Provision 29: What UK Boards Must Declare on Controls in 2026
Executive Action:
- Do not treat the ARGA pause as a signal to deprioritise controls readiness
- Ask auditors directly how the FRC’s new risk-based supervisory model affects your sector categorisation
- Brief the Risk Committee on the distinction between Provision 29 duties and the stalled ARGA legislation
How Should Boards Prepare the Declaration Process?
A defensible Provision 29 declaration needs a documented control framework, a testing methodology, and a clear escalation path for control failures identified during the year. Boards that leave this to a pre-year-end scramble will find the evidence trail thin exactly when it needs to be strongest.
The most effective approach treats the declaration as the output of a continuous process, reviewed at each scheduled Audit Committee meeting, rather than a single year-end exercise assembled retrospectively by finance and internal audit.
Executive Action:
- Add a standing Provision 29 evidence review to every Audit Committee agenda for the year
- Use INFORMD’s project review checklist to structure control testing documentation
- Agree in advance how any identified control weakness will be disclosed in the declaration
What Happens If a Board Gets the Declaration Wrong?
A materially inaccurate declaration exposes directors to the same scrutiny as any other misstatement in the annual report — questions from shareholders, potential FRC enquiry, and reputational damage if a subsequent control failure contradicts an earlier “effective” declaration. Directors carry personal accountability for statements made in their name under the Companies Act 2006.
The safer course is precise, evidenced language that reflects genuine uncertainty where it exists, rather than a blanket assurance the board cannot fully stand behind.
Executive Action:
- Have legal counsel review draft declaration wording before it goes to the full board
- Disclose known control gaps explicitly rather than smoothing them into general language
- Keep a contemporaneous record of the evidence relied on for each declaration statement
INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library or access our free assessment tools.
Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk.
Provision 29 requires boards to review the effectiveness of their material internal controls at least annually and declare in the annual report whether those controls were effective. It applies to financial years beginning on or after 1 January 2026.
No. Provision 29 sits within the Code itself and required no legislation, so it proceeds on schedule even though the wider Audit and Reporting Governance Authority reform has been paused by the Government.
The UK Corporate Governance Code applies on a comply-or-explain basis to premium-listed companies, primarily FTSE 350 constituents, for financial years beginning on or after 1 January 2026.
Disclose it explicitly in the declaration rather than smoothing it into general assurance language, document the remediation plan, and ensure legal counsel reviews the wording before it reaches the full board and annual report.
Executive Action:
- Confirm whether your first financial year beginning on or after 1 January 2026 is already underway
- Ask the Audit Committee to map which controls will be classified as “material” for declaration purposes
- Require management to produce evidence packs, not narrative summaries, for each material control
Why Did Audit Reform Stall While Provision 29 Moved Ahead?
The broader Audit and Reporting Governance Authority reform, which would have replaced the Financial Reporting Council with a stronger statutory regulator, has been paused by the Government, which has judged wholesale audit reform is not a current priority. Some elements are being carried forward informally under the proposed Corporate Reporting Authority label, but the formal legislative timetable has slipped.
Provision 29, by contrast, was already embedded in the Code itself and needed no primary legislation, so it proceeds on schedule regardless of the wider reform’s fate. Boards should not assume that a paused ARGA means reduced control scrutiny — the FRC has moved to a three-stage risk-based supervisory model covering the 2026-27 financial year, with enhanced supervision and quality reviews for firms it judges higher risk.
Executive Action:
- Do not treat the ARGA pause as a signal to deprioritise controls readiness
- Ask auditors directly how the FRC’s new risk-based supervisory model affects your sector categorisation
- Brief the Risk Committee on the distinction between Provision 29 duties and the stalled ARGA legislation
How Should Boards Prepare the Declaration Process?
A defensible Provision 29 declaration needs a documented control framework, a testing methodology, and a clear escalation path for control failures identified during the year. Boards that leave this to a pre-year-end scramble will find the evidence trail thin exactly when it needs to be strongest.
The most effective approach treats the declaration as the output of a continuous process, reviewed at each scheduled Audit Committee meeting, rather than a single year-end exercise assembled retrospectively by finance and internal audit.
Executive Action:
- Add a standing Provision 29 evidence review to every Audit Committee agenda for the year
- Use INFORMD’s project review checklist to structure control testing documentation
- Agree in advance how any identified control weakness will be disclosed in the declaration
What Happens If a Board Gets the Declaration Wrong?
A materially inaccurate declaration exposes directors to the same scrutiny as any other misstatement in the annual report — questions from shareholders, potential FRC enquiry, and reputational damage if a subsequent control failure contradicts an earlier “effective” declaration. Directors carry personal accountability for statements made in their name under the Companies Act 2006.
The safer course is precise, evidenced language that reflects genuine uncertainty where it exists, rather than a blanket assurance the board cannot fully stand behind.
Executive Action:
- Have legal counsel review draft declaration wording before it goes to the full board
- Disclose known control gaps explicitly rather than smoothing them into general language
- Keep a contemporaneous record of the evidence relied on for each declaration statement
INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library or access our free assessment tools.
Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk.
Provision 29 requires boards to review the effectiveness of their material internal controls at least annually and declare in the annual report whether those controls were effective. It applies to financial years beginning on or after 1 January 2026.
No. Provision 29 sits within the Code itself and required no legislation, so it proceeds on schedule even though the wider Audit and Reporting Governance Authority reform has been paused by the Government.
The UK Corporate Governance Code applies on a comply-or-explain basis to premium-listed companies, primarily FTSE 350 constituents, for financial years beginning on or after 1 January 2026.
Disclose it explicitly in the declaration rather than smoothing it into general assurance language, document the remediation plan, and ensure legal counsel reviews the wording before it reaches the full board and annual report.
UK boards must now formally declare, not just narrate, that their material internal controls are effective. Provision 29 of the UK Corporate Governance Code 2024 applies to financial years beginning on or after 1 January 2026, and it converts a soft narrative disclosure into a hard board-level attestation.
For most FTSE-listed and large private companies, this is the first Code cycle where “we believe our controls are broadly effective” is no longer sufficient. The board must state, with evidence, whether controls actually worked during the year.
What Exactly Does Provision 29 Require?
Provision 29 requires the board to monitor the company’s risk management and internal control framework and, at least annually, carry out a review of its effectiveness. The board must then report in the annual report on that review, including a declaration on whether the material controls were effective as at the balance sheet date. Alongside this, changes to Principle O make clear the board must not only establish but also maintain an effective framework — a continuous obligation, not an annual snapshot.
This is a materially higher evidentiary bar than the pre-2024 Code, which asked boards to describe their approach rather than certify an outcome.
Executive Action:
- Confirm whether your first financial year beginning on or after 1 January 2026 is already underway
- Ask the Audit Committee to map which controls will be classified as “material” for declaration purposes
- Require management to produce evidence packs, not narrative summaries, for each material control
Why Did Audit Reform Stall While Provision 29 Moved Ahead?
The broader Audit and Reporting Governance Authority reform, which would have replaced the Financial Reporting Council with a stronger statutory regulator, has been paused by the Government, which has judged wholesale audit reform is not a current priority. Some elements are being carried forward informally under the proposed Corporate Reporting Authority label, but the formal legislative timetable has slipped.
Provision 29, by contrast, was already embedded in the Code itself and needed no primary legislation, so it proceeds on schedule regardless of the wider reform’s fate. Boards should not assume that a paused ARGA means reduced control scrutiny — the FRC has moved to a three-stage risk-based supervisory model covering the 2026-27 financial year, with enhanced supervision and quality reviews for firms it judges higher risk.
Executive Action:
- Do not treat the ARGA pause as a signal to deprioritise controls readiness
- Ask auditors directly how the FRC’s new risk-based supervisory model affects your sector categorisation
- Brief the Risk Committee on the distinction between Provision 29 duties and the stalled ARGA legislation
How Should Boards Prepare the Declaration Process?
A defensible Provision 29 declaration needs a documented control framework, a testing methodology, and a clear escalation path for control failures identified during the year. Boards that leave this to a pre-year-end scramble will find the evidence trail thin exactly when it needs to be strongest.
The most effective approach treats the declaration as the output of a continuous process, reviewed at each scheduled Audit Committee meeting, rather than a single year-end exercise assembled retrospectively by finance and internal audit.
Executive Action:
- Add a standing Provision 29 evidence review to every Audit Committee agenda for the year
- Use INFORMD’s project review checklist to structure control testing documentation
- Agree in advance how any identified control weakness will be disclosed in the declaration
What Happens If a Board Gets the Declaration Wrong?
A materially inaccurate declaration exposes directors to the same scrutiny as any other misstatement in the annual report — questions from shareholders, potential FRC enquiry, and reputational damage if a subsequent control failure contradicts an earlier “effective” declaration. Directors carry personal accountability for statements made in their name under the Companies Act 2006.
The safer course is precise, evidenced language that reflects genuine uncertainty where it exists, rather than a blanket assurance the board cannot fully stand behind.
Executive Action:
- Have legal counsel review draft declaration wording before it goes to the full board
- Disclose known control gaps explicitly rather than smoothing them into general language
- Keep a contemporaneous record of the evidence relied on for each declaration statement
INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library or access our free assessment tools.
Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk.
Provision 29 requires boards to review the effectiveness of their material internal controls at least annually and declare in the annual report whether those controls were effective. It applies to financial years beginning on or after 1 January 2026.
No. Provision 29 sits within the Code itself and required no legislation, so it proceeds on schedule even though the wider Audit and Reporting Governance Authority reform has been paused by the Government.
The UK Corporate Governance Code applies on a comply-or-explain basis to premium-listed companies, primarily FTSE 350 constituents, for financial years beginning on or after 1 January 2026.
Disclose it explicitly in the declaration rather than smoothing it into general assurance language, document the remediation plan, and ensure legal counsel reviews the wording before it reaches the full board and annual report.
