Provision 29: The UK Board Material Controls Deadline for 2026

For every UK premium-listed company with a financial year beginning on or after 1 January 2026, the board is now in its first Provision 29 compliance year. By the time annual reports are published in 2027, boards must carry a formal declaration on the effectiveness of their material controls — and the groundwork to support that declaration must be laid now, not in the final quarter.

What Does Provision 29 Actually Require?

Provision 29 of the UK Corporate Governance Code 2024 places a clear obligation on boards: to monitor the company’s risk management and internal control framework across all its activities, and to conduct at least an annual review of its effectiveness. In principle, that duty has existed for years. What is new is the scope and the formality.

The 2024 Code explicitly extends the review to material controls covering financial, operational, reporting, and compliance activities — not just financial reporting controls as was previously the case. The board must make a formal declaration in the annual report on the effectiveness of those controls as at the balance sheet date, and must describe how it carried out that monitoring throughout the year.

The definition of “material” is the board’s to determine. That judgement must be defensible, proportionate to the organisation’s risk profile, and documented. Analysis by governance specialists suggests many boards are still working through what qualifies as a material control in their specific context — a gap that cannot remain open by year-end.

Executive Action:

• Agree the board’s working definition of “material controls” before the half-year — this is a board decision, not a management recommendation to be rubber-stamped.
• Confirm your Audit Committee has a formal review plan covering all four control categories: financial, operational, reporting, and compliance.
• Assess whether your current assurance reporting gives the board what it needs to make a credible declaration, or whether there are visibility gaps that need closing urgently.

Why This Is Different from Previous Internal Controls Requirements

Before the 2024 Code, the UK Corporate Governance Code required boards to review the effectiveness of their risk management and internal control systems, but the obligation was less explicit on scope and did not require a formal declaration. The Turnbull Guidance had evolved into something of a compliance checkbox. Provision 29 is a deliberate departure from that.

The FRC’s intent — articulated in the Code’s accompanying guidance — is to bring UK practice closer to the US Sarbanes-Oxley Section 404 model, without requiring audit attestation. The board declares; management provides the assurance framework behind that declaration. According to KPMG’s analysis of Provision 29 implementation, the requirement creates direct personal accountability for directors in a way previous guidance did not.

That accountability point is becoming more significant. The FRC is transitioning into the Audit, Reporting and Governance Authority — to be known as the Corporate Reporting Authority — which will carry new powers to impose civil regulatory sanctions on directors for serious failures of existing corporate reporting duties. Boards that produce inadequate Provision 29 disclosures will be operating in a regulatory environment with considerably fewer soft landings.

Executive Action:

• Do not delegate the declaration to the Audit Committee alone — the full board must be in a position to defend it, as individual director accountability is the direction of regulatory travel.
• Check that your internal audit plan for 2026 is explicitly mapped to material control categories, not just financial reporting.
• Consider whether board reporting dashboards need upgrading to give direct, timely visibility of control effectiveness across all four categories.

How Should Boards Approach the Material Controls Review?

The practical challenge for most boards is aggregation: management assurance processes are typically designed to report up to the CFO or CRO, not to give the board a direct view. Provision 29 requires the board to monitor throughout the year — not simply to receive a year-end summary and sign it off.

Effective implementation involves three connected elements. First, a clear articulation of what the board considers material — covering both likelihood and stakeholder impact. Second, a structured assurance map showing which controls in each category are being tested, by whom, and on what schedule. Third, a reporting cadence that gives the board genuine oversight, not a condensed annual pack presented weeks before the report is signed.

The Chartered IIA’s guidance on Provision 29 notes that internal audit has a central role in providing independent assurance across all four control categories. Boards that have historically used internal audit primarily for financial controls will need to recalibrate the function’s scope and resource, and clarify its reporting line to the board rather than to management alone.

Governance frameworks and templates to support board-level controls review are available via INFORMD’s templates library. Boards looking to test their current governance posture before committing to a declaration approach can use the diagnostic tools at INFORMD’s executive tools and assessments.

Executive Action:

• Review whether internal audit’s remit and resource are aligned to the full Provision 29 scope — operational and compliance controls are often under-assured relative to financial controls.
• Establish a clear protocol for escalating material control failures or near-misses directly to the board during the year — not just at year-end.
• Commission a gap analysis against Provision 29 requirements before the end of Q3 2026. Earlier if your financial year-end falls before December.

What the Transition to ARGA Means for Directors Right Now

The regulatory backdrop to Provision 29 is shifting in ways that matter beyond this year’s compliance cycle. The FRC is moving towards its successor body, the Corporate Reporting Authority, through legislation that will grant the new authority direct powers to pursue company directors for failures in corporate reporting obligations. This applies to all UK premium-listed companies — not just those in financial services.

Research from White & Case’s 2026 horizon scanning indicates that the consultation on director accountability powers is expected to progress this year. The direction is unambiguous: corporate reporting — including the Provision 29 declaration — is moving towards a regime in which named directors carry personal accountability for serious failures. Boards treating the declaration as a disclosure exercise, rather than a year-round governance process, are accumulating risk they may not have quantified.

INFORMD has been tracking the Provision 29 implementation landscape for UK senior executives alongside the broader corporate governance reform agenda — including the ARGA transition, the FRC’s updated guidance, and the investor scrutiny building around controls declarations in the first reporting cycle. Executives looking to stay current on these developments can access the full briefing library at INFORMD’s resources page.

Frequently Asked Questions

Which companies does Provision 29 apply to?

Provision 29 applies to UK premium-listed companies following the 2024 UK Corporate Governance Code, for financial years beginning on or after 1 January 2026. Companies with December year-ends will produce their first Provision 29 declarations in annual reports published in spring 2027. Earlier year-ends fall within scope sooner.

What counts as a “material control” under Provision 29?

The Code does not define material controls prescriptively — it is a board judgement based on the company’s specific risk profile and potential impact on stakeholders. Controls are generally considered material if their failure could cause significant financial loss, regulatory breach, operational disruption, or reputational harm. The board must document its definition and apply it consistently across all four control categories.

What happens if the board cannot declare controls effective?

A qualified or adverse declaration is permitted under the Code. If the board cannot make a positive declaration, it must disclose that fact and explain the remediation steps being taken. Such a disclosure will attract significant scrutiny from investors, auditors, and regulators. The priority is to identify weaknesses early enough to remediate before the year-end balance sheet date — which means active monitoring throughout the year, not a pre-publication review.

How does Provision 29 connect to the FRC’s transition to ARGA?

The FRC’s successor body — the Corporate Reporting Authority — will hold powers to sanction directors directly for failures in corporate reporting obligations. Provision 29 declarations sit within that reporting regime. While individual disclosures will not automatically trigger regulatory action, persistent or serious failures in board-level controls oversight will fall squarely within the new authority’s remit. Directors should treat Provision 29 as a personal governance obligation, not a company-level compliance exercise.

INFORMD provides intelligence briefings for senior business leaders across technology, finance, strategy, and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full library of executive briefings or speak to our team.

Stay ahead. Subscribe to INFORMD’s executive briefing at informd.co.uk/services.