Provision 29: What Boards Must Evidence When the Auditor Isn’t Testing

What the declaration covers

Provision 29 of the UK Corporate Governance Code 2024 applies to financial years beginning on or after 1 January 2026. For a December year-end, the first declarations will appear in annual reports published in 2027. The Code applies on a comply-or-explain basis to companies in the commercial companies and closed-ended investment funds listing categories.

The board should monitor the company’s risk management and internal control framework and, at least annually, review its effectiveness. The annual report should then include:

• a description of how the board has monitored and reviewed the effectiveness of the framework;
• a declaration of the effectiveness of the material controls as at the balance sheet date; and
• a description of any material controls that have not operated effectively as at the balance sheet date, the action taken or proposed to improve them, and any action taken to address previously reported issues.

Material controls are not limited to financial reporting. The Code covers financial, operational, reporting and compliance controls.

Identifying material controls

The Code leaves the definition of “material” to the board. The FRC has said it will not prescribe a number or a list. In its January 2026 mythbuster it observed that most companies it engaged with were identifying somewhere between 30 and 50 material controls, with some — particularly in financial services — identifying more. That is an observation, not a benchmark.

A defensible population starts from the company’s principal risks, business model and strategy rather than from an existing control inventory. The FRC’s guidance points to useful starting places: controls over principal risks; over external reporting that is price-sensitive or relied on by investors; over fraud and management override; and over information and technology risks, including cyber security.

The board should be able to explain why each control is material — why its failure could matter to the company, its shareholders or other stakeholders — and why controls that were considered were excluded.

Ownership, evidence and monitoring

The FRC does not expect companies to list their material controls or describe the testing performed. It does expect the report to set out the governance behind the declaration. That governance has to be real before it can be described.

For each material control, the board’s declaration rests on knowing:

• who owns it, and what it is designed to prevent or detect;
• how its operation is evidenced, and where that evidence is kept;
• how its effectiveness is assessed — by whom, how often and to what standard; and
• what assurance the board receives, from management, internal audit or other providers, and how independent that assurance is.

The evidence base has to be built across the year. A declaration as at the balance sheet date that rests on work performed in the final quarter leaves no runway to close gaps before that date.

Escalating deficiencies

The declaration requires disclosure of material controls that have not operated effectively, and of the action taken. That makes the escalation path a governance question, not only an operational one.

The board should agree in advance what counts as a control not operating effectively, what threshold escalates a failure to the audit committee or the board, how the significance of a failure is assessed, and how closure is verified. Failures that surface late in the year need a clear route to a decision on disclosure, not a debate about definitions.

Rehearsing the declaration

A dry run ahead of the first reporting period is the most reliable way to find the gaps. Take a sample of material controls, gather the evidence the board would rely on, assess it as the board would, and draft the declaration and the supporting description of monitoring and review.

The result shows whether the material controls population is defensible, whether the evidence exists and is retrievable, whether escalation works, and whether the board could sign with confidence. For December year-end companies, the period the first declaration covers is already under way.

This article is general information, current as at its publication date. It is not legal, accounting or audit advice.