Provision 29 Compliance: Board Controls Checklist

The scope of the declaration is broader than financial reporting controls alone. It covers four categories: internal controls over financial reporting (ICFR), operational controls relevant to material risks, reporting controls covering non-financial disclosures, and compliance controls relevant to material legal, regulatory, and contractual obligations. Companies that read 'material controls' as a proxy for ICFR will find themselves exposed when the FRC or investors ask about cyber, operational resilience, or third-party controls.

The board declaration must identify whether controls are effective, effective with specified exceptions, or not effective. Where exceptions or ineffectiveness are identified, the Annual Report must explain the nature of the weakness and the remedial actions taken or planned.

Provision 29 operates on a Comply or Explain basis. Boards that cannot declare effectiveness are expected to explain the position honestly. But a declaration of ineffectiveness without evidence of a documented assessment process will draw scrutiny from investors, the FRC, and regulators. The FRC's internal controls guidance makes clear that the declaration must be based on evidence: boards are expected to have a documented methodology for assessing controls, a testing programme that's been executed, and a reporting chain that gives them genuine visibility of control effectiveness before they sign off.

The context for Provision 29 is a decade of debate about whether UK governance standards adequately held boards to account for the quality of their internal controls. The Kingman Review (2018) and the Brydon Review (2019) both called for stronger board accountability. BEIS consulted on a UK equivalent to the US Sarbanes-Oxley Act (SOX) Section 404 requirement. The final Provision 29 is less prescriptive than SOX 404: it's a principles-based board declaration rather than an externally attested statement, and it applies to material controls rather than financial reporting controls only.

The practical implication is that Provision 29 doesn't require companies to adopt a specific control framework, whether COSO, ISO 27001:2022, or another. It does require a methodology the board can stand behind. In practice, the FRC expects companies to document their control identification process, explain how they've determined materiality, and provide evidence that controls have been tested.

Provision 29 applies to all companies with a UK premium listing on the London Stock Exchange, for financial years beginning on or after 1 January 2026. Companies with a standard listing or those listed on AIM are not mandatorily subject to the UK Corporate Governance Code, though investor expectations may encourage voluntary alignment.

For financial services firms regulated by the FCA and PRA, Provision 29 intersects with existing regulatory obligations. FCA-regulated firms that are premium-listed must satisfy both the UK Corporate Governance Code and their regulatory requirements, including the FCA's Handbook requirements on systems and controls (SYSC), PRA supervisory statements, and, for dual-regulated firms, operational resilience requirements. The Provision 29 declaration process provides an opportunity to align governance of internal controls across these overlapping obligations rather than running parallel programmes.

Determining which controls are 'material' is the first substantive challenge in Provision 29 compliance. The FRC guidance doesn't prescribe a universe of controls. Instead, it sets out a risk-based approach: material controls are those that address risks that could, if they crystallised, cause significant harm to financial performance, operational continuity, regulatory standing, or the reliability of the company's reporting.

In practice, determining materiality requires working through three questions. First, what are the material risks the company faces? Second, for each material risk, what controls exist that are designed to prevent or detect it? Third, is the design and operation of those controls adequate to give the board reasonable assurance that the risk is being managed?

For financial services firms, the intersection between Provision 29 and FCA operational resilience requirements under PS21/3 is direct. The important business services identified under operational resilience obligations are, by definition, material operational processes. The impact tolerances, mapping, and testing evidence produced for FCA purposes can feed directly into the Provision 29 evidence framework, reducing duplication across overlapping compliance obligations.

This checklist covers the five areas that a Provision 29 compliance programme must address. It's designed for use by internal audit, compliance, and risk functions preparing for the first declaration cycle. Each item requires documented evidence, not assertion.

1. Governance Framework

1. Board has formally designated accountability for overseeing the internal controls assessment (the Audit Committee in most cases).

2. Audit Committee terms of reference updated to include Provision 29 oversight responsibilities.

3. A named executive holds responsibility for the internal controls framework (CFO, CRO, or CISO for relevant control categories).

4. A cross-functional controls working group is established, with representation from Finance, Risk, Legal, IT/Cyber, and Compliance.

5. A documented methodology for Provision 29 assessment has been approved by the Audit Committee.

6. The FRC guidance on Provision 29 has been reviewed and the company's approach aligned to it.

7. The assessment methodology and timeline have been communicated to all control owners.

2. Risk and Materiality Assessment

1. A complete list of material risks facing the company has been identified and documented, drawing on the enterprise risk register.

2. For each material risk, relevant controls have been identified and mapped.

3. A materiality threshold has been defined and documented: what level of control failure would be reportable under Provision 29?

4. The materiality determination has been reviewed and approved by the Audit Committee.

5. Controls associated with FCA and PRA regulatory obligations and FCA PS21/3 operational resilience requirements have been included where applicable.

6. Third-party and ICT outsourcing controls have been assessed for materiality, particularly for DORA in-scope entities or firms with material outsourcing under SS2/21.

3. Control Design and Documentation

1. Each material control has a documented description covering: what it does, who is responsible, how often it operates, and what evidence it produces.

2. Control designs have been assessed for adequacy: is the control, if operating as designed, sufficient to address the risk?

3. Control owners have confirmed their understanding of and responsibility for each control.

4. The controls inventory is held in a system of record (GRC platform, not spreadsheet) that supports version history and evidence linkage.

5. Gaps in the control universe (risks identified without adequate controls) have been documented and escalated.

6. Compensating controls for known design weaknesses have been identified and documented.

4. Control Testing and Monitoring

1. A risk-based testing programme has been designed and approved, covering all material controls.

2. Testing frequency reflects control risk: higher-risk controls tested more frequently, automated controls tested for continued operation.

3. Testing has been carried out by teams independent of control owners (internal audit or second-line risk functions).

4. Test results have been documented with evidence, including any exceptions or deficiencies identified.

5. Deficiencies identified during testing have been rated by severity (control deficiency, significant deficiency, or material weakness equivalent).

6. Remediation actions for deficiencies have been assigned, tracked, and closed within defined timelines.

7. An ongoing monitoring process is in place between formal testing cycles (key risk indicators, automated control monitoring, exception reporting).

8. Evidence from regulatory inspections, external audits, and internal audit reviews has been incorporated into the controls assessment.

5. Board Declaration and Reporting

1. The Audit Committee has reviewed the consolidated output of the controls assessment, including all deficiencies and their disposition.

2. The board has received a summary of the controls assessment with sufficient detail to support an informed declaration.

3. The declaration position (effective, effective with exceptions, or not effective) has been determined and documented.

4. Where exceptions are identified, the nature of the weakness, its financial or operational impact, and the remedial actions taken are documented for inclusion in the Annual Report.

5. The Provision 29 disclosure in the Annual Report has been reviewed by Legal and the Audit Committee before publication.

6. The controls assessment documentation is retained and accessible for a minimum of six years, consistent with general company records retention requirements.

Companies approaching Provision 29 for the first time encounter the same set of problems. Understanding them in advance reduces the risk of the board being unable to make a credible declaration.

1. Insufficient evidence from control owners. The most common gap: control owners who understand their responsibilities but haven't been maintaining contemporaneous evidence of control operation. Where evidence exists only in individuals' memory or in informal communications, it can't support a board declaration. Control owners need to produce dated, documented evidence at the time controls operate, not at year-end.
2. Materiality determined too narrowly. Companies that interpret 'material controls' as synonymous with 'financial reporting controls' find themselves exposed when regulators or investors ask about cyber, operational resilience, or outsourcing controls. The FRC guidance is explicit: materiality extends beyond ICFR.
3. Testing too close to reporting. Companies that begin their testing programme in the final quarter of the financial year leave no time to remediate deficiencies before the declaration must be made. A rolling testing programme, designed to surface and address deficiencies throughout the year, is the only approach that makes remediation before declaration achievable.
4. Audit Committee insufficiently engaged. A board declaration requires genuine board understanding of the controls environment. Audit Committees that receive a one-page summary without discussion of the underlying methodology or key deficiencies can't make an informed declaration. Regular, substantive Audit Committee engagement throughout the year is what turns a controls programme into a defensible declaration.

A Provision 29 compliance programme generates a substantial volume of documentation: risk assessments, control inventories, test results, deficiency logs, remediation tracking, Audit Committee papers. Spreadsheet-based tracking breaks down when multiple control owners update their sections independently, when testing evidence is held across different systems, and when the Audit Committee needs a consolidated view ahead of the board declaration.

A GRC platform addresses these problems structurally. Centralised control inventories with linked evidence give a single view of control status across the business. Automated testing workflows notify control owners and escalate overdue items. Real-time dashboards give the Audit Committee and board visibility of the controls environment without manual report consolidation.

A full audit trail of decisions, exceptions, and remediation actions provides the documented record that a credible Provision 29 declaration requires. Without it, the controls programme may be running; it just can't be demonstrated.

Gracie AI Agents with Personas and Skills performs activities across controls testing and evidence collection, cutting audit preparation time by up to 75%. That means the board gets its consolidated controls assessment faster, with less manual reconciliation behind it. When the Audit Committee needs to stand behind a declaration, the evidence is already assembled, audited, and traceable.

For financial services firms, the additional value of a GRC platform is cross-framework integration. Provision 29 controls evidence overlaps substantially with what's required for FCA operational resilience (PS21/3 self-assessments), DORA compliance (ICT risk management framework evidence), and ISO 27001:2022 surveillance audits. A platform that maps controls once and uses them across frameworks removes the duplication that makes Provision 29 a standalone compliance burden.

For guidance on how compliance automation supports continuous controls monitoring and evidence collection throughout the year, see our guide to compliance vs continuous assurance. For an overview of compliance automation approaches available to UK-listed and regulated financial services firms, see compliance automation in the UK.