The 2024 UK Corporate Governance Code asks boards to declare the effectiveness of material internal controls, for financial years beginning on or after 1 January 2026. That declaration needs a register where principal risks, controls, testing and incidents are linked, not a slide assembled for the audit committee.
10 risks on the register. 7 rated High before controls, 1 after.
Select a cell to see which risks sit there and where their controls move them.
Typically 100 to 1,000 employees, established and regulated, with the risk register, supplier oversight and resilience work still run largely by hand.
What it asks
A board declaration on the effectiveness of material internal controls, and a description of how the board monitored and reviewed them.
What ERM+ holds
Material controls linked to the risks they address, with owners, test results and deficiencies recorded as they happen.
What it asks
A robust assessment of principal and emerging risks, and how they are managed or mitigated.
What ERM+ holds
Principal and emerging risks with appetite, ratings, trends and actions, reported to the board from live data.
What it asks
For AIM companies, a recognised governance code applied and explained, including risk management and internal control.
What ERM+ holds
A proportionate risk framework that grows with the company, without an enterprise GRC price tag.
What it asks
Confidence that key suppliers and systems can fail without taking the business with them.
What ERM+ holds
Suppliers, systems and incidents linked to the risks and processes they affect, so dependencies are visible to the board.
A summary to frame the conversation, not legal advice. The first call establishes exactly which requirements apply to your firm.
Directors will want to see how the controls they are declaring effective were tested, not a summary built the week before.
A principal risks table refreshed once a year loses its link to the incidents and control failures that happened in between.
New sites, suppliers and systems add risk faster than a manual register can absorb it.
CFO
Also: Finance Director
Head of Risk / CRO
Also: Head of Operational Resilience, Risk Director
COO
Also: Head of Operations
CTO / CIO
Also: Head of IT, Head of Technology Risk
Head of Compliance
Also: Chief Compliance Officer, Head of Regulatory Affairs
More than 50 years of risk experience between the co-founders and over 500 with our senior associates. Implementation in weeks, not months.
Meet the team“ERM PLUS significantly reduced the time and resources for achieving regulatory compliance in risk and prudential management.”
“The expertise and professionalism of the ERM Plus team are unparalleled. Their strategic guidance and hands-on approach have been instrumental in achieving our business goals.”
We look at what you capture today, what your regulator will ask for, and whether there is a gap. If there is nothing there, no need to take it further.
A gap check, not a pitch. No project, no budget conversation, no access to sensitive data.