The provision asks boards to make a declaration on the effectiveness of their material internal controls. Boards decide which controls are material, and the declaration extends to reporting controls, including those covering narrative and ESG reporting. Boards must also monitor the risk management and internal control framework and review its effectiveness at least annually.
The Code applies to companies listed in the commercial companies category or the closed-ended investment funds category, wherever they are incorporated, as part of complying with the UK Listing Rules. Private companies sit outside it, although large private companies within scope of the Companies (Miscellaneous Reporting) Regulations 2018 must disclose their governance arrangements, with the Wates Principles offering a framework.
One declaration, written a year after the controls had to work
The timing is the commercially relevant detail. A board declaring in 2027 on the effectiveness of controls during the 2026 financial year needs evidence gathered throughout 2026. Evidence that was never collected cannot be reconstructed afterwards.
What the Code does not do is prescribe a method. It does not say which controls are material, what evidence is sufficient, or how effectiveness should be tested. That ambiguity is the opening.
Smaller accounting firms, internal-audit specialists and finance-automation consultancies are better placed here than their size suggests. The work is not an audit and it is not a software implementation. It is determining, for one company, which controls genuinely matter and then making the evidence for those controls accumulate automatically rather than being assembled by hand each quarter.
Reconciliations, access reviews, journal approvals, supplier onboarding and period-end close are the obvious candidates, because they already run on systems that can produce an evidence trail if anyone configures them to.
The constraint is scope. A firm that offers to map an entire control environment will produce a document nobody maintains. A firm that takes five material controls, instruments them inside the systems the client already runs and produces a monthly evidence pack has something a board can actually sign against.
There is also a market beyond the listed companies themselves. Suppliers, subsidiaries and acquisition targets of listed groups are routinely pulled into the same evidence requirements without being in scope of the Code, and they have no internal function to handle it.
A reasonable test over the next quarter is one client and five controls. Record how many hours currently go into evidencing them manually, instrument them, and compare. If the saving does not cover the fee, the control was probably not material enough to start with.
More information
Source and more information: Financial Reporting Council – UK Corporate Governance Code