UK Corporate Governance Code Provision 29: Internal Controls Declaration Guide

Last updated: 22 October 2026

Quick answer: Provision 29 of the 2024 UK Corporate Governance Code asks the board to monitor and, at least annually, review the effectiveness of the company’s risk management and internal control framework, covering all material controls. From financial years beginning on or after 1 January 2026, the annual report should include a declaration on the effectiveness of material internal controls as at the balance sheet date, and describe any that were not effective and what is being done about them. It works on a “comply or explain” basis.

The Financial Reporting Council (FRC) published the revised UK Corporate Governance Code in January 2024. Most of the changes took effect for financial years beginning on or after 1 January 2025. Provision 29, the internal controls provision, was given an extra year and applies from financial years beginning on or after 1 January 2026.

For a company with a calendar year end, that means the first declaration covers controls as at 31 December 2026 and appears in the annual report published in 2027. The work behind it, though, has to happen during 2026. A board cannot credibly declare controls effective at year end without evidence that they were identified, owned, tested and reported on beforehand.

This guide explains what Provision 29 requires, what “material controls” can mean, what the FRC guidance says, and a practical readiness roadmap for audit committees, risk teams, CISOs and DPOs who own parts of the control environment.

What is Provision 29 of the UK Corporate Governance Code?

Provision 29 is the part of the 2024 Code that sets out how the board should monitor, review and report on the company’s risk management and internal control framework.

It sits under Principle O, which says the board should establish and maintain an effective risk management and internal control framework and determine the nature and extent of the principal risks it is willing to take to achieve its long-term strategic objectives. The 2024 UK Corporate Governance Code then asks the board, under Provision 29, to:

• Monitor the risk management and internal control framework and, at least annually, carry out a review of its effectiveness.
• Cover all material controls in that monitoring and review, including financial, operational, reporting and compliance controls.
• Report in the annual report on three things:
  • a description of how the board has monitored and reviewed the effectiveness of the framework;
  • a declaration of effectiveness of the material internal controls as at the balance sheet date; and
  • a description of any material internal controls that have not operated effectively as at the balance sheet date, the action taken or proposed to improve them, and any action taken to address previously reported issues.

The earlier Code already asked boards to review the effectiveness of risk management and internal control. The new element is the explicit declaration about material controls at a fixed point in time, together with disclosure of the ones that were not effective.

When does Provision 29 apply?

Provision 29 applies to financial years beginning on or after 1 January 2026; the rest of the 2024 Code applies to financial years beginning on or after 1 January 2025.

Companies with a non-calendar year end start later. A company with a 31 March year end, for example, first applies Provision 29 to the year beginning 1 April 2026 and declares as at 31 March 2027.

In practice: the declaration is “as at the balance sheet date”, but you will only reach that date with confidence if controls have been operating, and tested, for a good part of the year. Treat the current financial year as the evidence-gathering year.

Who does Provision 29 apply to?

The Code applies to companies whose UK Listing Rules require them to report against it, essentially those with equity shares in the commercial companies category (the successor to the former premium listing segment).

These companies must state in their annual report how they have applied the Code’s principles and whether they have complied with its provisions, explaining any departures. Other companies may adopt the Code voluntarily. Large private companies are not bound by the Code; many use the Wates Corporate Governance Principles for Large Private Companies instead, though some choose to follow a Provision 29-style approach as good practice, particularly if they have listed peers, private equity owners or plans to list.

What does “comply or explain” mean for Provision 29?

“Comply or explain” means a company should either follow Provision 29 or give a clear explanation of why it has not and what it does instead.

Provision 29 is not a legal requirement in the way the Companies Act is. A board can depart from it, but the explanation has to be meaningful to investors: what the company does instead, why, and how this still supports good governance. Generic or boilerplate explanations are unlikely to satisfy investors or the FRC, which reviews the quality of Code reporting.

It is also worth separating two different outcomes:

• Complying with a negative finding. If some material controls were not effective at the balance sheet date, the board can still comply with Provision 29 by saying so, describing the controls and setting out remediation. Ineffective controls do not by themselves mean non-compliance.
• Not complying. If the board has not carried out the monitoring and review, or cannot make the declaration at all, it needs to explain the departure.

Is Provision 29 the UK equivalent of SOX?

Not really. It is often compared with the US Sarbanes-Oxley Act, but it is narrower in some ways and broader in others.

The FRC has deliberately left room for boards to apply judgement. That flexibility is useful, but it also means the board has to be able to explain how it reached its conclusion.

What are “material controls”?

The Code does not define material controls. Each board decides which controls are material to its company, based on its business model, principal risks and the potential impact if a control fails.

Provision 29 says material controls can include financial, operational, reporting and compliance controls. A useful working test is: would a failure of this control have a significant effect on the company’s ability to meet its objectives, its financial position, its reporting, or its legal and regulatory obligations?

Cyber security and data protection controls often qualify because a single failure can disrupt operations, lead to regulatory action and affect reporting at the same time. Fraud is another common area, especially since the “failure to prevent fraud” offence under the Economic Crime and Corporate Transparency Act came into force on 1 September 2025. Our guide to UK business compliance in 2026 covers that offence.

Common mistake: listing too many controls as material. If the list runs into hundreds, the board cannot meaningfully oversee it. Most companies end up with a focused set of material controls, supported by a larger population of underlying controls that management monitors.

What does the FRC guidance say?

The FRC published Corporate Governance Code Guidance alongside the 2024 Code, including a section on risk management and internal controls. The guidance is not mandatory and is not prescriptive, but it sets out the FRC’s expectations.

Key points from the guidance include:

• Board judgement. The board decides which controls are material and how to monitor and review them. There is no single required method.
• Link to principal risks. Material controls should be identified with reference to the company’s principal risks, which the Code (Provision 28) describes as including those that would threaten its business model, future performance, solvency or liquidity and reputation.
• Sources of assurance. The board can draw on management reporting, internal audit, external audit and other assurance providers, and decides what combination gives it enough confidence.
• Frameworks. Companies can use recognised internal control frameworks where helpful, but this is not required.
• Clear disclosure. Reporting should be specific to the company, explain how the review was done, and be candid about material controls that did not operate effectively and the remediation under way.

The guidance also covers areas such as fraud and information technology, including cyber security, as risks boards may need to consider. Read the current version directly, as the FRC can update guidance independently of the Code.

How do you prepare for Provision 29? A readiness roadmap

Most companies follow the same sequence: scope material controls, assign ownership, test and evidence them, track deficiencies and report to the board on a regular cycle.

1. Start from principal risks. Review the principal risks disclosed in the annual report and confirm they are current. A clear risk appetite statement helps the board decide how much control failure it can tolerate in each area.
2. Scope material controls. For each principal risk, identify the controls that matter most. Record why each control is material, what risk it addresses and how failure would be detected. Keep the rationale, as you may need to explain it to the audit committee and the external auditor.
3. Document the controls. For each material control, write down the objective, the activity, frequency, owner, systems involved and the evidence it produces. Link controls to the risks in your enterprise risk register so the connection is visible.
4. Assign ownership. Give every material control a named owner in the first line and a reviewer in the second line. Define who attests, when and to whom.
5. Test design and operation. Test whether each control is designed to address its risk and whether it actually operated during the period. Agree the role of internal audit and any external assurance. Cyber controls can often be tested against work already done for ISO 27001; our ISO 27001 internal audit guide explains how to plan that.
6. Collect evidence. Store test results, approvals, logs, reconciliations and sign-offs in one place, with dates and owners. Evidence should be traceable back to the control and the period it covers.
7. Track deficiencies. Log every control failure with its severity, root cause, owner, remediation action and target date. Decide in advance how the company will judge whether a deficiency makes a material control ineffective.
8. Report to the board. Give the audit committee regular updates during the year, not just at year end: status of testing, open deficiencies, overdue actions and changes in scope. This creates the record of “how the board has monitored and reviewed” that Provision 29 asks you to describe.
9. Run a dry run. Before the first live year end, run a full cycle on a recent quarter or half year. Draft the annual report disclosure and test whether the evidence supports it.
10. Prepare the declaration. At the balance sheet date, confirm the status of each material control, agree the wording of the declaration and the description of any ineffective controls, and record the board’s decision.

In practice: material controls rarely sit in one function. Finance, IT, security, privacy, operations and compliance teams each own part of the picture, often in different spreadsheets. The hardest part of readiness is usually bringing that information together in a consistent format the board can rely on.

How does GRC software support Provision 29?

GRC software gives you one place to record material controls, link them to risks, collect evidence, track deficiencies and report status to the board, with an audit trail that shows what was done and when.

Spreadsheets can work for a small number of controls, but they become hard to manage when many owners update them, evidence lives in email and version history is unclear. Our comparison of spreadsheets and GRC software sets out where the tipping point usually falls.

When evaluating tools for Provision 29 work, look for:

• Risk and control linkage: a risk register where each risk is linked to the controls that mitigate it, with owners and scoring history.
• Evidence management: a central repository where evidence is attached to the control it supports, with dates and an audit trail.
• Assessments and testing: structured assessments and audits that record results against each control.
• Deficiency and remediation tracking: tasks linked to failed controls, with owners, due dates and reminders.
• Board reporting: dashboards that summarise control status, open issues and trends for the audit committee.
• Cross-framework mapping: the ability to reuse controls already in place for ISO 27001, UK GDPR or Cyber Essentials, rather than building a separate Provision 29 control set.

Enactia is one option for the cyber security, data protection and compliance parts of the control environment. Its Enterprise Risk Management module links risks to controls from an extensive control catalogue and assigns ownership. The document repository and evidence management module keeps supporting evidence linked to requirements, and ticketing and task management tracks remediation actions. Dashboards and an audit trail support reporting to the board. Enactia focuses on cyber security and data protection governance, so finance teams may still use their own tools for financial reporting controls; the aim is a consistent view, not one tool for everything.

A GRC platform does not make the declaration for you. The board still has to judge whether material controls were effective. What software does is make the evidence behind that judgement complete, current and easy to review.

Key takeaways

• Provision 29 of the 2024 UK Corporate Governance Code applies to financial years beginning on or after 1 January 2026.
• The board should monitor and at least annually review the risk management and internal control framework, covering all material controls.
• The annual report should describe the review, declare whether material controls were effective as at the balance sheet date, and describe any that were not, with remediation.
• Material controls can be financial, operational, reporting or compliance controls, and often include cyber security and data protection.
• The Code works on “comply or explain”, and the FRC guidance supports a proportionate, judgement-based approach.
• Readiness depends on scoping, ownership, testing, evidence, deficiency tracking and regular board reporting throughout the year.

Frequently asked questions

When does Provision 29 come into effect?
Provision 29 applies to financial years beginning on or after 1 January 2026. For companies with a 31 December year end, the first declaration covers material controls as at 31 December 2026 and appears in annual reports published in 2027. The rest of the 2024 Code has applied since financial years beginning on or after 1 January 2025.

Does Provision 29 require an external audit of internal controls?
No. The Code does not require external assurance over the declaration. The board decides what assurance it needs, which may include internal audit, external audit or other providers. Some companies choose to obtain external assurance over specific areas, but this is a board decision rather than a Code requirement.

What happens if some material controls were not effective?
The board should say so in the annual report, describe the controls that did not operate effectively as at the balance sheet date, and set out the action taken or proposed to improve them, plus progress on any previously reported issues. Disclosing ineffective controls in this way is consistent with complying with Provision 29.

Do cyber security and data protection controls count as material controls?
They can. The board decides which controls are material based on its principal risks. For many companies, controls over access, backup and recovery, incident response and personal data handling are material because a failure could disrupt operations, trigger regulatory action under UK GDPR and affect reporting.

Does Provision 29 apply to private companies?
Not directly. The Code applies to companies required by the UK Listing Rules to report against it. Large private companies often use the Wates Principles instead, but some adopt a Provision 29-style approach voluntarily because investors, lenders or acquirers expect strong evidence of control effectiveness.

Is there a required internal control framework?
No. The Code and FRC guidance do not prescribe a framework. Companies can use a recognised framework if it helps, or their own structured approach, as long as the board can explain how it monitored and reviewed the effectiveness of material controls.

Building your Provision 29 evidence trail

Provision 29 asks boards to stand behind a clear statement about their material controls. That statement is only as strong as the evidence behind it, so the work needs to run through the year: scope the controls, name owners, test them, track and fix deficiencies, and keep the board informed. For a wider view of UK requirements that feed into the control environment, see our guide to GRC software for UK organisations.

For help organising your control evidence, contact us or book a demo or start your 14-day free trial.

This article is for general information and is not legal advice.