TRW & Co · Corporate governance
UK Corporate Governance Code: Provision 29 and the Internal Controls Declaration
Under the UK Corporate Governance Code 2024, boards of commercial companies must declare whether their material controls were effective at the balance sheet date for financial years beginning on or after 1 January 2026. No external assurance is required, but boards need a defined set of material controls, documented monitoring and clear evidence for their conclusion.
Key pointThe FRC has confirmed that the auditor does not test or opine on the Provision 29 declaration, so the board's own documented evidence, typically an assurance map linked to principal risks, is what supports it.
At a glance
First declarations in 2027
New Provision 29 applies to financial years beginning on or after 1 January 2026, so calendar-year companies make their first declaration in 2027 annual reports.
Three reporting elements
Describe how the board monitored and reviewed the framework, declare effectiveness of material controls, and describe any material controls that were not effective.
Broad control scope
Material controls include financial, operational, reporting and compliance controls, so narrative, sustainability, sanctions and cyber controls can all be in scope.
No external assurance needed
The Code does not require external assurance, and the auditor treats the statement as other information under ISA (UK) 720 rather than testing the controls.
Comply or explain
Companies in the commercial companies or closed-ended investment funds categories must apply the Code or explain departures under the FCA's UK Listing Rules.
Swipe or scroll →
The short answer: what Provision 29 requires
Provision 29 of the UK Corporate Governance Code 2024 asks the board to monitor the company's risk management and internal control framework, review its effectiveness at least annually, and report three things in the annual report: how it monitored and reviewed the framework, a declaration of effectiveness of the company's material controls as at the balance sheet date, and a description of any material controls that were not effective at that date, with the action taken or proposed.
The new Provision 29 applies to financial years beginning on or after 1 January 2026. For a company with a 31 December year end, the first declaration covers the year to 31 December 2026 and appears in the annual report published in 2027. The rest of the Code has applied since financial years beginning on or after 1 January 2025.
The declaration is not a guarantee and does not need external assurance. What it does need is evidence: a defined set of material controls, a monitoring and review process the board can describe, and a record of how the board reached its conclusion. This guide explains what boards should be able to show and how to build an assurance map ahead of the first report, as of October 2026.
Who the UK Corporate Governance Code 2024 applies to
The Financial Reporting Council (FRC) published the UK Corporate Governance Code 2024 on 22 January 2024. According to the FRC, it applies to companies listed in the commercial companies category or the closed-ended investment funds category of the FCA's UK Listing Rules, whether incorporated in the UK or elsewhere.
The Code works on a "comply or explain" basis. The Listing Rules require in-scope companies to state how they have applied the Principles and to explain any departure from a Provision. A company can therefore choose not to make a Provision 29 declaration, but it must explain why, and investors will scrutinise that explanation closely. The FRC's March 2026 report on improving the quality of comply or explain reporting sets out what it expects good explanations to contain.
Large private companies are not covered by the Code; many use the Wates Principles to meet their separate governance reporting obligation. AIM companies follow the governance code their nominated adviser and board choose, which may or may not be the FRC's Code.
Principle O and Provision 29 of the UK Corporate Governance Code 2024
Provision 29 sits under Principle O in Section 4 (Audit, risk and internal control). Principle O says the board should establish and maintain an effective risk management and internal control framework, and determine the nature and extent of the principal risks it is willing to take to achieve its long-term strategic objectives.
Under the text of the 2024 Code, the board's monitoring and review should cover all material controls, including financial, operational, reporting and compliance controls. "Reporting" is broader than financial reporting: the FRC has confirmed that narrative and sustainability reporting controls can be in scope. Until the new Provision applies, Provision 29 of the 2018 Code continues to apply.
Provision 29 works alongside other Code requirements. Provision 25 gives the audit committee responsibility for reviewing the framework unless a separate risk committee or the board does so. Provision 28 requires a robust assessment of emerging and principal risks. In practice, the principal risks are the starting point for deciding which controls are material.
| Element | 2018 Code | UK Corporate Governance Code 2024 |
|---|---|---|
| Monitoring | Monitor the framework and review its effectiveness at least annually | Same, covering all material controls |
| Scope of controls | Financial, operational and compliance controls | Financial, operational, reporting and compliance controls |
| Description of review | Report on the review | Describe how the board monitored and reviewed effectiveness |
| Declaration | None | Declaration of effectiveness of material controls as at the balance sheet date |
| Failures | No specific requirement | Describe material controls not operating effectively at the balance sheet date, action taken or proposed, and progress on previously reported issues |
| Applies to | Financial years beginning before 1 January 2026 | Financial years beginning on or after 1 January 2026 |
What the FRC has clarified since 2024
The FRC has published non-prescriptive Code guidance and three Provision 29 "mythbusters" in 2026. Together they answer most of the questions boards raise about applying the UK Corporate Governance Code 2024 to internal controls. None of them changes the Code itself; they explain how the FRC expects companies to read it.
Preparing to report (January 2026)
The first mythbuster makes several practical points. The FRC will not suggest a number of material controls; most companies it has engaged with identify roughly 30 to 50, with financial services firms often having more. Companies do not need to list their material controls or the testing performed. There is no template wording, but the declaration must be clearly signposted. Reporting is usually no more than two pages.
A later restatement does not of itself invalidate a declaration made as at the balance sheet date. Companies already reporting under the US Sarbanes-Oxley regime can build on that work, but Provision 29 goes beyond financial reporting controls.
The auditor's role (June 2026)
The second mythbuster confirms that the auditor's opinion on the financial statements does not cover the Provision 29 statement. It is "other information" under ISA (UK) 720: the auditor reads it and considers whether it is materially inconsistent with the financial statements or with knowledge obtained in the audit, but is not required to test the design or operating effectiveness of the board's material controls. A significant deficiency found in the audit does not necessarily contradict a declaration of effectiveness, but the auditor will consider it.
Cyber (September 2026)
The cyber mythbuster recognises that many companies will treat a cyber security control as material. The declaration should not disclose commercially sensitive information or technical control details, and it is not a guarantee against future incidents. Provision 29 does not create a duty to report every breach; the question is whether a material control failed as at the balance sheet date. The FRC points boards to the government's Cyber Governance Code of Practice. Our cyber security lawyers advise boards on incident governance.
Building an assurance map for Provision 29
An assurance map shows, for each material control, who owns it, how it is tested, by whom, how often and what the results were. It is the single most useful document a board can have when deciding whether to make the declaration under the UK Corporate Governance Code 2024.
- Start from principal risks. Take the principal risks identified under Provision 28 and ask which controls, if they failed, would have a material effect on the company, its shareholders or its reporting.
- Define material controls. Agree a written materiality approach that reflects the company's size, business model, strategy and complexity. Approve the resulting list at board or committee level and record the reasoning.
- Assign owners. Give each material control a named first-line owner responsible for its design and day-to-day operation.
- Map the assurance sources. Record what assurance exists for each control: management self-assessment, second-line risk and compliance reviews, internal audit, external audit work relied on for the financial statements, and any third-party assurance.
- Identify gaps. Flag controls with weak or no independent assurance and decide whether to test them, add assurance or accept the gap with an explanation.
- Test before year end. Run a dry run in the year before the first declaration so that remediation can finish before the balance sheet date.
- Report upwards. Give the audit or risk committee a structured report on effectiveness, deficiencies and remediation, and minute the committee's and board's conclusions.
- Draft the statement. Describe the monitoring and review process, make the declaration, and describe any ineffective material controls and actions, cross-referring to the principal risks section.
The declaration speaks as at the balance sheet date, but the evidence must be built across the year. Boards that leave testing to the final quarter often discover deficiencies too late to fix them, which forces a disclosure that could have been avoided. Aim to have remediation complete, and tested, before the year end.
What boards must be able to evidence
Although no external assurance is required, the board must be able to show how it reached its view. The key records are:
- the board-approved list of material controls and the reasoning for selecting them;
- the assurance map, showing owners, testing and results for each material control;
- committee papers and minutes showing challenge, not just noting;
- a log of deficiencies, near misses and incidents during the year, with root cause and remediation;
- management representations from control owners and senior executives supporting the declaration; and
- a reconciliation between the principal risks, the material controls and the annual report disclosures.
These records also protect directors. A declaration made after a documented, proportionate process is far easier to defend than one made on informal comfort, whether the challenge comes from investors, the FRC or, after a significant failure, litigation. Our guide to directors' duties in the UK explains the wider duty of care and skill.
Illustrative scenario: a first-year declaration
This example is illustrative only and uses generic parties.
A UK-listed manufacturing group with a December year end identifies 38 material controls across finance, health and safety, sanctions compliance, IT access and cyber resilience. It maps each to a principal risk and assigns owners. Internal audit tests a rotating sample, while second-line compliance tests the sanctions controls quarterly.
In October, internal audit finds that user access reviews for a key enterprise system were not completed in two subsidiaries. Management fixes the process and internal audit retests in December. The control is operating effectively at the balance sheet date, so the board makes a clean declaration, but describes the monitoring that identified the issue as evidence that its review process works.
Had the retest failed, the board would still make a declaration, but would describe the ineffective control at a high level, the action proposed and the expected timetable, without disclosing sensitive technical detail.
Common mistakes and risks
Treating Provision 29 as a financial controls exercise
The UK Corporate Governance Code 2024 expressly covers operational, reporting and compliance controls as well as financial ones. Boards that simply reuse their financial statement audit controls will miss material risks in areas such as health and safety, sanctions, data protection, cyber and sustainability reporting. Start from the principal risks, not from the external auditor's controls list; the FRC has confirmed the two sets are not the same.
Defining too many, or too few, material controls
A list of several hundred controls cannot be meaningfully reviewed by a board; a list of five will not convince investors. The FRC will not set a number, but has said most companies it has engaged with identify roughly 30 to 50. The right answer depends on the business. Document the materiality approach and revisit it each year as the business and its risks change.
Leaving compliance controls without independent assurance
Compliance controls, such as those supporting the bribery, sanctions and new failure to prevent fraud regimes, often rely on self-assessment. If they are material, the board should consider independent testing by internal audit, a second-line function or an external reviewer. Our guide to failure to prevent fraud explains the reasonable procedures expected for that offence, which overlap heavily with Provision 29 evidence.
Disclosing too much detail
The FRC has said companies should not include commercially sensitive information or specific technical controls, especially for cyber. Over-disclosure can create security, litigation and market-abuse risks. Describe the governance and outcome of the review, and any material failure at a high level, and keep the detailed evidence in the board pack. Have the draft reviewed by legal counsel before publication.
Groups with overseas operations
The Code applies to in-scope companies wherever incorporated, and the declaration covers the whole group's material controls. Groups with subsidiaries or suppliers in Bangladesh, the Gulf or Asia should make sure local controls, such as sanctions screening, anti-bribery approvals and supply chain due diligence, are within the assurance map and that local management can provide reliable evidence. Language, time zones and different local regulatory standards often make overseas controls the weakest link.
Overseas subsidiaries do not need to adopt the UK Corporate Governance Code 2024 themselves, but the listed parent's board must be satisfied about the controls they operate. Clear group policies, local control owners and a reporting line into the parent's audit or risk committee make that possible.
Groups also listed in the United States can build on their Sarbanes-Oxley processes, but should extend them beyond financial reporting. Our equity capital markets team advises issuers on listing obligations, and our Bangladesh supply chain compliance page covers sourcing controls in that market.
Checklist for the first Provision 29 declaration
- Confirm the first financial year to which the new Provision 29 applies and the publication date of that annual report.
- Approve a written approach to identifying material controls, linked to the principal risks.
- Build and maintain an assurance map with owners, testing and results.
- Run a dry run in the year before the first declaration and remediate gaps.
- Decide whether any external assurance is worth obtaining, and over which controls.
- Agree with the external auditor how they will read the statement as other information.
- Prepare the statement early, keep it proportionate and avoid sensitive technical detail.
- Consider whether a comply or explain disclosure is needed for any departure.
TRW & Co's London office is authorised and regulated by the Solicitors Regulation Authority. Our corporate governance lawyers advise boards and committees on the UK Corporate Governance Code 2024, governance frameworks, board minutes and annual report disclosures. To discuss your preparations, contact us at info@trw.co or on +880 1779 127165, or visit us at Holborn Gate, 330 High Holborn, London WC1V 7QH.
Frequently asked questions
01When does Provision 29 of the UK Corporate Governance Code 2024 take effect?
The new Provision 29 applies to financial years beginning on or after 1 January 2026. A company with a 31 December year end will make its first declaration for the year ending 31 December 2026, in the annual report published in 2027. The rest of the 2024 Code has applied to financial years beginning on or after 1 January 2025. Until the new Provision applies, Provision 29 of the 2018 Code continues to apply. The FRC does not require early adoption.
02What is a material control?
The Code does not define material controls. Each board decides which of its controls are material, taking into account the company's size, business model, strategy, operations, structure and complexity. They can include financial, operational, reporting and compliance controls. The FRC will not set a number, but has said most companies it has engaged with identify roughly 30 to 50. The best starting point is the company's principal risks.
03Does the Provision 29 declaration need external assurance?
No. The Code does not require external assurance over material controls. The board decides whether to obtain any, and over which controls, and the approach can change from year to year. The external auditor's opinion does not cover the Provision 29 statement; the auditor reads it as other information under ISA (UK) 720 and considers whether it is materially inconsistent with the financial statements or the audit, but does not test the controls.
04What happens if a material control was not effective at the year end?
The board should describe any material controls that did not operate effectively as at the balance sheet date, the action taken or proposed to improve them, and any action taken on previously reported issues. The description can be at a high level and should not include commercially sensitive or technical detail. Disclosing an ineffective control is compliance with the Provision, not a breach of it, although investors will expect a credible remediation plan.
05Does the UK Corporate Governance Code 2024 apply to private companies?
No. According to the FRC, the Code applies to companies listed in the commercial companies category or the closed-ended investment funds category, whether incorporated in the UK or elsewhere. Large private companies with a separate statutory governance reporting obligation often use the Wates Principles instead. Private companies can still adopt Provision 29 practices voluntarily, and investors and lenders sometimes ask them to.
06Does a later cyber incident make the declaration wrong?
Not necessarily. The declaration speaks as at the balance sheet date and is not a guarantee that a company will not suffer a later incident. The FRC's cyber mythbuster says Provision 29 does not require boards to guarantee total cyber security or to report every breach. The question is whether a material control failed as at the balance sheet date. Boards should still consider reasonable changes in cyber risk when designing and reviewing controls.
Sources and official materials
- UK Corporate Governance Code (FRC) — Scope, effective dates and FAQs on the 2024 Code
- UK Corporate Governance Code 2024 (full text) — Principle O and Provisions 24 to 31
- Corporate Governance Code Guidance — FRC non-prescriptive guidance on applying the Code
- Provision 29 Mythbuster: Preparing to report — FRC clarifications on material controls and reporting
- Mythbuster: the auditor's responsibilities for the Provision 29 statement — ISA (UK) 720 and the auditor's role
- Provision 29 Mythbuster: Focus on Cyber — Reporting cyber controls without sensitive detail
- Improving the quality of comply or explain reporting — FRC expectations for explanations of departures
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.