Your 2025 Guide to UK Corporate Governance Code Provision 29 Compliance

The 2025 update to the UK Corporate Governance Code sets higher expectations for risk management and internal controls. At the center of it all is Provision 29, which asks boards to show that their internal controls are designed properly, work effectively, and are reviewed regularly.

For many UK-listed companies, that brings new pressure — and new challenges. What does “effective control” really look like? How do you gather the right evidence without piling more work on already stretched teams?

In this guide, you’ll find clear answers. We’ll break down what Provision 29 demands, where companies often get stuck, and how SureCloud makes staying compliant simpler, more connected, and less stressful.

Book a Demo and See it in Action

Don’t Just Keep Up – Stay Ahead with SureCloud GRC.

Key Takeaways

Provision 29 Raises the Bar: The 2025 UK Corporate Governance Code update requires boards to prove their internal controls are well-designed, effective in practice, and regularly reviewed — not just documented.

New Compliance Pressures: Businesses face challenges from fragmented systems, manual workflows, and limited visibility, all while audit and compliance teams are expected to deliver faster, evidence-backed assurance.

SureCloud Simplifies Compliance: The SureCloud GRC platform connects risk, control, and testing activities, automates monitoring, and provides real-time dashboards to make compliance seamless and transparent.

Confidence Through Connection: With integrated technology and advisory support, SureCloud helps boards meet Provision 29 requirements confidently — reducing risk, improving accountability, and future-proofing governance.

What Is Provision 29 and Why It Matters

The UK Corporate Governance Code sets the standard for leadership, accountability, and risk management across premium-listed companies in the United Kingdom. It was built on the combined code of corporate governance, which first outlined the need for strong internal controls.

Now, the latest UK Corporate Governance Code update — effective from 2025 — raises the bar even higher.

Provision 29 is one of the biggest changes. It requires boards to confirm each year that their internal controls are not only designed properly, but also working effectively in practice. Boards must gather clear evidence to back up their statements.

This change matters because:

Investors want better proof that risks are being managed well
Regulators expect faster action when risks emerge
Boards are now directly responsible for making sure controls work — they cannot pass this duty to others

In the past, under the combined code of corporate governance, companies could focus on simply "having" controls. Now, under the new corporate governance code, it’s not enough to have controls on paper — you must prove they work.

If your controls fail, you must explain why, disclose it publicly, and demonstrate how you plan to fix it. For FTSE-listed and other large UK firms, this means stronger internal assurance processes, tighter risk monitoring, and better evidence at every step.

Read more expert commentary on the latest changes

Key Challenges for Businesses in Meeting Provision 29

Provision 29 raises the stakes for internal controls. But for many UK-listed companies, meeting the new standard isn’t simple. Here’s where most businesses struggle:

Complexity of Risk and Control Reporting:

Risks and controls are often managed across different teams using disconnected systems. Without a clear view, it’s hard for boards to spot gaps or weaknesses — and even harder to prove controls are working.

Manual Processes and Siloed Systems:

Lack of Audit Trails and Real-Time Visibility:

Pressure on Internal Audit and Compliance Teams:

How SureCloud Supports Provision 29 Compliance

SureCloud helps you move beyond manual processes and spreadsheets to meet Provision 29 expectations with less effort and more confidence. Here’s how our platform and consultancy services make compliance easier at every step.

Streamlined Risk Management

SureCloud helps you define and assess your principal risks with structured, auditable processes. You can link risks, controls, and testing activities in one connected system, so nothing falls through the cracks.

Map risks to controls quickly
Use real-time dashboards and risk registers for instant updates
Provide your board with clear, live views of your risk landscape

Find out more: SureCloud Risk Management Solutions

Controls Monitoring & Testing

Assurance & Accountability

Advisory Support

SureCloud’s GRC Platform in Action

SureCloud’s GRC platform brings risk, control, and compliance activities into one simple, connected system. It’s built to scale with you — whether you’re managing a handful of controls or hundreds across a global operation.

Here’s what you can do with SureCloud:

Connect risks, controls, and testing in one place
See control performance in real-time with easy dashboards
Automate evidence collection for Provision 29 reporting
Tailor reports to your board’s needs quickly and easily
Integrate with your existing risk and compliance systems

You’ll move faster, stay more organized, and always have a clear view of your compliance health.

Find out more: SureCloud GRC Platform Overview

Benefits of Partnering with SureCloud

Choosing SureCloud means you get more than just a software platform — you get a smarter, faster path to Provision 29 compliance. Here’s how we help you stay ahead:

Accelerated Compliance Timeline:

SureCloud streamlines risk, control, and reporting processes, helping you meet Provision 29 requirements faster and with less stress.

Confidence in Controls and Reporting:

SureCloud streamlines risk, control, and reporting processes, helping you meet Provision 29 requirements faster and with less stress.

Reduced Regulatory and Reputational Risk:

SureCloud streamlines risk, control, and reporting processes, helping you meet Provision 29 requirements faster and with less stress.

Future-Proof Governance Approach:

SureCloud streamlines risk, control, and reporting processes, helping you meet Provision 29 requirements faster and with less stress.

Explore FAQ’s on UK Corporate Governance Code and Provision 29

FAQs About the UK Corporate Governance Code  and Provision 29

Who does Provision 29 of the UK Governance Code apply to?

Provision 29 applies to UK premium-listed companies, including firms on the FTSE 350 index. Read the latest UK Corporate Governance Code update here.

What is required in the annual declaration of effectiveness?

What types of risks should be covered under Provision 29 of the UK Governance Code?

How often should internal controls be reviewed or tested?

What happens if a company cannot confirm effectiveness under Provision 29?

How can software help with Provision 29 compliance?

Does SureCloud offer support for both risk and internal controls management?

Ready to Comply? Here’s Your Next Step

Provision 29 compliance is about more than meeting a requirement — it’s a chance to strengthen your business for the future. SureCloud makes the journey simple, connected, and stress-free.

Ready to see how it works?

Request a Demo

Reviews

Read Our G2 Reviews

Review us on G2