SOX compliance in the UK means two different things. US SOX applies directly to US-listed companies and reaches UK subsidiaries through their parent’s audit. Provision 29 of the UK Corporate Governance Code asks premium-listed boards to declare their material controls effective. Most private UK companies face neither directly.
Either way, auditors want proof your controls ran every period. Here’s how that plays out for supplier statement reconciliation, and what to put in place.
The right answer to “are we SOX-compliant?” is “which SOX?” UK finance teams use the nickname for two very different things, and mixing them up sends you after the wrong evidence.
Does SOX apply to UK companies?
Not directly, unless the company is listed in the US. The Sarbanes-Oxley Act (SOX) covers companies with securities on a US exchange or registered with the SEC. A private UK company with no SEC registration sits outside it.
A UK subsidiary of a US-listed parent is the catch. Its results feed the parent’s consolidated accounts, and the parent has to assess internal controls across its material subsidiaries under Section 404. So your reconciliation process can land in the parent’s audit sample, even though your company never registered with the SEC.
What is “UK SOX”? Provision 29 explained
When UK finance directors say “UK SOX”, they usually mean Provision 29 of the UK Corporate Governance Code. It isn’t a UK copy of SOX, and it isn’t a statute.
Provision 29 asks the board to review its risk management and internal controls at least once a year, then declare whether its material controls (the ones your board judges most important to the business) were effective at the balance sheet date. If a material control didn’t work, the board describes it and says what it’s doing about it. It applies to accounting periods starting on or after 1 January 2026, so the first declarations land in annual reports from 2027. (Sources: FRC Provision 29 mythbuster, FRC Code overview and the ICAEW summary of the Code.)
The Financial Reporting Council (FRC) won’t name the controls that count as material, or set a number. Your board decides. Neither rule names statement reconciliation. But if your board treats accounts payable as a material control area, it needs evidence the control ran.
SOX vs Provision 29, side by side
Where supplier statement reconciliation fits as a control
Statement reconciliation is a detective control. It doesn’t stop a bad invoice getting paid. It finds what slipped through: a missing credit, a duplicate payment, an invoice that never reached your ledger. The preventive side sits earlier, in invoice matching and invoicing automation.
It also compares your ledger with an outside record, the supplier’s own statement, which makes the evidence harder to argue with.
An auditor isn’t checking that the numbers were right on the day. They check that the control ran every period and left proof. Here’s what that proof looks like:
NG Bailey’s AP team used to check payments over £5,000 line by line against more than 500 supplier statements a month. They now run it through Open ECX, and the audit trail builds itself.
How to build audit-ready accounts payable controls
- Ask which AP controls count as material. Your board, finance director or US parent decides. Don’t guess.
- Reconcile on a fixed schedule. Weekly if volumes allow, monthly at the minimum.
- Cover every supplier. The accounts you skip sit outside any control. High-volume teams feel this first.
- Log every exception. Record a reason, an owner and the resolution. Our guide to common reconciliation problems shows where teams slip.
- Sign off each period. Use a named reviewer and record the date.
- Keep the record where an auditor can reach it. Read-only access beats a spreadsheet extract.
Ticking all of that off by hand, every period, for every supplier, is the job Open ECX automates. Matching, flagging and the audit trail happen as statements land, and your auditors get their own read-only view. Book a demo and we’ll show you what it looks like on your own supplier statements.
