Service 04 of 11

Internal Controls Review & Testing

We test whether your key controls are well designed and actually operate, and help you prepare for the UK Corporate Governance Code material controls declaration.

Book a 20-minute call How it works

Supports: The Provision 29 material controls declaration
Outcome: Evidence that your key controls work
You get: A risk and control matrix and test results
Focus: Key financial and operational controls

Overview

What is an internal controls review?

Internal controls are the policies, procedures, approvals, reconciliations and checks that prevent or detect errors, fraud and failures. An internal controls review identifies the key controls in your processes and tests whether they are well designed and actually operate as intended.

For companies applying the UK Corporate Governance Code, it supports the board’s declaration on the effectiveness of material controls. For every organisation, it reduces the risk of financial loss, misstatement and operational failure, and often removes duplicated or low-value controls along the way.

What it stands for

Evidence over assumptionControls are tested, not just described.

Proportionate testingEffort focused on the controls that matter most.

Practical remediationFixes that fit how your teams actually work.

Who it’s for

When you need evidence that controls work

Boards are increasingly expected to show, not just assert, that their controls are effective. A structured controls review gives you that evidence and a clear plan for any gaps.

Companies preparing for the Provision 29 material controls declaration
Finance teams after a system change, merger or rapid growth
Organisations that have suffered errors, losses or fraud
Boards wanting assurance over key financial and operational controls

How it works

Map, test and fix your key controls

Stage 1
Scope

We identify your key processes and the material risks that matter most to the board.
Stage 2
Map

We document processes, risks and controls in a risk and control matrix (RCM).
Stage 3
Test

We test design and operating effectiveness, including segregation of duties and system access.
Stage 4
Remediate

We agree practical actions to close gaps, then re-test to confirm they work.

Why it matters

Controls only protect you if they work. We prove that they do, or show you how to fix them.

What you receive

Evidence your board can rely on

Every deliverable is tailored to your organisation and written for the people who will use it.

Process walkthroughs

How each key process really runs.

Risk and control matrix

Risks, controls and owners in one place.

Testing results

Design and operating effectiveness.

Segregation of duties analysis

Conflicts and how to resolve them.

Remediation plan

Prioritised actions with owners.

Board summary

A clear view for the material controls declaration.

Benefits

The value we add

Fewer errors and losses

Weak controls are found and fixed before they cause damage.

Declaration-ready

Evidence to support the board’s material controls declaration.

Fewer audit findings

Stronger controls mean smoother external audits.

Clear ownership

Every key control has a named owner who understands it.

Efficiency

Redundant or duplicated controls are identified and removed.

Confidence for stakeholders

Lenders, investors and boards see controls that are proven to work.

Senior-led

Delivered by chartered and certified professionals (ACA, ACCA, CIA).

Fixed fee

Scope and price agreed in writing before work starts.

Standards-aligned

Methodology aligned to the IIA Global Internal Audit Standards.

Frequently asked questions

Internal Controls Reviews: your questions

How much does an internal controls review cost?

It depends on the number of processes, entities and controls in scope. We agree a fixed fee once the scope is set.

What is the Provision 29 material controls declaration?

Under the 2024 UK Corporate Governance Code, boards of companies applying the Code must declare whether their material internal controls were effective, for financial years beginning on or after 1 January 2026.

What is a risk and control matrix?

A document that links each key risk in a process to the controls that address it, who owns them and how they are tested.

Is this only for listed companies?

No. Any organisation can benefit from knowing its key controls work, especially after growth, system changes or a loss.

Do you include IT controls?

Our focus is business process and financial controls. Where specialist IT controls testing is needed, we will say so and agree how it is covered.

Page last updated 2 November 2026

Policies, Procedures & SOPs Review and drafting of usable documentation. View service → Fraud Risk Management Risk assessments and reasonable procedures. View service → Outsourced, Co-Sourced & Interim Internal Audit Audit capacity and skills when you need them. View service →

More insights →

Controls

Provision 29 material controls: the declaration explained

Provision 29 of the UK Corporate Governance Code 2024 asks boards to declare whether material controls were effective. What it requires, who it applies to and how to prepare.

3 February 2026 · 12 min read

Controls

Risk and control matrix (RCM): how to build one that works

A practical guide to building a risk and control matrix: mapping risks, writing testable controls, choosing key controls, testing them and keeping the RCM current ahead of Provision 29.

9 December 2025 · 14 min read

Fraud

Fraud risk assessment template: how to write one that works

How to write a fraud risk assessment that stands up to scrutiny, with a template structure: register columns, scoring scales and an illustrative worked example.

21 October 2025 · 13 min read

Want assurance over your controls?

Book a free 20-minute call to talk through your situation.

Book a 20-minute call