Building the Board’s Evidence Base for the Provision 29 Declaration

By the time a board signs the declaration, the hard work is done. The declaration is the visible two pages; the evidence base is the months of preparation that let the board stand behind them. With Provision 29 applying to financial years beginning on or after 1 January 2026 and first reporting from 2027, the runway is now — and the organisations that treat readiness as a programme, not a year-end scramble, are the ones that will declare with confidence. This guide walks the readiness process end to end and shows where independent physical verification fits.

From framework to declaration: what the board must be able to stand behind

The board is not declaring that it has a framework; it is declaring that its material controls were effective as at the balance sheet date, and disclosing any that were not. Standing behind that requires two things the board can point to: a record of how it monitored the controls, and the basis for its conclusion. Everything in the readiness process below exists to produce those two things for each material control. The distinction between the framework description and the effectiveness declaration is set out in the Provision 29 material-controls pillar.

Step 1 — Define scope and materiality

Begin by linking each candidate control to a principal risk or a reporting or regulatory duty, and applying the materiality test: could the control’s failure reasonably influence stakeholder decisions, or affect price-sensitive reporting, principal risks or legal and regulatory obligations? This is board judgement, not a prescribed threshold — the Code is principles-based and the FRC sets no list. The output is a defensible boundary between material and non-material controls that the board can explain.

Step 2 — Build the material-controls inventory (where PP&E controls fit)

With scope agreed, build the inventory of material controls across the four categories — financial, operational, reporting and compliance. For asset-intensive companies this is where PP&E controls earn their place: existence and reconciliation controls, safeguarding controls, and location-accuracy controls, each of which can span more than one category. The reasoning for including them is set out in the register-controls spoke — a reasoned professional position, not FRC instruction.

Step 3 — Agree evidence standards

For each material control, decide what “effective” evidence looks like before you gather it: the coverage required, the attestation or testing frequency, the exception thresholds that trigger investigation, and the criteria for closing an exception. Setting these standards up front prevents the common failure mode of arriving at year end with activity but no agreed bar for what the activity was meant to prove.

Step 4 — Assurance mapping across the three lines

Assurance mapping is the discipline of laying each material control against its sources of assurance: first-line management attestations, second-line monitoring and compliance functions, third-line internal audit, and independent external specialists where the board wants evidence free of self-review. The map shows, at a glance, which controls are well-covered and which rely on a single, possibly conflicted, source. For PP&E controls, independent physical verification is the specialist source that strengthens an otherwise management-only line — the role explored in the physical-verification evidence spoke.

Step 5 — Test and remediate priority controls

Test the priority controls — including asset existence and safeguarding — against the evidence standards, and remediate what the testing exposes. This is where weaknesses surface: ghost assets, unrecorded disposals, custody gaps, mislocations. Remediating them before year end is the difference between a clean declaration and an ineffective-controls disclosure. The cost of leaving asset weaknesses unaddressed is set out in the analysis of the cost of unmanaged fixed assets, and the year-end preparation runbook is in preparing for a fixed asset audit in 2026.

Step 6 — Dry-run the declaration with the audit committee

A dry run rehearses the effectiveness review and the declaration with the audit committee before it is mandatory. It answers the questions the board will face in earnest: is the evidence sufficient, are the exception dispositions defensible, is the wording accurate, and would we be comfortable disclosing what we know? A dry run in the year before first reporting gives the organisation time to close gaps rather than discover them under deadline.

Step 7 — Disclose proportionately

Finally, disclose in line with the FRC’s expectation that the material-controls report is proportionate and concise — in most cases no longer than two pages. The skill is to make the disclosure legible and honest while keeping the robust supporting evidence in the working papers. A concise report backed by deep evidence is the target; a long report backed by thin evidence is the failure the whole programme is designed to avoid.

Where readiness typically lags

Professional commentary describes UK readiness as uneven: some organisations are taking positive steps, others remain at an early stage. We deliberately avoid quoting a readiness percentage — there is no reliable published figure, and inventing one would be worse than useless. Qualitatively, the areas that most often lag are the operational and compliance controls that fall outside a legacy financial-reporting mindset, and the evidence base for physical-asset controls, where many organisations have a register but not the independent verification to prove it operates. US-listed groups have a head start on the financial controls; the reusable and the missing pieces are mapped in the comparison of UK SOX and Provision 29.

Commissioning independent physical verification as part of the evidence pack

For a board building its evidence base, commissioning independent physical verification is a concrete readiness step that directly strengthens the assurance map for PP&E controls. It produces the existence, location, tagging and reconciliation evidence that turns a management-only assurance line into an independently corroborated one, timed to the balance sheet date and packaged for the audit committee. The right starting point is a scoping conversation about your asset base, sites and risk profile — from which we design a proportionate verification programme that feeds your declaration.

Frequently Asked Questions