Filing Rights Are Board Rights: A Three-Hour Assurance Review of Companies House Controls

Companies House is no longer a passive registry at the edge of governance. It is an active control point through which the public record, counterparty confidence and, increasingly, access rights to a company can be altered. For UK boards, the question in 2026 is not whether identity verification has been completed for known directors. It is whether the board can demonstrate that every person who can change the company's record is authorised, verified, monitored and removable.

That distinction matters because filing permissions are often treated as an administrative detail. In practice, they are a form of delegated authority. A person who can update the register can also create, amend or obscure information that customers, lenders, regulators and investors rely upon. The board does not need to become a registry specialist, but it does need assurance that this authority is controlled with the same discipline applied to bank mandates or payment approvals.

The control question has changed

The reforms introduced under the Economic Crime and Corporate Transparency Act 2023 have shifted the compliance burden from disclosure alone to verification and authorisation. The operational consequence is straightforward: companies now need a reliable view of who is verified, who may file, which entities are in scope and how exceptions are handled. For groups with multiple companies, dormant subsidiaries or overseas directors, that view is rarely contained in a single spreadsheet maintained by one person.

Boards should therefore ask a sharper question than whether the company secretarial team has completed the necessary steps. They should ask what evidence exists that the control environment remains effective after implementation. A three-hour review is sufficient to test that proposition, provided it is structured around evidence rather than presentation.

A 180-minute agenda that produces evidence

0 to 30 minutes: establish the entity and role map

The company secretarial team should open with a single schedule covering every UK entity in scope. For each company, the schedule should show the company number, status, directors, secretary where applicable, people with significant control or relevant legal entities, authorised filers, any authorised corporate service provider used, dormant status and overseas directors. The board should test completeness rather than absorb detail. Are there companies outside the schedule? Are there recently acquired or dormant entities that have been omitted? Who owns the schedule and when was it last reconciled to the statutory registers?

30 to 75 minutes: verified identities and authorised filers

The next stage is to examine verification status and filing rights. Directors and PSCs should be checked against the register, with exceptions identified and explained. The board should see a named list of authorised filers, the business justification for each person, the approval date and the next review date. Shared credentials, generic email accounts and informal filing by third parties should be treated as exceptions requiring remediation. Leavers should be removed promptly, and the board should ask how removal is evidenced. Where filings are material, a dual-control or second-review step should be considered.

75 to 120 minutes: dormant entities, overseas directors and ownership chains

Dormant companies are a common weak point because they generate little internal attention while remaining part of the public record. The board should confirm that dormant entities still have a monitored registered office, an identified filer and a named owner. Overseas directors add a further layer of complexity: verification routes, documentary requirements, time-zone delays and reliance on local advisers all need to be understood. The board should also test the ownership chain. If a PSC is a legal entity, who is responsible for confirming the accuracy of the chain and for notifying changes?

120 to 150 minutes: account takeover and filing fraud

A short scenario exercise is useful here. Assume a director's email account is compromised and an attempt is made to change filing permissions, the registered office or a director's details. What would the company see, when would it see it, and who would act? The board should examine monitoring of Companies House notifications, domain security, out-of-band confirmation for sensitive changes and the escalation route to the company secretary, finance director and legal counsel. The objective is not to design a technical solution in the meeting. It is to identify whether a credible detection and response path exists.

150 to 180 minutes: decisions, owners and evidence

The final half hour should convert findings into a record. The board should agree a named accountable executive, a short remediation plan, a date for the next review and the evidence to be retained. Items that cannot be evidenced should be marked as open, not assumed to be satisfactory. This prevents the review from becoming a one-off comfort exercise.

Evidence checklist for 2026

• A complete UK entity schedule reconciled to statutory registers.
• Identity verification status for directors and PSCs, with exceptions explained.
• A named list of authorised filers, approvals and review dates.
• Confirmation that leavers and role changes are removed promptly.
• Evidence of monitoring for Companies House notifications and filing confirmations.
• A register of dormant entities with named owners and filing arrangements.
• Documentation of overseas director verification and local support arrangements.
• A tested escalation route for suspected account takeover or unauthorised filing.
• Board minutes recording accountable owners, actions and next review date.
• A clear statement of where reliance is placed on third-party providers and how that reliance is overseen.

The board's own discipline

Companies House controls are sometimes described as a compliance task. They are better understood as a board assurance matter. The test is not whether the company can file. It is whether the board can prove who may file, on whose authority, under what monitoring and how that authority is withdrawn. A focused 180-minute review, supported by the evidence above, gives directors a defensible answer and a practical route to remediation where the answer is not yet strong enough.