Provision 29 of the UK Corporate Governance Code 2024 requires the boards of premium-listed companies to make a formal annual declaration on the effectiveness of their material internal controls — for financial years beginning on or after 1 January 2026. Despite this being the most significant UK governance reform in over a decade, Grant Thornton’s 2025 Corporate Governance Review found that only 1% of FTSE 350 firms had provided the granular disclosures the provision demands. The window for boards to act is closing fast.

What Does Provision 29 Actually Require Boards to Do?

The requirement centres on three specific disclosures in the annual report: a description of how the board has monitored and reviewed the effectiveness of its material controls framework throughout the year; a formal declaration of effectiveness as at the balance sheet date; and a description of any controls that have not operated effectively, alongside the remedial actions taken or planned.

The scope is broader than many boards initially assume. “Material controls” under the 2024 Code is not restricted to financial controls — the traditional territory of the CFO — but explicitly encompasses operational, reporting, and compliance controls. Critically, it is each board’s own responsibility to determine which controls are material, based on the company’s size, business model, strategy, and risk profile. There is no prescribed list from the Financial Reporting Council (FRC). The judgement is the board’s to make, and to stand behind publicly.

The FRC has been explicit: boards that describe their process in generic terms will face scrutiny. This is not a drafting exercise — it is a governance commitment.

Executive Action:

• Map your existing control framework against the four categories: financial, operational, reporting, and compliance — and identify gaps before the audit committee process begins.
• Commission a gap analysis immediately. For January year-end companies, the first disclosure cycle is already underway.
• Agree the board’s definition of “material control” as a formal resolution — this should not be left to finance or external advisers alone.

Why Are Only 1% of FTSE 350 Boards Actually Ready?

The gap between declared compliance and Provision 29 readiness reveals something structural. According to Grant Thornton’s analysis of 216 FTSE 350 companies, 69% of boards claim full compliance with the UK Corporate Governance Code — yet barely 1% have produced the detailed material controls disclosures the new provision demands. The disconnect is not primarily a reporting failure. It reflects how most boards have historically treated internal controls: as a finance function matter, delegated to the CFO and audit committee, rather than a board-level governance responsibility.

Provision 29 ends that arrangement. The board — not the CFO, not internal audit — must own the declaration. That requires directors to genuinely understand the controls framework, engage with what has and has not operated effectively, and stand behind a written statement in the annual report. For many non-executive directors, this represents a meaningful shift in accountability.

Executive Action:

• Review board-level training on internal controls governance — directors cannot credibly declare what they do not understand.
• Ensure the audit committee has a formal, time-bound Provision 29 workplan for the current financial year, with milestone reviews at each board meeting.
• Request a readiness assessment from internal audit, benchmarked against published FRC guidance, before Q3 2026.

How Should Boards Define What Is “Material”?

The absence of a fixed definition is both Provision 29’s greatest flexibility and its most significant governance risk. The FRC intentionally left “material” company-specific, expecting boards to make substantive, reasoned judgements about which controls — if they failed — could have a significant impact on the business or its stakeholders. That judgement must be documented and defensible.

In practice, most advisers recommend a risk-based approach: identify the risks that pose the greatest threat to the business model and stakeholder outcomes, map the controls that mitigate those risks, and then assess whether those controls are operating effectively. For regulated businesses — financial services firms under FCA rules, companies subject to the Companies Act 2006, or those navigating UK GDPR obligations — the materiality threshold will typically be higher, and FRC scrutiny more intense.

Boards should also resist the temptation to define materiality narrowly to reduce disclosure burden. The FRC’s corporate reporting review function has already signalled that it will examine whether materiality assessments appear genuine or artificially constrained.

Executive Action:

• Convene a structured materiality assessment workshop involving finance, operations, legal, risk, and compliance — not just the CFO’s team.
• Document the board’s materiality rationale explicitly in board minutes. Vague reasoning will not survive FRC review.
• Consider appointing an independent adviser to pressure-test your materiality threshold before the first disclosure is finalised.

What Should Boards Do in the Next 90 Days?

For companies with January 2026 financial year starts, the first Provision 29 disclosures will appear in annual reports published in early 2027 — but the evidence underpinning those declarations must be gathered, tested, and documented throughout 2026. Boards that approach this as a year-end drafting exercise will find themselves exposed when auditors and the FRC scrutinise the quality of the evidence trail.

Three practical priorities stand out. First, establish a board-approved position on which controls are in scope — this should not be a unilateral CFO determination. Second, embed a regular controls monitoring cadence into board and audit committee agendas. Provision 29 requires boards to describe how they have “monitored and reviewed” effectiveness over the course of the year, not merely assessed it at year-end. Third, identify any controls already known to be operating ineffectively and begin documenting the remediation narrative now. The annual report must disclose not just the declaration of effectiveness but also a clear account of what has gone wrong and what is being done about it.

INFORMD has been tracking Provision 29 readiness across UK boardrooms and expects the first wave of FRC challenge letters to target companies whose materiality frameworks appear underdeveloped or whose monitoring processes lack the cadence the Code demands. Boards that treat this as a governance priority — rather than a compliance afterthought — will be better positioned to withstand that scrutiny.

Executive Action:

• Set a Q3 2026 audit committee checkpoint to review the Provision 29 evidence base and identify any controls requiring remediation before year-end.
• Ensure all material control failures are logged in real time and remediation tracked formally — the disclosure must be accurate, not aspirational.
• Engage external auditors now on their expectations for supporting evidence. Getting alignment early avoids surprises during the annual report sign-off.

INFORMD provides intelligence briefings for senior business leaders across technology, finance, strategy, and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full library of executive briefings or speak to our team.

Stay ahead. Subscribe to INFORMD’s executive briefing at informd.co.uk/services.

Frequently Asked Questions

Who does Provision 29 of the UK Corporate Governance Code apply to?

Provision 29 applies to companies with a premium listing on the London Stock Exchange that are subject to the UK Corporate Governance Code 2024. It takes effect for financial years beginning on or after 1 January 2026, meaning the first annual reports disclosing Provision 29 declarations will appear in 2027 for December year-end companies.

What counts as a “material control” under Provision 29?

There is no fixed definition — the FRC has deliberately left this as a board-level judgement. Material controls span financial, operational, reporting, and compliance categories. Boards must determine which controls, if they failed, would have a significant impact on the business or its stakeholders, based on the company’s specific risk profile, business model, and operating context.

What must the annual report disclose if material controls have not operated effectively?

Provision 29 requires boards to disclose any material controls that have not operated effectively as at the balance sheet date, along with a description of the remedial actions taken or planned. The disclosure must also cover actions taken to address any issues reported in the prior year. Silence on known control failures is not an option and would constitute a material omission under the Code.

How does Provision 29 compare to the Sarbanes-Oxley requirements in the US?

Provision 29 is frequently compared to Section 404 of the US Sarbanes-Oxley Act. Both require declarations on internal controls, but the UK approach differs in important respects: it is board-led rather than management-led; it does not mandate external auditor attestation on internal controls (unlike SOX 404(b) for larger US filers); and it gives companies significantly more flexibility in defining materiality. However, that flexibility comes with the expectation of genuine board judgement — which the FRC will actively scrutinise.

---

Related Tools & Templates: Apply a structured framework to your board agenda — explore INFORMD executive assessments or download board-ready templates. Explore all INFORMD executive tools and assessments →