ALCOA principles: the test any record has to pass
ALCOA+ is a checklist for whether data can be trusted. Most failures are not fraud — they are records made later, by someone else, in a file nobody versioned.
Statutory books are the registers a company must keep by law. They are cheap to maintain monthly and expensive to reconstruct during a transaction.
Statutory books — the statutory registers — are the records a company is required by law to keep about itself: who owns it, who runs it, who controls it, and what has been issued or charged. They are separate from the accounts and separate from what Companies House holds; the company’s own registers are the primary record, and the public register is a reflection of them.
Nobody looks at them for years, and then several people look at once: an acquirer’s solicitors, a bank taking security, an investor in a funding round. What they are checking is not whether the company is well run but whether it can prove who owns it — and the answer is either a maintained set of registers or a month of reconstruction.
The register of members is the one that matters most and is neglected most. It is the legal record of who owns the company: not the cap table in a spreadsheet, not the shareholders listed in the last filing, and not the share certificates in issue.
The pattern is consistent. A transfer is agreed and signed, the certificate is issued, and the register is never updated. A director resigns and the change is filed publicly but not entered in the register. A share issue is approved by a board resolution nobody minuted. Each is small; together they mean the registers no longer show what happened.
The reconstruction that follows is not merely tedious. Where the paperwork cannot be found, the company may need shareholders to ratify historical events years later — and shareholders who have since fallen out are under no obligation to help.
Keep the register of members and the cap table as one thing, not two. Where finance maintains a spreadsheet and the company secretary maintains a register, they diverge — and the version investors were shown will not be the legal record.
Registers are tables with a legal life: rows that must show what was true on a date, kept for years, produced on demand. Ettex Sheets holds them with full version history, so the state of the register at any past date can be shown rather than asserted — which is exactly what a buyer’s diligence request asks for. Deciding what belongs in them remains a company secretarial judgement.
At the registered office, or at a single alternative inspection location notified to the registrar. They must be available for inspection as the legislation requires.
Yes, in most jurisdictions, provided the records can be reproduced in hard copy when required and are adequately protected against loss or falsification.
No. The company keeps its own registers; Companies House holds filings derived from them. Where the two differ, the company’s register is generally the primary record of membership.
It is an offence, and the practical consequences arrive during due diligence — delayed transactions, price adjustments, or warranties the directors would rather not give.
ALCOA+ is a checklist for whether data can be trusted. Most failures are not fraud — they are records made later, by someone else, in a file nobody versioned.
A gap analysis compares what the regulation requires against what you actually do. Its value depends entirely on evidence being tested, not asserted.
The risk assessment is where an ISMS is won or lost. Vague risk statements produce controls nobody can test and a certificate that means little.