From a control list to board assurance

Begin with the risk being controlled

A control list becomes useful when it explains the risk, accountable owner and evidence of operation. The FRC guidance distinguishes design, implementation and effectiveness and expects boards to form their own view from evidence. Its recognition that controls cannot provide absolute assurance is a useful limit for any organisation’s reporting.

For companies reporting against the UK Corporate Governance Code, Provision 29 addresses monitoring and annual review of the framework and a declaration about material controls at the balance-sheet date. Apply the Code’s actual scope and financial-year commencement rules before treating that reporting expectation as relevant.

Practical workflow: define a testable control

This is an editorial method for organising evidence. Replace descriptions such as ‘finance reviews payments’ with an explanation of who checks what, when, using which information and how exceptions are resolved. A control with no trigger or retained evidence is difficult to evaluate consistently.

• Purpose: the event or error the control is intended to prevent, detect or correct.
• Operation: the performer, reviewer, frequency, systems and required evidence.
• Test: the question, population, period, sample rationale and criteria for an exception.
• Conclusion: the observed result, limits of testing, responsible owner and next action.

Keep three questions separate

Design asks whether the proposed control could address the risk. Implementation asks whether it has actually been introduced. Operating effectiveness asks whether it worked as intended during the period tested. A signed policy may support implementation; it does not by itself demonstrate that staff followed the process.

For example, a payment control might require a reviewer to verify a change of bank details using an independently obtained contact route. A useful test would inspect the required evidence in selected cases and evaluate exceptions. A screenshot of the procedure alone would leave the operation untested. The example is illustrative and does not prescribe a universal sample size.

Report uncertainty and track the retest

Separate controls that worked in the evidence tested from controls with failures, controls awaiting testing and controls outside the review. Do not convert missing evidence into a pass. Explain how test coverage, independence, changes during the period or unreliable source data constrain the conclusion.

A remediation action should contain an owner, completion date and evidence required for closure. ‘Implemented’ and ‘retested successfully’ are different states. The board report should connect unresolved weaknesses to the risks and decisions they affect, including whether temporary measures or escalation are needed.