Financial close governance is moving beyond performing controls toward demonstrating that they operated, with audit trails, documentation management and control evidence rising up the agenda for UK boards, finance teams, internal control and internal audit functions. 2026 is the first year in which Provision 29 evidence must be built, and the first full year of the ECCTA failure-to-prevent-fraud offence, making close governance, control frameworks and the regulatory impact on financial close automation a live question for in-scope organisations.
Sixthfin Software Supports UK Internal Control Evidence for Provision 29 and ECCTA Failure-to-Prevent-Fraud
London, United Kingdom, Sept. 26, 2026 (GLOBE NEWSWIRE) — Boards of UK listed companies will sign a declaration next year stating whether their material internal controls were effective. The evidence supporting that declaration is being generated now, during financial years already under way, by the same recurring finance processes that produced it, or failed to, in every previous year. Where the record was not captured as the work happened, it has to be reconstructed afterwards, and reconstruction is where weaknesses tend to surface. Under Provision 29, material weaknesses and the action taken in response are disclosed in the annual report. To learn more visit https://sixthfin.com/en/solution/closing/
Two developments account for the shift: Provision 29 of the 2024 UK Corporate Governance Code, which applies to financial years beginning on or after January 1, 2026, and the failure-to-prevent-fraud offence under the Economic Crime and Corporate Transparency Act, in force since September 1, 2025. Together they move the expectation on finance and internal control functions from performing controls to evidencing them.
Provision 29 requires boards to describe how they have monitored and reviewed the effectiveness of the company’s risk management and internal control framework, and to declare whether material controls, financial, operational, reporting and compliance, were effective as at the balance sheet date, disclosing any material weaknesses and the action taken. It applies on a comply-or-explain basis to companies in the UK’s commercial companies and closed-ended investment funds listing categories, rather than to private companies generally, though other organisations are aligning voluntarily. Because the first declarations will not appear in annual reports until 2027, 2026 is the year in which the underlying evidence has to be generated.
Unlike the US Sarbanes-Oxley regime, no external audit sign-off of the declaration is required, and the Financial Reporting Council has said it will not provide template wording. The board reaches its own conclusion from evidence it gathers itself, which places weight on the quality of the record produced by recurring financial processes during the year.
The ECCTA offence operates on different terms. It applies to large organisations, those meeting at least two of three thresholds: more than 250 employees, turnover above 36 million pounds, or total assets above 18 million pounds. It holds them criminally liable where an associated person commits a fraud offence intended to benefit the organisation and reasonable fraud prevention procedures were not in place. The offences listed in the Act include false accounting. The regime has extraterritorial reach, capturing organisations outside the UK where the fraud has a UK nexus. The UK Bribery Act, France’s Sapin 2 framework and the US Foreign Corrupt Practices Act form the wider environment for multinational groups.
A control that appears on a process map or a closing checklist differs from a control whose execution, findings and remediation can be evidenced.
“Boards are discovering that the hard part of a material controls declaration is not deciding what the controls are, it is producing a year of evidence that they ran. That evidence is either generated as the close happens or reconstructed afterwards, and reconstruction is where the weaknesses show up,” said François Vallana, CEO of Sixthfin.
The financial close is one of the recurring processes where that evidence is created. Account justifications, balance sheet reviews, analytical reviews, controls over manual entries, supporting documentation, comments, approvals and exception investigations collectively record how finance teams assessed the reliability of information before reporting it.
Research indicates how difficult that record is to maintain in practice. In the Sixthfin Report on Accounting Transformation, a study of 303 CFOs at large and mid-sized private UK companies conducted by Odoxa for Sixthfin and published in May 2026, 34% said difficulties with traceability and account documentation complicate the close, 35% cited dependence on certain key individuals and 34% lack of coordination between teams. 67% identified improving the reliability of accounts as a priority, while only 42% described financial close management in their company as very satisfactory. The survey covered private UK companies rather than listed groups within Provision 29’s scope, but the operational conditions it describes are common to both. The full study is available at https://sixthfin.com/en/resource/sixthfin-report-on-accounting-transformation/
The issue for most large enterprises is not the absence of controls. Control frameworks are typically extensive. The harder question is whether the organisation can consistently demonstrate that relevant controls were performed across entities, and that exceptions were identified, investigated and documented. Audit findings frequently arise not from large accounting errors but from weak justification, unexplained discrepancies, inconsistent application of controls and an inability to evidence that a review took place.
That separates close automation aimed at speed from automation aimed at governance. A faster close reduces reporting time. A controlled close also establishes what was reviewed, against what population of data, what exceptions were found, what supporting information was considered and what conclusion was reached. Automation of the controls themselves, of analysis across complete data populations rather than samples, and of balance sheet reviews produces that record as a by-product of the work rather than as a separate documentation exercise.
Closing, Sixthfin’s solution dedicated to account reconciliation performance and documentation, centralises financial information from different ERP systems and structures balance sheet reviews, account analysis and justification, anomaly analysis, supporting documentation and transaction level drill-down. Reviews and their associated evidence are retained within the close environment, creating a history of how accounts and exceptions were examined that is available to finance, internal control, internal audit and external audit. Sixthfin technology is ERP and chart of accounts agnostic, supports all ERP systems and is already deployed in more than 70 countries, with data fed through a configured data exchange mechanism rather than a real time connection to each source system. More than 1,000 companies and groups were covered by Sixthfin technology in 2026.
That architecture matters for governance because multinational control frameworks generally have to operate across systems never designed as a single environment. A UK-headquartered group may have subsidiaries running different ERP platforms, local charts of accounts and currencies, while the board and group finance function still need consistent visibility over material controls and evidence that required reviews occurred. Standardising control evidence without requiring every subsidiary onto an identical ERP is therefore becoming a consideration in close transformation planning.
Artificial intelligence adds a further dimension. As finance teams automate more accounting activity and use AI to identify anomalies, organisations still need to establish why an exception was raised, which underlying transaction produced it and how it was resolved. AI-assisted analysis can support financial control without altering accountability for the resulting information.
The regulatory requirements applicable to any individual organisation depend on its size, structure, listing status and jurisdictions, and Sixthfin does not present its technology as making an organisation compliant with any particular law or governance framework. Its role is to support financial review, control execution, documentation and evidence across complex finance environments. As UK organisations strengthen their internal control frameworks through 2026, the distinction between controls that are performed and controls that can be evidenced is likely to become steadily more consequential.
For more information about Sixthfin’s compliance and financial control technology, visit https://sixthfin.com/en/solution/compliance-anti-corruption/
About Sixthfin
Sixthfin develops financial data control and financial close technology for complex organisations. Its technology supports finance, accounting, internal control and audit teams in balance sheet review, account analysis and justification, anomaly analysis, documentation and transaction level investigation across multi-entity and multi-ERP environments. Sixthfin technology supports 38 ERP systems, is deployed in more than 70 countries and covered more than 1,000 companies and groups in 2026. The company has offices in London and Paris.
Attachment
- Sixthfin Software Supports UK Internal Control Evidence for Provision 29 and ECCTA Failure-to-Prevent-Fraud
CONTACT: Cécile Mana 1 Waterhouse Square London EC1N 2ST, United Kingdom +44 7 517 614 077
