Provision 29: The Board Internal Controls Declaration for 2026

Under Provision 29 of the UK Corporate Governance Code, boards must formally declare the effectiveness of their material internal controls — and 2026 is the only year to build that evidence before the first declarations are due.

Provision 29 of the 2024 UK Corporate Governance Code, published by the Financial Reporting Council (FRC), applies to financial years beginning on or after 1 January 2026. For companies with calendar year-ends, the first mandatory Provision 29 declaration will appear in annual reports published in early 2027. This means 2026 is the evidence-building year — the period in which boards must monitor, test, and document the effectiveness of their material controls. Boards that have not yet begun this process are already behind the timeline that Provision 29 implicitly requires.

What Exactly Does Provision 29 Require from UK Boards?

Provision 29 requires boards to make three specific disclosures in their annual report. First, a description of how the board has monitored and reviewed the effectiveness of its risk management and internal control framework throughout the year. Second, a declaration of whether the board considers the material controls to be effective as of the balance sheet date. Third, disclosure of any material control weaknesses identified, together with details of remediation or improvement plans.

This is a substantive upgrade from the previous requirement under the 2018 Code, which required only a general statement that the board had reviewed the effectiveness of risk management and internal controls. Provision 29 requires a specific, evidenced declaration — one that auditors, investors, and the FRC will scrutinise. According to ICAEW guidance published in January 2026, companies should be aware that Provision 29 declarations will be subject to enhanced investor and regulator scrutiny, particularly where weaknesses or near-misses are identified but not disclosed. Boards that make declarations without adequate supporting evidence expose individual directors to accountability questions under the Companies Act 2006. Use INFORMD’s governance self-assessment tools to evaluate your current controls framework against Provision 29 requirements.

• Agree the definition of “material controls” with your external auditor and Audit Committee before commencing the monitoring cycle — scope ambiguity is the most common early-stage risk.
• Establish a formal monitoring calendar that schedules controls testing at intervals throughout 2026, not just at year-end — Provision 29 requires evidence of ongoing monitoring, not a point-in-time assessment.
• Ensure the board, not just management, reviews controls effectiveness data at each board meeting — the declaration must reflect the board’s own assessment, not a management representation.

Executive Action: agree materiality scope and monitoring calendar with the Audit Committee by end of Q3 2026.

Which Controls Fall Within Scope of the Provision 29 Declaration?

The 2024 UK Corporate Governance Code deliberately extends the scope of controls beyond financial reporting. Provision 29 applies to material controls covering financial, operational, compliance, and reporting risks — including controls over narrative and ESG reporting. This is a significant expansion. Previously, internal controls declarations were largely associated with financial reporting controls in the style of Sarbanes-Oxley Section 404. Under Provision 29, the scope extends to the controls that underpin operational continuity, regulatory compliance, and the accuracy of the Strategic Report.

For Audit Committees, this means the controls review programme must now encompass IT and cybersecurity controls relevant to operational continuity, controls over ESG and sustainability data underpinning disclosures in the Strategic Report, legal and regulatory compliance controls, and key financial controls over reporting. According to KPMG guidance on Provision 29, the expanded scope means many boards will need to invest significantly in their controls infrastructure to be in a position to make a credible Provision 29 declaration. Boards that have historically relied on management representations for non-financial controls now face a governance gap. Access INFORMD’s governance briefing library for further resources on controls programme design.

• Map all material controls across the four categories — financial, operational, compliance, and reporting — and confirm which are in scope for the Provision 29 declaration.
• Extend internal audit coverage to include ESG reporting controls and key operational controls not previously within the audit programme.
• Brief the board on the expanded scope at the earliest opportunity — many NEDs are accustomed to the narrower financial controls framework and will need time to engage with the broader requirements.

Executive Action: expand the internal audit programme to cover all Provision 29 in-scope controls before Q4 2026.

What Happens When Material Control Weaknesses Are Identified?

Provision 29 does not require perfection — it requires transparency and remediation. The Code explicitly anticipates that boards may identify material control weaknesses in their assessment. Where weaknesses are found, the board must disclose their nature and the remediation or improvement plans in place. This is a significant cultural shift for many UK boards, which have historically treated controls weaknesses as confidential matters for management to resolve before year-end.

The FRC’s expectation is that Provision 29 disclosures will be substantive and specific, not boilerplate. Investors and proxy advisers will compare declarations across companies to identify those where the absence of disclosed weaknesses appears implausible given the organisation’s complexity, the pace of change, or prior incidents. Boards should consider carefully whether their Provision 29 declaration passes the scrutiny test: if a sophisticated investor reviewed our controls programme, would they find our declaration credible? Explore INFORMD’s Board Governance templates for a structured approach to Provision 29 disclosure planning.

• Establish a clear protocol for escalating identified weaknesses from management to the Audit Committee and then to the full board — Provision 29 is a board-level declaration, not a management one.
• Prepare a remediation tracking mechanism that documents the status of any weakness identified during the monitoring cycle, with target resolution dates.
• Test the draft Provision 29 declaration against investor scrutiny before finalisation — consider engaging a specialist governance adviser to review for credibility and completeness.

Executive Action: establish a weaknesses escalation and remediation tracking protocol by end of Q2 2026.

How Should the Audit Committee Lead the Provision 29 Process?

The Audit Committee is the primary governance vehicle for Provision 29 preparation. It is responsible for overseeing the controls monitoring programme, reviewing the outputs of internal audit and management self-assessment, and recommending the board’s declaration for approval. In practice, this means the Audit Committee Chair must take an active leadership role in 2026 — not simply receive reports from management, but drive the controls review agenda and challenge management on completeness and rigour.

Audit Committees should also engage early with external auditors on their Provision 29 approach. While the declaration is the board’s, external auditors will form a view on its plausibility as part of their annual report review. Proactive engagement reduces the risk of last-minute disputes over the adequacy of the monitoring programme or the credibility of the declaration. The FRC’s Audit Committee Guidance (updated 2024) provides a useful framework for this engagement. Access INFORMD’s contact page to discuss governance advisory support for Provision 29 readiness.

• Task the Audit Committee with presenting a Provision 29 readiness report to the full board by end of Q3 2026, covering monitoring progress, weaknesses identified, and declaration drafting timeline.
• Engage external auditors on their approach to reviewing the Provision 29 declaration before year-end — agree expectations on evidence standards and disclosure format in advance.
• Consider whether the current Audit Committee composition has the skills to lead the expanded Provision 29 scope — operational and technology controls expertise may need to be added.

Executive Action: issue a Provision 29 leadership mandate to the Audit Committee Chair no later than July 2026.

INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library or access our free assessment tools.

Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk.