The free FPPP self-scan

framework document — Sets out how risks are identified, assessed, owned, mitigated and escalated, and on what cycle the process itself is reviewed.

A formal Risk Management Framework must be documented, describing the overall approach to identifying, assessing, and mitigating risk.

register — A current group risk register giving, for each risk, likelihood, financial impact, owner and mitigation.

A Group Risk Matrix must exist and be updated periodically to reflect current risks.

framework document — A single directors' FPPP risk assessment addressing each of the seven areas by name, and stating for each the procedures relied upon.

The directors' risk assessment must explicitly identify, assess, and consider risks relating to each of the following seven areas: (i) high-level reporting environment, (ii) forecasting and budgeting, (iii) management reporting framework, (iv) significant transaction complexity and potential financial exposure or risk, (v) strategic projects and initiatives, (vi) financial accounting and reporting, and (vii) the IT environment — and document how FPP procedures address those risks.

terms of reference — Signed terms of reference for each of the three committees, stating composition, independence requirements, quorum and delegated authority.

Formal written Terms of Reference must be in place for: Audit & Risk Committee, Remuneration and Nomination Committees.

framework document — Identifies the key financial reporting controls, names a control owner for each, and states how design and operating effectiveness are assessed and on what cycle.

A documented Internal Control over Financial Reporting (ICFR) framework must exist.

matrix — Approval limits for procurement, payments and commitments, by role and value band.

A Delegation of Authority (DoA) matrix must be in place showing approval limits for procurement, payments, and commitments — embedded in financial systems.

org chart — Roles, reporting lines and responsibilities from the CFO to key accounting staff, with qualifications shown and vacancies marked.

The finance function must be adequately staffed with qualified personnel, evidenced by a documented organisational chart covering roles, reporting lines, and responsibilities from the CFO to key accounting staff.

terms of reference — An internal audit charter and annual plan approved by the audit committee — or, where there is no function, a board-approved explanation naming the compensating controls relied upon.

An internal audit function must exist — or its absence must be formally explained with compensating controls documented.

process document — Sets out the budget cycle with dates, responsibilities, the assumption-setting step, the challenge and iteration stages, and the board approval point.

A documented annual budgeting process must exist — from assumption-setting through to final Board approval.

financial model — A single controlled master version, with an assumptions sheet, a change log, and the model's logic documented well enough for a reviewer to follow a number from driver to output.

A financial model must exist with clearly documented logic, assumptions, and version control.

financial model — Downside and upside scenarios run on the declared key drivers, with the mechanics visible in the model rather than pasted in as values.

Sensitivity and scenario analysis procedures must be documented, covering key business drivers (e.g. fuel prices, exchange rates, cargo volumes).

report pack — Actual against budget and against forecast, with written explanation of material variances in both directions, in a pack the board demonstrably received.

A variance analysis process must exist: actual results vs budget vs forecast, with management commentary reviewed by the Board on a timely basis.

management accounts — A monthly pack containing all six elements, with divisional reporting for every entity in the IPO perimeter.

A monthly management accounts pack must be produced covering: P&L, cash flow, balance sheet, working capital, KPIs, and divisional performance reports for each subsidiary.

process document — A published close calendar, plus the actual issue date of each of the last six packs against it.

The management accounts pack must be produced to a defined timetable — consistently and on time.

process document — The documented reconciliation with the most recent bridge retained, showing each reconciling item and who reviewed it.

A reconciliation process between management accounts and statutory IFRS accounts must be documented.

terms of reference — Review Board and committee Terms of Reference and minutes to confirm formal ESG oversight responsibilities.

Board-level or committee-level oversight of ESG matters must be formally established — with documented mandate.

register — Review the ESG Risk Matrix and supporting climate risk assessment to confirm inclusion of physical and transition risks.

Climate-related risks — transition and physical — must be formally integrated into the Group Risk Matrix.

process document — Review the documented sustainability reporting procedure, reporting calendar, responsibilities, approval controls, and supporting evidence.

A documented process must exist for preparing the sustainability section of the Annual Report, ensuring compliance with the UK Corporate Governance Code and other applicable ESG-related regulations (including TCFD-aligned disclosures).

policy — Defines what constitutes a significant transaction, states the class tests applied, and names who performs the assessment and when.

A formal written policy for identifying significant transactions must exist — defining what constitutes a significant transaction under UKLR rules.

register — A maintained related-party register plus the documented procedure covering identification, assessment against the threshold, approval, and disclosure.

Related-party transaction procedures must be documented — covering identification, assessment, approval, and disclosure.

process document — Requires strategic fit, financial viability and risk assessment in every proposal, and names the approval threshold at which the board decides.

An investment appraisal process must exist for major capital projects — covering strategic fit, financial viability, risk assessment, and Board approval.

report pack — CapEx reporting showing actual spend AND outstanding commitments against approved budget, in a pack the board received.

Capital expenditure reporting must track actual spend and commitments against approved budgets — reported to the Board regularly.

policy — A group IFRS accounting policy manual, board-approved, with evidence it is the manual each perimeter entity actually applies.

IFRS-compliant accounting policies must be formally documented, Board-approved, and applied consistently across all group entities.

process document — A schedule of key judgements and estimates with, for each, the assumption used, the basis for it, and who approved it.

Key areas of judgement and estimation uncertainty must be identified and documented (asset lives, impairment, provisions, revenue recognition, leases).

process document — A reporting calendar working back from the DTR deadlines, with each step owned by a named individual and the review and approval gates marked.

A timetable and process for preparing half-year and annual financial statements must be documented with roles assigned, meeting statutory deadlines.

terms of reference — Terms of reference for the disclosure committee and the audit committee, stating membership, quorum and decision-making authority.

A finance team, Disclosure Committee, and Audit Committee must be established with documented terms of reference and clear decision-making authority.

register — A maintained insider list, plus documented procedures for PDMR notifications and for assessing, escalating and disclosing inside information — including when to issue a holding announcement.

MAR (Market Abuse Regulation) compliance procedures must be in place: insider lists maintained and updated; PDMR (Person Discharging Managerial Responsibilities) notification process; process for identifying and disclosing inside information to the market, including holding announcements where needed.

system config — A current user access list for each key financial application, showing access restricted to authorised users, with joiners and leavers reflected.

Logical access controls must be in place for all key financial applications — restricting access to authorised users only.

system config — A documented segregation-of-duties matrix and evidence of a periodic access review, including the exceptions it raised and how they were cleared.

User permissions must be formally set up with appropriate segregation of duties — documented and reviewed periodically.

process document — A disaster recovery plan naming every system critical to financial reporting, with recovery objectives, and evidence it has been approved and communicated.

A documented disaster recovery plan must exist, covering all systems critical to financial reporting.

process document — A system landscape document naming the core financial systems, their data inputs and outputs, and every interface between them — flagging which are automated and which are manual.

Core financial systems (e.g. ERP - Enterprise Resource Planning, consolidation tools) must be formally reviewed, and key IT processes supporting financial reporting must be fully documented — covering data inputs, system outputs, and interfaces between systems.