them into section 6 as sources of assurance |
| GAO Green Book 2025 | US federal standard; used here only as a public-domain reference for internal control components |

*Example:* Corvid Commerce Group plc applies the Code and is also an
SEC foreign private issuer (Form 20-F) subject to SOX 404, so its ICFR
assessment (`compliance/icfr-management-assessment`) supplies the
evidence for the financial reporting material controls. The severity
scale for financial reporting deficiencies is the SEC scale, documented
in `compliance/control-deficiency-evaluation`, and the board reads the
same ratings in both reports.

## 2. Governance and responsibilities

<!-- Guidance: Name the board committee that does the detailed review and the executives who own each part. Make clear that the declaration is the board's, not management's. Pitfall: delegating the whole topic to the audit committee when many material controls are operational or cyber controls overseen elsewhere. -->

The board owns the framework and the declaration. Committees review in
depth and recommend; management designs, operates and self-assesses the
controls; internal audit gives independent assurance.

| Activity | Board | Audit committee | Risk committee | CFO / finance | Chief risk officer | Internal audit | Control owners |
|---|---|---|---|---|---|---|---|
| Approve criteria for material controls | A | R | C | C | R | C | I |
| Approve the inventory of material controls | A | R | R | C | R | C | I |
| Design and operate controls | I | I | I | R (finance) | R (risk) | I | R |
| Self-assessment and certification | I | I | I | R | R | C | R |
| Independent testing and annual opinion | I | A | I | I | I | R | C |
| Year-end assessment and draft disclosure | A | R | R | R | R | C | C |
| Approve the annual report statement | A | C | C | C | C | I | I |

R = responsible, A = accountable, C = consulted, I = informed.

The audit committee's terms of reference should state its role in
reviewing the internal control and risk management systems (UK Code
Provision 25) and in reviewing this working paper before the board
meeting. Where a separate risk committee oversees operational and
compliance risk, split the inventory review between the two committees
by control category and record the split in section 5.

## 3. Risk management and internal control framework

<!-- Guidance: Describe the framework in your own words: the components, the processes that keep it working and the link to principal risks. Name any external framework used as a reference by name only. Pitfall: copying a framework's principle statements into the annual report. -->

Describe the framework the board monitors. Keep the description factual
and short enough to reuse in the annual report.

| Component (Green Book 2025 component name) | How it works at the company | Evidence |
|---|---|---|
| Control environment | [Code of conduct, board oversight, organisation, competence, accountability] | [Policies, board minutes] |
| Risk assessment | [Principal and emerging risk process, fraud risk assessment, change assessment] | [Risk register, fraud risk assessment] |
| Control activities | [Process controls, IT general controls, policies and procedures] | [Risk and control matrices] |
| Information and communication | [Management reporting, whistleblowing channel, external reporting controls] | [Reporting calendar, speak-up reports] |
| Monitoring | [Self-assessment, second-line reviews, internal audit, deficiency tracking] | [Monitoring calendar, internal audit opinion] |

*Example:* Corvid describes its framework as five components that follow
the public-domain Green Book 2025 model, which is structurally aligned
with the COSO Internal Control framework the external auditor refers
to. Principal risks are reviewed quarterly by the risk committee; each
principal risk names the key controls that mitigate it; material
controls are a subset of those key controls.

The link to principal risks is the backbone of the declaration. A
material control that does not mitigate any principal risk is a sign
that either the risk register or the inventory is incomplete. The
reverse also matters: a principal risk with no material control needs an
explanation (for example, the risk is accepted, transferred or managed
by strategic choices rather than controls).

## 4. How the board defines material controls

<!-- Guidance: Agree written criteria before choosing controls. Use criteria the board can apply consistently year to year. The FRC Guidance discusses factors boards may consider; read it, but write criteria in your own words for your business. Pitfall: equating "material" with "financial statement materiality" only. -->

Write the criteria the board approved. Each criterion should be
testable: a reviewer must be able to say whether a given control meets
it.

| Criterion ID | Criterion (company wording) | Example threshold or test |
|---|---|---|
| CRIT-01 | Failure could cause a material misstatement in the published financial statements | Potential misstatement at or above group overall materiality (*Example:* EUR 700k) |
| CRIT-02 | Failure could threaten the viability or continuity of the business model | Outage, loss or event that would breach the going concern or viability scenarios |
| CRIT-03 | Failure could lead to a serious breach of law or regulation | Fines, licence loss, or personal liability for directors |
| CRIT-04 | Failure could cause severe harm to customers, employees or the public | Large-scale personal data breach, safety incident |
| CRIT-05 | The control mitigates a principal risk and no other control reduces that risk to within appetite | Single point of failure in the principal risk register |
| CRIT-06 | Failure would materially damage the integrity of reporting to investors other than the financial statements (for example sustainability metrics or alternative performance measures) | Restatement of a published KPI |

Record how the criteria were applied:

1. Start from every key control linked to a principal risk.
2. Apply CRIT-01 to CRIT-06; a control meeting at least one is a
   candidate.
3. Group candidates that work together into a single material control
   where they share an objective (for example "user access to financial
   systems" rather than twelve separate access controls).
4. Challenge the list with internal audit and the executive committee.
5. Present the list to the committees and the board for approval.

*Example:* Corvid's board approved six criteria in March 2026, applied
them to 146 key controls (the 46 ICFR key controls in the risk and
control matrix plus 100 operational and compliance key controls in the
group control library), and approved 12 material controls (some
grouped from several key controls). The board confirmed that
operational and compliance controls (cyber, data protection, supplier
continuity) are included alongside financial reporting controls.

## 5. Material controls inventory

<!-- Guidance: One row per material control with its owner, criteria, principal risk, underlying key controls and planned assurance. Keep IDs stable year to year. Pitfall: listing control areas ("revenue") instead of controls with an objective that can be tested. -->

| MC ID | Material control (objective) | Category | Criteria met | Principal risk | Underlying key controls | Owner | Overseeing committee |
|---|---|---|---|---|---|---|---|
| MC-001 *(Example)* | Group consolidation and financial statement close is complete and accurate | Financial reporting | CRIT-01 | PR-04 Financial reporting | CTL-R2R-010 to CTL-R2R-014, ELC-006, ELC-008 | [@group-financial-controller] | Audit |
| MC-002 *(Example)* | Manual journals are authorised and reviewed before posting | Financial reporting | CRIT-01 | PR-04 | CTL-R2R-002 | [@group-financial-controller] | Audit |
| MC-003 *(Example)* | Subscription revenue and deferred revenue are recognised in the right period and amount | Financial reporting | CRIT-01, CRIT-05 | PR-04 | CTL-REV-001 to CTL-REV-004, CTL-REV-007, CTL-REV-008 | [@head-of-revenue-accounting] | Audit |
| MC-004 *(Example)* | Payments are made only to approved suppliers with verified bank details | Financial and fraud | CRIT-01, CRIT-03 | PR-07 Fraud | CTL-P2P-002, CTL-P2P-006 | [@head-of-shared-services] | Audit |
| MC-005 *(Example)* | Treasury: daily cash positioning, counterparty limits and dual authorisation of transfers | Operational | CRIT-02 | PR-05 Liquidity | CTL-TRY-001 to CTL-TRY-005 | [@group-treasurer] | Audit |
| MC-006 *(Example)* | Tax provisions and transfer pricing positions are reviewed and supported | Financial and compliance | CRIT-01, CRIT-03 | PR-08 Tax | CTL-TAX-002, CTL-TAX-005 | [@head-of-tax] | Audit |
| MC-007 *(Example)* | Access to financial systems is restricted and reviewed (including privileged access) | IT general control | CRIT-01, CRIT-05 | PR-04, PR-01 Cyber | ITG-ACC-001 to ITG-ACC-008 | [@cio] | Audit |
| MC-008 *(Example)* | Cyber incidents are detected, escalated and contained within defined times; backups restore critical systems | Operational | CRIT-02, CRIT-04 | PR-01 Cyber | CTL-SEC-010, CTL-SEC-014, CTL-BCP-003 | [@ciso] | Risk |
| MC-009 *(Example)* | Critical third parties are assessed for security and continuity before onboarding and annually | Operational and compliance | CRIT-02, CRIT-03 | PR-06 Third parties | CTL-TPR-001, CTL-TPR-003 | [@head-of-procurement] | Risk |
| MC-010 *(Example)* | Personal data processing is recorded, assessed and subject to breach notification within legal deadlines | Compliance | CRIT-03, CRIT-04 | PR-03 Data protection | CTL-DPR-001, CTL-DPR-005 | [@dpo] | Risk |
| MC-011 *(Example)* | Sanctions screening of customers and marketplace sellers before onboarding and on list updates | Compliance | CRIT-03 | PR-09 Regulatory | CTL-SAN-001, CTL-SAN-002 | [@head-of-compliance] | Risk |
| MC-012 *(Example)* | Alternative performance measures and sustainability metrics in the annual report are defined, reconciled and reviewed | Reporting | CRIT-06 | PR-04 | CTL-APM-001, CTL-ESG-003 | [@head-of-investor-relations] | Audit |

Use one control ID convention across the ICFR and the wider control
library (`CTL-<process>-NNN`, `ITG-<domain>-NNN`, `ELC-NNN`, as set in
`compliance/risk-control-matrix`), so that a deficiency, a test and a
material control can be joined without a mapping table. ICFR key
controls come from the risk and control matrix; operational and
compliance controls (security, continuity, third parties, data
protection, sanctions, investor reporting) come from the group control
library.

Keep a change log of the inventory. Additions, removals and regroupings
during the year are approved by the overseeing committee and reported
to the board in the year-end paper.

| Date | Change | Reason | Approved by |
|---|---|---|---|
| 2026-06-30 *(Example)* | MC-012 added | Board decided published APMs meet CRIT-06 after investor feedback | Audit committee |
| [YYYY-MM-DD] | [Change] | [Reason] | [Committee] |

## 6. Sources of assurance

<!-- Guidance: Build an assurance map for each material control. The declaration should rest on more than management's own view for the highest-risk controls. Pitfall: counting the external audit of the financial statements as assurance over controls it did not test. -->

| MC ID | First line: owner self-assessment | Second line: risk, compliance or finance review | Third line: internal audit | External: auditor, SOC 1 / ISAE 3402 or other reports | Assurance level |
|---|---|---|---|---|---|
| MC-001 *(Example)* | Quarterly certification | Group finance review of entity packs | Audit IA-2026-03 | Auditor's controls testing (partial reliance) | High |
| MC-003 *(Example)* | Monthly evidence of review | Internal control team testing of CTL-REV-007 (TW-2026-REV-007) | Internal audit testing of CTL-REV-004 (TW-2026-REV-004) and the remediation retests | Auditor's integrated audit of revenue controls and substantive testing | High |
| MC-007 *(Example)* | Quarterly access reviews | IT risk testing | Audit IA-2026-07 | SOC 1 Type 2 report for hosted ERP | High |
| MC-008 *(Example)* | Monthly security metrics | Annual incident simulation | Audit IA-2026-09 | Penetration test report | Medium |
| MC-009 *(Example)* | Supplier assessment tracker | Procurement risk review | Not in 2026 plan | None | Low |
| [MC-ID] | [Source] | [Source] | [Source] | [Source] | [High / Medium / Low] |

Set a minimum: every material control has at least first-line
self-assessment and one independent source (second line, internal
audit or external) during the year. Where the map shows "Low", either
add a test before the balance sheet date or explain to the board why
reliance on management evidence is enough.

The assurance map is also a planning tool. Reading across a row shows
whether the same control is being tested three times by three teams
while another control has no independent view at all. Agree with
internal audit and the second line who tests what, and let the external
auditor know, so that the work can be relied on rather than repeated.

Outsourced controls deserve particular care. When a service provider
runs part of a material control, obtain its assurance report, check the
period it covers against your year end, and confirm that the
complementary controls the provider expects you to run are themselves
tested.

## 7. Monitoring and review during the year

<!-- Guidance: Show the annual calendar that leads to the declaration: when owners certify, when tests run, when committees review, and the cut-off for remediation before year end. Pitfall: testing everything in Q4, leaving no time to fix and retest. -->

```mermaid
flowchart LR
    A[Q1: approve criteria and inventory] --> B[Q2: first owner certifications and second-line tests]
    B --> C[Half-year: committee review of results]
    C --> D[Q3: internal audit fieldwork and remediation]
    D --> E[Q4: retests and roll-forward to year end]
    E --> F[Year end: assessment as at balance sheet date]
    F --> G[Committees review draft statement]
    G --> H[Board approves annual report]
```

| Activity | Frequency | Timing (*Example* FY2026) | Output |
|---|---|---|---|
| Owner self-assessment and certification | Quarterly | April, July, October, January | Certification log |
| Second-line testing | Per plan | February to November | Test workpapers |
| Internal audit reviews of material controls | Per audit plan | March to October | Audit reports |
| Deficiency evaluation and aggregation | Ongoing; formal quarterly | Each quarter | `compliance/control-deficiency-evaluation` |
| Committee review of status | Each meeting | March, July, October, February | Committee papers |
| Remediation cut-off for year-end retest | Annual | Monthly controls fixed by 2026-10-31 | Remediation tracker |
| Roll-forward procedures to year end | Annual | December and January | Roll-forward memo |
| Board review of the draft statement | Annual | February 2027 | Board paper |

Monitoring should also catch change. When the business changes (a new
system, an acquisition, a reorganisation, a new market), ask whether a
material control is affected and whether the inventory needs updating.
The Green Book 2025 added a stronger emphasis on assessing change in its
risk assessment component, which is a useful reminder for any entity.

## 8. Effectiveness assessment at the balance sheet date

<!-- Guidance: Use one rating scale for every material control, apply it as at the balance sheet date, and keep the evidence. Pitfall: concluding "effective" because a deficiency found in the year has been fixed, without a retest proving the fix operated before year end. -->

Rate each material control as at the balance sheet date using the scale
below. A control remediated during the year is "effective" at year end
only if the corrected control operated for a sufficient period and was
retested before that date.

| Rating | Meaning (company scale) |
|---|---|
| Effective | Designed appropriately and operated as designed as at the balance sheet date; any deficiencies found are minor and do not undermine the objective |
| Effective, with improvements | Effective as above; improvement actions open that do not affect the objective |
| Not effective | The control did not meet its objective as at the balance sheet date, or evidence is insufficient to conclude |

The rating is a judgement, not a count of test exceptions. Consider
how close the failure is to the control's objective, whether other
controls covered the same risk during the gap, how long the gap lasted,
and whether the evidence is strong enough to support a conclusion at
all. A control that could not be tested because records were missing is
not "effective by default": insufficient evidence leads to "Not
effective" unless other reliable evidence fills the gap. Record the
reasoning for every rating other than a plain "Effective", and record
who challenged it. Where the committee and management disagree, the
committee's view and the reasons go to the board.

For financial reporting material controls, link the rating to the
severity scale in `compliance/control-deficiency-evaluation`. A material
weakness or an unremediated significant deficiency in the underlying key
controls normally means "Not effective" for the material control.

| MC ID | Deficiencies in the year | Remediated and retested before year end? | Rating as at balance sheet date | Evidence |
|---|---|---|---|---|
| MC-001 *(Example)* | None | Not applicable | Effective | IA-2026-03; certifications |
| MC-003 *(Example)* | DEF-2026-001 (CTL-REV-007) and DEF-2026-003 (CTL-REV-004), aggregated as significant deficiency AGG-01, reported to the audit committee on 2026-10-14 | Yes: retests of the October and November operation passed by 2026-12-15; December operation confirmed in roll-forward testing in January 2027 | Effective | CDE-2026; TW-2026-REV-004 and TW-2026-REV-007, version 1.1 |
| MC-007 *(Example)* | DEF-2026-002 (ITG-ACC-002, control deficiency) | Yes: October and November monthly privileged access reviews retested by 2026-12-15; December review in roll-forward | Effective | CDE-2026; IA-2026-07 follow-up |
| MC-008 *(Example)* | Incident simulation found escalation slower than target | Partly; retest scheduled 2027-03 | Effective, with improvements | Simulation report SIM-2026 |
| MC-009 *(Example)* | Annual assessment overdue for 2 of 14 critical suppliers at year end | No | Not effective | Supplier tracker, risk review RR-2026-11 |
| MC-010 to MC-012 *(Example)* | None | Not applicable | Effective | Certifications, second-line tests |
| [MC-ID] | [Summary] | [Yes / No] | [Rating] | [Reference] |

Record the overall conclusion for the board in one paragraph. *Example:*
"Eleven of the twelve material controls were effective as at 2026-12-31.
MC-009 (assessment of critical third parties) was not operating
effectively at that date because two annual assessments were overdue.
No financial reporting material control was found ineffective. One
significant deficiency in revenue controls identified in Q3 was
remediated, and the corrected controls were tested and found to have
operated in the final months of the year."

## 9. Material controls not operating effectively

<!-- Guidance: For every control rated "Not effective", record what failed, the consequence, what has been done and what is planned, with owners and dates. From the second year, also track issues reported in the prior year. Pitfall: vague actions with no date, which the board cannot monitor. -->

| ID | MC ID | What did not operate effectively | Consequence and exposure | Action taken | Action planned | Owner | Target date | Status |
|---|---|---|---|---|---|---|---|---|
| ISS-2026-01 *(Example)* | MC-009 | Annual security and continuity reassessment not completed for two critical suppliers (payments gateway and warehouse management SaaS) by year end | No incident occurred; exposure is undetected deterioration of supplier controls for services that support order processing | Interim questionnaires obtained in January 2027; SOC 2 report received for one supplier | Complete both full reassessments; add an automated reminder 90 days before due date; quarterly committee reporting on overdue assessments | [@head-of-procurement] | 2027-03-31 | Open |
| [ISS-ID] | [MC-ID] | [Description] | [Consequence] | [Done] | [Planned] | [@owner] | YYYY-MM-DD | [Status] |

Prior-year issues (from the second year of Provision 29):

| ID | Reported in | Action promised | Outcome | Closed on |
|---|---|---|---|---|
| [ISS-ID] | [FY] | [Action] | [Done / Partly / Not done, explanation] | YYYY-MM-DD |

Do not omit an issue because it was fixed shortly after the balance
sheet date. The rating speaks to that date; later remediation can be
mentioned as an action taken.

## 10. Draft annual report disclosure

<!-- Guidance: Draft the statement in plain language and trace every sentence to sections 3 to 9. Read the Code and the FRC Guidance for what the statement should cover; do not copy their wording. Pitfall: boilerplate that would fit any company. -->

Structure the annual report section in four parts and keep the evidence
reference beside each paragraph while drafting. Remove the references
before publication.

| Part | Content | Evidence |
|---|---|---|
| A. How the board monitored and reviewed the framework | Committees, cadence, sources of assurance, scope of review | Sections 2, 6, 7 |
| B. Declaration on material controls as at the balance sheet date | Board's conclusion on effectiveness | Section 8 |
| C. Material controls that did not operate effectively | Description, actions taken and planned | Section 9 |
| D. Prior-year issues (second year onwards) | Progress on previously reported matters | Section 9 |

*Example* draft wording (Corvid, FY2026; original illustrative text, not
a model required by any rule):

> **Risk management and internal control.** The board is responsible for
> the group's risk management and internal control framework. During
> 2026 the audit committee and the risk committee reviewed the framework
> at each scheduled meeting on the board's behalf, drawing on quarterly
> certifications by control owners, testing by the finance and risk
> teams, five internal audit reviews and the external auditor's reports.
> In March 2026 the board approved the criteria it uses to identify
> material controls and an inventory of twelve material controls covering
> financial reporting, treasury, tax, information technology, cyber
> security, data protection, sanctions, third parties and investor
> reporting.
>
> **Declaration.** Having considered this work, the board concludes that
> the group's material controls were effective as at 31 December 2026,
> with the exception described below.
>
> **Control not operating effectively.** Annual reassessments of two of
> our fourteen critical suppliers were not completed by the year end, so
> the control over the security and continuity of critical third parties
> was not operating effectively at that date. No incident resulted.
> Interim assurance has been obtained, the full reassessments are due by
> 31 March 2027, and overdue assessments will be reported to the risk
> committee each quarter. During the year we also identified and fixed
> weaknesses in the review of deferred subscription revenue, in our US
> business and in the group review; the corrected controls were tested
> and found to have operated in the final months of the year.

Coordinate the wording with the audit committee report
(`finance/audit-committee-report`) and with the viability and going
concern statements, so that the same issue is not described differently
in two places.

## 11. Board approval and evidence pack

<!-- Guidance: List what the board receives before approving the statement and record the decision. Pitfall: the board receiving only the draft wording, not the assessment behind it. -->

| Item in the board pack | Prepared by | Included |
|---|---|---|
| This working paper, sections 1 to 10 | Company secretary and head of risk | [Yes / No] |
| Audit committee chair's report on its review | Audit committee chair | [Yes / No] |
| Risk committee chair's report on its review | Risk committee chair | [Yes / No] |
| Internal audit annual opinion | Head of internal audit | [Yes / No] |
| CFO and CEO certification to the board | CFO, CEO | [Yes / No] |
| External auditor's views on controls (from its report to the audit committee) | Audit committee chair | [Yes / No] |
| Draft annual report statement (section 10) | Company secretary | [Yes / No] |

Management certification to the board (*Example* wording, original):
"To the best of our knowledge, after appropriate enquiry, the material
controls listed in section 5 operated as described in section 8 as at
the balance sheet date, and all known deficiencies and issues have been
disclosed to the audit committee." Signed [CEO], [CFO], YYYY-MM-DD.

| Board decision | Value |
|---|---|
| Meeting | [Reference] |
| Date | YYYY-MM-DD |
| Decision | [Approved / Approved with changes / Deferred] |
| Changes requested | [Text] |

## 12. Improvement plan for next year

<!-- Guidance: Record lessons from this cycle and the changes to criteria, inventory, assurance and timing. Pitfall: repeating a compressed Q4 testing calendar every year. -->

| ID | Improvement | Reason | Owner | Due |
|---|---|---|---|---|
| IMP-01 *(Example)* | Add internal audit coverage of MC-009 and of the entity-level revenue review CTL-REV-007 in the 2027 plan | MC-009 rated Low in 2026; DEF-2026-001 was found by the internal control team, not internal audit | [@head-of-internal-audit] | 2027-01-31 |
| IMP-02 *(Example)* | Move the remediation cut-off for monthly controls to 2027-09-30 | Three remediation retests in 2026 finished on 2026-12-15, leaving little margin before year end | [@head-of-internal-control] | 2027-02-28 |
| IMP-03 *(Example)* | Automate certifications in the governance, risk and compliance tool | Manual tracking delayed Q3 certifications | [@head-of-risk] | 2027-06-30 |
| [IMP-ID] | [Improvement] | [Reason] | [@owner] | YYYY-MM-DD |

Revisit the criteria in section 4 each year. Strategy changes,
acquisitions and new regulation can make a control material that was
not before, or the reverse.

## 13. Glossary and references

<!-- Guidance: Define the terms the board will see in the paper and in the annual report. Cite sources by name and number; obtain the current texts. -->

| Term | Meaning in this template |
|---|---|
| Material control | A control the board judges material to the company, using the criteria in section 4 |
| Key control | A control relied on to mitigate a significant risk; material controls are a subset |
| Assurance map | A table showing which lines of defence and external providers give assurance over each control |
| Balance sheet date | The financial year end; the declaration speaks to this date |
| Comply or explain | The Code's basis: a company follows a provision or explains why it does not |
| Roll-forward | Procedures that extend conclusions from the last test date to the balance sheet date |

References (obtain current versions):

- UK Corporate Governance Code 2024 (Financial Reporting Council), Provisions 25, 26 and 29; FRC Corporate Governance Code Guidance (names and numbers only).
- GAO, Standards for Internal Control in the Federal Government (Green Book), GAO-25-107721, 2025-05-15, effective from fiscal year 2026.
- COSO Internal Control, Integrated Framework (2013) (name only).
- SEC Regulation S-X Rule 1-02(a)(4), Regulation S-K Item 308 and Form 20-F Item 15 (for dual-listed groups), eCFR and sec.gov.
- Related templates: Control Deficiency Evaluation (`compliance/control-deficiency-evaluation`), ICFR Management Assessment (`compliance/icfr-management-assessment`), Risk and Control Matrix (`compliance/risk-control-matrix`), Audit Committee Report (`finance/audit-committee-report`), Risk Register (`compliance/risk-register`), Fraud Risk Assessment (`compliance/fraud-risk-assessment`), Internal Audit Charter and Plan (`compliance/internal-audit-charter-and-plan`), Board Pack (`business/board-pack`).

## Standard and licence note

Structure aligned with the UK Corporate Governance Code 2024, Provision
29 (Financial Reporting Council), which is cited by name and provision
number only: no Code or Guidance text is reproduced or paraphrased, and
the criteria, inventory and wording here are original. Based on the GAO
Green Book 2025 (a US government work) for the internal control
component model. The COSO framework is named only. This template is not
affiliated with or endorsed by the FRC, GAO or COSO. All names and
figures in the examples are fictional. This template is original text
written for this collection. Check the current official version of the
Code and its Guidance before use. Template licence: MIT.