Provision 29 material controls: the declaration explained

For companies with a 31 December year-end, the first financial year caught by the revised Provision 29 of the UK Corporate Governance Code began on 1 January 2026. Provision 29 material controls reporting asks the board to declare, in the annual report, whether the company’s material controls were effective at the balance sheet date. For a December year-end, that means a declaration as at 31 December 2026, published in the annual report in 2027.

That may sound distant, but the evidence for the declaration has to be generated during 2026. This article explains what Provision 29 requires, who it applies to, how boards can identify their material controls, what evidence they will need, and the practical steps worth taking now. It is written for audit committee chairs, finance directors, heads of internal audit and company secretaries who are planning the first cycle.

Provision 29 material controls: what the Code requires

The FRC published the UK Corporate Governance Code 2024 in January 2024. It describes the 2024 revision as a limited one that in particular addresses internal controls, making clear the board’s accountability for effective internal controls through a declaration.¹ The heart of the change is Provision 29:

The board should monitor the company’s risk management and internal control framework and, at least annually, carry out a review of its effectiveness. The monitoring and review should cover all material controls, including financial, operational, reporting and compliance controls.

UK Corporate Governance Code 2024, Provision 29

The Provision then asks the board to include three things in the annual report:¹

1. a description of how the board has monitored and reviewed the effectiveness of the framework;
2. a declaration of effectiveness of the material controls as at the balance sheet date; and
3. a description of any material controls that have not operated effectively as at the balance sheet date, the action taken or proposed to improve them, and any action taken to address previously reported issues.

Three points are easy to miss. First, the scope is wider than financial reporting: operational, reporting and compliance controls are all in. Second, the FRC’s guidance is clear that the declaration relates to the internal controls, not to the risk management and internal control framework as a whole.² Third, the declaration is made at a point in time, the balance sheet date, although the board’s monitoring and review cover the whole year.

When the first declarations fall due

The 2024 Code applies to accounting periods beginning on or after 1 January 2025, except Provision 29, which applies to accounting periods beginning on or after 1 January 2026. Until then, Provision 29 of the 2018 Code continues to apply.¹ The table below works through what that means for common year-ends.

Year-end	First financial year in scope	Declaration as at	Annual report published
31 December	1 January 2026 to 31 December 2026	31 December 2026	2027
31 March	1 April 2026 to 31 March 2027	31 March 2027	2027
30 June	1 July 2026 to 30 June 2027	30 June 2027	2027
30 September	1 October 2026 to 30 September 2027	30 September 2027	Late 2027 or early 2028, depending on the reporting timetable

Who it applies to

The Code applies to all companies listed in the commercial companies category or the closed-ended investment funds category, whether incorporated in the UK or elsewhere.¹ The commercial companies category was introduced by the FCA’s UK Listing Rules, which came into force on 29 July 2024 and replaced the former premium and standard listing segments for equity shares. The FCA carried over to the new category the Code reporting requirements that had applied to premium-listed companies, including the “comply or explain” statement.³

The Code works on a “comply or explain” basis. The Listing Rules require companies to state how they have applied the Code’s Principles and to give reasons for any non-compliance with a Provision. The FRC says explanations should set out the background, give a clear rationale and explain the impact, and, where a departure is intended to be temporary, indicate when the company expects to conform.¹ A company could therefore explain rather than comply with Provision 29, but investors will expect a convincing reason.

Two further points of scope matter in practice:

• No external assurance requirement. The FRC’s guidance states that there is no requirement or expectation in the Code or the guidance that companies obtain external advice or assurance on the effectiveness of material controls, and that it may not be necessary, particularly where the company has an effective, appropriately resourced internal audit function. Whether any external assurance is needed, and of what type, is a decision for the board.²
• Companies outside the listing categories. AIM companies, large private companies and public sector bodies are not required to report against the Code. Some will still use Provision 29 as a benchmark, particularly where they are preparing for a listing or where their investors or funders expect equivalent discipline.

Identifying material controls

The FRC deliberately did not define “material controls”. Its guidance says it does not set out a framework or define a material control, that this will depend on the nature of the principal risks, and that it is not the FRC’s role or intention to prescribe what a material control is for a company.² Instead, the guidance gives the board factors to work with:

• material controls are company-specific, depending on features such as size, business model, strategy, operations, structure and complexity;
• when deciding which controls are material, the board considers how a deficiency in the control could affect the interests of the company, its shareholders and other stakeholders; and
• material controls could include, but are not limited to, controls over principal risks; over external reporting that is price-sensitive or could lead investors to make investment decisions; over fraud, including override of controls; and over information and technology risks, including cyber security, data protection and new technologies such as artificial intelligence.²

In practice, the most defensible approach is top-down. Start with the principal risks the board already assesses under Provision 28,¹ add the reporting, fraud and technology areas the guidance highlights, and then identify the controls that the company genuinely relies on to keep each risk within appetite. Document the criteria, apply them consistently, and have the audit committee (or the board) approve both the criteria and the resulting list. That approval record is itself part of the evidence.

Illustrative only: the examples below show the kinds of controls companies commonly consider. Which controls are material is a judgement for each board.

Category	Examples of controls a board might consider material
Financial	Period-end close and consolidation review; controls over significant judgements and estimates; treasury payment authorisation
Operational	Health and safety controls at high-hazard sites; product quality release controls; supplier continuity arrangements for critical inputs
Reporting	Review and verification of key performance indicators, sustainability metrics and other narrative information in the annual report and market announcements
Compliance	Sanctions screening; anti-bribery and fraud prevention procedures; data protection controls
Cross-cutting	Delegated authority limits; privileged system access and change management; cyber security controls

Once the list is agreed, each material control needs to be documented to a testable standard: owner, frequency, evidence and the risk it addresses. Our guide to building a risk and control matrix explains how to do that, and how material controls relate to key controls more generally. Because fraud and management override feature explicitly in the guidance, it is also worth revisiting your fraud risk assessment at this stage.

Evidence the board will need

The FRC’s guidance says the board should form its own view on effectiveness, based on the evidence it obtains, exercising the standard of care generally applicable to directors. It adds that the board can only provide a reasonable conclusion on effectiveness, based on the work carried out and evidence obtained.² In other words, the declaration is only as good as the evidence beneath it.

Most companies will build that evidence from several sources:

• Management ownership and self-assessment. Control owners confirm, with evidence, that their controls operated. Self-assessment without independent challenge carries limited weight on its own.
• Second-line monitoring. Risk, compliance and financial control teams test or monitor controls in their areas.
• Internal audit. Independent testing of the design and operating effectiveness of material controls. The audit committee’s role under Provision 25 already includes reviewing the risk management and internal control framework and monitoring the effectiveness of internal audit.¹
• Other sources. The guidance notes that the board may draw on information from the external audit, and on work done for other regulatory requirements, including foreign regulation.²

Testing should address both design and operation. The guidance says that when establishing whether a control is operating effectively, the board should also consider its design and implementation.² The UK auditing standard ISA (UK) 330 draws the same distinction and states that inquiry alone is not sufficient to test operating effectiveness,⁴ which is a sensible benchmark for internal testing too.

The guidance also anticipates the annual report description. It may cover the type of information the board received, the units and individuals it consulted, any internal or external assurance, and, if relevant, the recognised framework the board used.² It mentions COSO, ISO and COBIT as examples of recognised frameworks or standards.² COSO’s Internal Control – Integrated Framework (2013), with its five components and seventeen principles, gives the board a recognised structure for its review.⁵

When a material control has not operated effectively

Provision 29 does not demand perfection; it demands transparency. If a material control is not operating effectively at the balance sheet date, the guidance says the board should disclose this with the action taken or proposed, and that this could form part of a declaration in line with Provision 29. The board is not expected to disclose confidential information, or information that could inadvertently affect the company’s interests if made public. Where the board has been unable to determine effectiveness, it can use the “comply or explain” basis of the Code. The guidance also recognises that some procedures after the balance sheet date may be relevant to the declaration.²

Boards should agree in advance how deficiencies will be evaluated. The guidance says that, in agreeing controls, the board should determine what constitutes a significant control failing, and that repeated “near misses” should be reported to the board even where there is no clear deficiency.²

Practical steps

For a December year-end company, the following sequence fits the 2026 timetable. Companies with later year-ends have a little more time, but not as much as it seems.

1. Confirm ownership and governance. Name an executive sponsor, agree the role of the audit committee (or risk committee) and the board, and set a reporting calendar for the year.
2. Agree the material controls criteria and list. Use the FRC factors, start from principal risks, and record the rationale for what is in and what is out.
3. Document each material control. Update the risk and control matrix so every material control has an owner, frequency, evidence and test approach.
4. Test design early. Walk through each material control in the first half of the year and fix design gaps while there is still time to show they work.
5. Build an assurance map. Decide which sources of assurance cover each material control, avoid duplication between the lines, and decide whether any external assurance is wanted.
6. Test operating effectiveness and roll forward. Test during the year, then update the testing to the balance sheet date so the conclusion holds at 31 December.
7. Agree the deficiency framework. Define how failures are rated and escalated, and what would prevent the board from declaring effectiveness.
8. Draft the disclosure early. The guidance warns against standardised language that is long on detail but short on insight.² A draft prepared mid-year shows where the evidence is thin.

A common weakness is to treat Provision 29 as a finance project. Operational, reporting and compliance controls are equally in scope, and their owners often have less experience of documenting and evidencing controls.

How we can help

We help listed boards prepare for Provision 29: identifying material controls, documenting them in a risk and control matrix and testing design and operating effectiveness through our internal controls reviews. Our governance and risk management work covers principal risks, risk appetite and assurance mapping, and our independent audit committee members and non-executives bring experienced challenge to the board’s review. We work with corporates and listed companies across sectors. To discuss your first declaration, book a free 20-minute call.

This article is general guidance, not legal advice. Take advice on your organisation’s specific circumstances.

Frequently asked questions

When does Provision 29 of the UK Corporate Governance Code come into effect?

Provision 29 of the 2024 Code applies to financial years beginning on or after 1 January 2026, a year later than the rest of the Code. For a company with a 31 December year-end, the first declaration is made as at 31 December 2026 and appears in the annual report published in 2027. Until then, Provision 29 of the 2018 Code applies.

Does the Provision 29 declaration need external assurance?

No. The FRC's guidance states that there is no requirement or expectation that companies obtain external advice or assurance on the effectiveness of material controls. It may not be necessary where the company has an effective, appropriately resourced internal audit function, and whether to obtain any external assurance is a decision for the board.

What are material controls under Provision 29?

The FRC deliberately does not define material controls; each board decides which of its controls are material. The guidance suggests considering how a deficiency could affect the company, its shareholders and other stakeholders, and says material controls could include controls over principal risks, price-sensitive external reporting, fraud including management override, and information and technology risks such as cyber security.

References

1. Financial Reporting Council, 22 January 2024. UK Corporate Governance Code 2024
2. Financial Reporting Council, 29 January 2024 (as updated to 5 November 2025). Corporate Governance Code Guidance
3. Financial Conduct Authority, July 2024. PS24/6: Primary Markets Effectiveness Review – Feedback to CP23/31 and final UK Listing Rules
4. Financial Reporting Council, 25 September 2025. International Standard on Auditing (UK) 330 (Revised July 2017): The Auditor's Responses to Assessed Risks (updated September 2025)
5. Committee of Sponsoring Organizations of the Treadway Commission (COSO), May 2013. Internal Control – Integrated Framework: Executive Summary