UK Corporate Governance Code Provision 29: 2026 Guide

The FRC published the updated UK Corporate Governance Code in January 2024. It applies on a comply-or-explain basis: companies state annually how they've complied with the Code, and where they haven't, they explain why. Following the Financial Conduct Authority's (FCA) July 2024 Policy Statement PS24/6, which replaced the old premium and standard listing segments with a single commercial companies category, the Code's reach now extends to every company in the commercial companies and closed-ended investment funds listing categories, well beyond the former premium-listed tier.

The 2024 Code introduced a two-stage timeline. Principle O, which requires boards to maintain and review a risk management and internal control framework, applies to financial years beginning on or after 1 January 2025. Provision 29, the formal declaration requirement, follows a year later for financial years beginning on or after 1 January 2026. Companies already working to Principle O should have a framework in place before their first Provision 29 declaration falls due.

Provision 29 asks boards to do three things: describe how they monitored and reviewed the risk management and internal control framework throughout the year, declare formally whether material controls were effective at the balance sheet date, and disclose any material controls that weren't operating effectively, along with the action taken and progress against anything reported previously.

The board decides what counts as material, linked to the company's principal risks, business model and stakeholder impact. The FRC doesn't hand boards a checklist, so this is one of the most consequential judgement calls a board makes in 2026.

How This Differs From US SOX

Provision 29 gets compared to the US Sarbanes-Oxley Act (SOX) often enough that the comparison is worth correcting directly. Under SOX, management's assessment of internal controls over financial reporting must be attested by the external auditor. Provision 29 carries no such requirement: the board makes its own declaration from evidence it has gathered through its own monitoring and assurance work, and external auditors aren't required to opine on it. The practical effect is a standard of reasonable assurance, built on a documented evidence base the board compiles itself, which is why the ICAEW has published specific guidance for auditors on what the revised provision changes for their work.

Provision 29 is a board-level responsibility that boards can't delegate to the compliance team. But the parts that cause the most difficulty in a first declaration are rarely technical. They're judgement calls: what's material, what evidence is enough, and how to write a disclosure that says something real.

Defining "Material" Controls

The FRC doesn't supply a list of controls to cover. Boards decide for themselves, tied to the company's principal risks, business model and the interests of key stakeholders, and that scoping decision needs a documented rationale to survive scrutiny. Most companies engaging with the FRC on this have landed on somewhere between 30 and 50 material controls, with financial-sector firms often naming more, and there's no requirement to match that number or compare against peers. Many boards are scoping their first declaration without any published peer disclosures to benchmark against, since the earliest Provision 29 declarations won't appear until 2027.

Setting an Evidence Standard Before Q4

A board can't declare with confidence unless it's already agreed what counts as sufficient evidence: which controls get tested and how often, what exception thresholds trigger escalation, how issue closure gets verified, and who's accountable for attesting at each level. Skip this agreement and the year-end evidence pack turns out inconsistent, incomplete, or both. Boards that leave the question until the fourth quarter are the ones scrambling in December.

Reconciling the Three Lines of Assurance

The board's view of control effectiveness rests on three different sources of evidence. First-line management attestations come from control owners, second-line monitoring comes from risk and compliance functions, and third-line findings come from internal audit, each in a different format, at a different frequency, often sitting in a different system. Bringing the three together into one coherent picture is the real operational challenge behind Provision 29. Miss the reconciliation between internal audit findings and management attestations, and the board is working from a picture that isn't complete.

Avoiding Boilerplate Language

Generic language draws scrutiny. The FRC has confirmed it will not be providing any wording for declarations, specifically so boards don't default to safe, generic phrasing, and it expects reporting to stay proportionate rather than turn into a box-ticking script. Outcome-focused language, tied to the company's principal risks and risk appetite, is what separates a credible declaration from one that reads like a compliance formality.

Weak: "The board has reviewed the risk management and internal control framework and is satisfied that it is operating effectively."

Stronger: "During the year, the board reviewed the effectiveness of material controls across financial, operational, reporting and compliance categories, testing [X] key controls with [Y]% operating effectively throughout the year. Two controls relating to [specific risk area] needed improvement, with remediation complete by [date], and the board is satisfied that material controls were effective at the balance sheet date."

Specificity over sentiment.

The FRC expects boards to show their working: the process and reasoning behind the view, laid out in enough depth to reflect the evidence sitting behind it. A board that compresses real testing work into a single paragraph hasn't met the spirit of the requirement.

Boards and governance, risk and compliance (GRC) teams are asking the same question right now: what does a good Provision 29 declaration actually look like? The FRC's guidance is clear on structure, but the quality of early disclosures will vary widely.

1. A description of the monitoring and review process: How the board maintained oversight of the risk framework across the year, including reporting cadence, roles involved and assurance activity undertaken.
2. A formal declaration on effectiveness: A positive assertion that material controls were, or weren't, effective at the balance sheet date.
3. Disclosure of any ineffective controls: What the control was, the action taken or proposed, and progress against anything flagged previously.
4. The process used to reach the conclusion: How the board got there: testing results, internal audit findings, management attestations, exception reports.

Boards that treat Provision 29 as a year-end exercise run out of road. The evidence base for a credible declaration gets built across the full financial year, and the table below reflects emerging practice from FRC guidance and GRC advisers working with FTSE-listed companies.

The mid-year dry run in Phase 3 is the step boards skip most often, and it's the one that matters most. Advisers working with boards on Provision 29 readiness see the same pattern repeatedly: rehearsing the declaration with the audit committee while there's still time to test surfaces evidence gaps early. Boards that skip it tend to find those same gaps in the fourth quarter, when the options for fixing them have mostly closed.

Most boards already have controls in place. What they lack is reliable, current evidence that those controls are working, because point-in-time testing only ever gives a snapshot. Automated controls suit continuous monitoring; manual controls still need management attestations alongside targeted testing. SureCloud's Continuous Controls Monitoring provides full-population testing data across automated controls in place of sample-based testing, giving boards a continuously updated view of control performance and a 50 to 65% reduction in manual evidence collection.

The three-lines model is the right framework for Provision 29, but most organisations run each line through a separate system: management attestations sitting in email threads or spreadsheets, risk and compliance monitoring in one tool, Internal Audit findings recorded in another. Consolidating that picture manually takes weeks, so the board's assurance map is rarely current. SureCloud connects first-line attestations, second-line risk and compliance monitoring, and Internal Audit findings in a single system, so gaps between lines show up before they become blind spots in the annual declaration. Clients using the platform have cut board report preparation from two weeks to two days, because the underlying data doesn't need re-assembling every time.

Boards building the evidence for their first Provision 29 declaration face three judgement calls that no platform can make for them: which controls are material, what evidence standard is enough, and how to draft disclosure language that meets FRC expectations without overstating or understating the position. SureCloud's advisory team works alongside the platform on exactly these questions, scoping material controls against principal risks, designing evidence standards that are proportionate and defensible, and reviewing draft disclosure language before it reaches the audit committee. That support tends to matter most for boards that are ahead on technology but behind on the calls only the board itself can make.

1. Risk-to-control mapping that keeps scope decisions documented and traceable.
2. Continuous control testing for automated controls, replacing point-in-time sampling.
3. Structured, auditable attestation workflows for first-line management input.
4. Integrated Internal Audit findings, recorded in the same system as risk and compliance data so the assurance map stays current.
5. Board-ready reporting, generated from live data and ready well ahead of year-end.