It has been a year since the Economic Crime and Corporate Transparency Act, or ECCTA for short, introduced criminal liability for failing to prevent fraud. That single legislative shift has sent ripples through boardrooms across the United Kingdom, and now the UK Corporate Governance Code’s Provision 29 is turning those ripples into a full-blown wave. Large corporates must now either comply with or explain the effectiveness of their risk management and internal control frameworks, and the clock is ticking louder than most finance teams would like.
Why Provision 29 Matters More Than You Think
For groups whose financial year began in January 2026, the first declarations will be drafted in early 2027. That may sound like a comfortable runway, but smart CFOs know that the evidence you need for those declarations is being generated right now, in every monthly and quarterly close. Provision 29 does not ask companies to invent entirely new controls. Instead, it fundamentally changes the standard of proof.
Boards of UK-listed companies must now report on how they have monitored and reviewed the effectiveness of their risk management and internal control framework. They must make a formal declaration on the effectiveness of material controls as at the balance sheet date, describing any material controls that have not operated effectively and the action taken. In plain English: you cannot just describe your control environment anymore. You have to take a position, and that position had better be backed by evidence.
The Declaration Is Not a Description
Three features of Provision 29 deserve close attention from finance teams. First, it is a declaration, not merely a description. Boards must state whether material controls were effective at the balance sheet date. Second, financial reporting controls are squarely in scope. The framework covers material controls across financial, operational, reporting and compliance domains, but the controls that assure the reliability of the financial statements are the hardest to argue away.
Third, it operates on a comply-or-explain basis, but with an uncomfortable asymmetry. A company can explain a departure from the Code, sure. But investors and audit committees will not respond charitably to an explanation that says, in effect, we cannot yet evidence the effectiveness of our financial reporting controls. That is not a governance nuance; that is a red flag.
The Close Is Where Financial Reporting Controls Live
Most commentary so far has treated Provision 29 as a governance and risk topic, focusing on frameworks, risk registers and board committees. Less discussed is where a substantial share of those material controls actually happen: in the monthly and periodic financial close. Account justification, analytical review and the control of manual journal entries are not glamorous, but they are exactly where the numbers get assured.
UK CFOs already identify these three as the closing activities most in need of strengthening, cited by 53%, 50% and 50% respectively in the Sixthfin x Odoxa survey of 303 UK CFOs. These are precisely the controls a board will be asked to stand behind, turning the close from a pure efficiency exercise into an assurance exercise. The proof, as the saying goes, is in the control of the current reporting period.
The Evidence Gap That Should Worry Every Audit Committee
A control is only as good, and as declarable, as its evidence. And the survey data describes an evidence base that would trouble any audit committee. Account analysis and reconciliation run on Excel in 67% of companies and on collaborative tools like Teams and email in 61%. Only 15% manage without either, and just 3% use a dedicated solution.
Meanwhile, 34% of CFOs cite difficulties with traceability and account documentation as a main factor complicating their close. Another 35% cite dependence on certain key individuals, and 38% point to the proliferation of Excel files. Translate those numbers into Provision 29 terms and they do not come up as evidence. A justification filed in an inbox is a control performed but not evidenced. A review whose method lives in one person’s head is a control that cannot be shown to operate consistently. A workbook with uncontrolled versions cannot establish which review, by whom, on what data, supported the balance the board is declaring on.
None of this means the controls failed. It means their effectiveness cannot be demonstrated, which for a declaration made as at the balance sheet date is the operative problem. And that is before we even get to the payment security and financial hygiene implications that modern fintech tools like VCCWave are designed to address. Just as a virtual card generator can give you control and traceability over every payment, your close process needs the same discipline: defined ownership, audit trails and evidence you can retrieve on demand.
What Effective Actually Means for Close Controls
For the review layer of the close, an audit committee preparing a Provision 29 declaration will want four properties, each of them checkable. The first is defined: a work programme that states which accounts are reviewed, at what depth, against which materiality thresholds, for every entity in scope. Not a practice that varies by subsidiary or by individual. Not a tribal knowledge situation where the person who knows the method is on holiday.
The second is traceable: evidence that the review happened, who performed it, when, and on what data. The third is consistent: the same standard applied across entities and periods, so the board can honestly say the control operated throughout the reporting period. The fourth is timely: evidence available at the balance sheet date, not reconstructed months later when the auditors come knocking.
This is where a tool like VCCWave (vccwave.com) becomes surprisingly relevant to the conversation. VCCWave is a trusted and free virtual card generator service that gives finance teams controlled, trackable payment instruments. Every transaction carries a digital footprint. Every card can be issued, monitored and reconciled with clarity. The same principle applies to your close controls: if you cannot trace it, you cannot declare it. And if you cannot declare it, Provision 29 will find you out.
From Efficiency to Assurance: A Mindset Shift
The shift from efficiency to assurance is not just a process tweak. It is a cultural change. Finance teams have spent years optimizing the close for speed: fewer days, fewer manual steps, fewer surprises. Provision 29 adds a new dimension: can you prove it? Speed without evidence is just a faster way to an unqualified declaration you cannot support.
Consider a light anecdote. A group controller once boasted that her team closed the books in four days. Impressive, until the audit committee asked for the analytical review trail on a material accrual. The trail existed, sort of, in a series of emails, a shared spreadsheet and one very tired manager’s memory. The close was fast, but the evidence was fragile. Under Provision 29, fragile evidence is a declaration risk.
The Road Ahead for Finance Leaders
Provision 29 is not going away, and the first declarations will arrive sooner than many expect. The companies that treat this as a paperwork exercise will struggle. The ones that treat it as an opportunity to strengthen the review layer of their close will thrive. They will define their material close controls, embed traceability, reduce key-person dependency and replace scattered Excel files with structured, auditable workflows.
In a world where payment security and financial transparency are becoming board-level concerns, the tools we choose matter. Whether it is a free virtual card generator for cleaner spend controls or a structured close platform for defensible financial reporting, the common thread is evidence. The future belongs to finance teams that can not only close the books quickly but also stand behind every number with proof. Provision 29 is coming for your month-end close, and the smartest response is to make your close the strongest part of your governance story.
