The situation
Picture a listed UK mid-cap with a newly appointed audit committee chair. The UK Corporate Governance Code’s Provision 29 declaration is on the board agenda, a declaration on the effectiveness of the company’s material internal controls, and it belongs to the board, with the personal accountability that carries. The chair understands what that means. If the declaration is later shown to rest on assertion, the first question asked is what the audit committee did to test it.
The chair reads the papers that are meant to support the declaration and finds attestation in place of evidence. Management asserts that controls operate. Internal audit samples a fraction of the control estate each year. No record exists of anyone outside the executive contesting the position. None of this is unusual. Most control narratives are written by the people they describe. What is missing is independent challenge, applied continuously and documented, between one declaration and the next. An independent test is what turns a control narrative into evidence.
How the engagement works
Retained SGaaS runs at 15 to 30 hours per month across the board cycle. Each month the chair receives a Governance Pulse report covering the regulatory horizon, emerging risk, and the governance metrics the committee tracks. Each quarter the principal briefs the board directly, in the room, where the briefing can be questioned. Between cycles the principal is on call. When a control owner reclassifies a deficiency, or a paper asserts more than it evidences, the chair can take the question to an adviser who sits outside management.
The discipline sits in the record. Every challenge the principal raises is minuted. Every management response is documented against it. Month by month the retainer assembles a file of independent contest, built through the quiet periods, because a record of challenge can only be created in real time.
Once a year, before the declaration is signed, a Red Team Review formally challenges the risk and control position: what the control narrative asserts, what it evidences, and where the gap between the two sits. Findings go to the audit committee with management’s responses attached, in time to close gaps before signature.
The position this leaves the board in
Set the cost of the retainer against the cost of being wrong. The white paper’s recovery gap analysis shows what a severe governance failure does to a listed company. Twenty-four months after the event, the affected firm has on average recovered only its pre-crisis share price, while the broader market has advanced 15 per cent. That twelve-point loss of relative position is permanent. A retainer measured in hours per month is the defensive position against that arithmetic, and against the narrower, likelier cost of restating a control statement that lacked independent testing.
When the board signs the Provision 29 declaration, it holds a year of minuted independent challenge, a control narrative that has been formally attacked and repaired, and a paper trail that stands up to the regulator, to investors, and to the directors’ own scrutiny. The declaration is signed either way. The question is what the board is holding when it signs.
This is a constructed scenario showing how Retained SGaaS operates. It does not describe a Marentis Labs client. To test the approach against your board cycle, schedule a confidential call.