Provision 29 asks boards reporting against the UK Corporate Governance Code to make a material controls declaration in their annual report. It states whether those controls were effective at the balance sheet date. The revised provision applies to financial years beginning on or after 1 January 2026, on a comply-or-explain basis.
For Company Secretaries, the practical task is to help the board reach an informed conclusion: clear responsibilities, timely information, meaningful challenge and a record supported by evidence.
What does Provision 29 require the board to report?
The annual report should explain the board’s monitoring and review, give its conclusion on material controls at the balance sheet date, and address ineffective controls and remedial action. The final element also includes action on previously reported issues.
Under Provision 29 of the 2024 Code, the board should monitor the risk management and internal control framework and review its effectiveness at least annually. This covers all material controls, including financial, operational, reporting and compliance controls.
The annual report needs three elements:
- Monitoring and review: how the board assessed the framework’s effectiveness.
- The declaration: the board’s assessment of whether its material controls were effective at the balance sheet date.
- Problems and action: which material controls were ineffective at that date, what has been done or is planned to improve them, and action addressing issues reported previously.
The previous Code already expected board monitoring and review. The new declaration gives additional importance to the evidence supporting the board’s conclusion. A description of governance processes alone does not provide that conclusion.
Which companies are in scope and when does reporting start?
The Code applies to companies in the equity shares (commercial companies) and closed-ended investment funds listing categories, wherever incorporated. They apply its Principles and comply with its Provisions or explain departures. Other companies may choose to adopt it. See the Financial Reporting Council’s (FRC) application guidance.
For a company with a normal calendar financial year, the first revised Provision 29 period is 1 January to 31 December 2026, with reporting expected in 2027. Different year ends change the first assessment date:
| Normal financial year end | First financial year covered | First balance sheet date assessed |
| 31 December | 1 January to 31 December 2026 | 31 December 2026 |
| 31 March | 1 April 2026 to 31 March 2027 | 31 March 2027 |
| 30 June | 1 July 2026 to 30 June 2027 | 30 June 2027 |
| 30 September | 1 October 2026 to 30 September 2027 | 30 September 2027 |
These dates are calculated from the commencement rule and assume unchanged, twelve-month financial years. The FRC expects first reporting from 2027 and does not require early adoption. Until the revised provision applies, the 2018 version continues to apply.
As at 15 September 2026, calendar-year companies are already in their first reporting period. The practical priority is to establish what oversight and evidence are available, identify gaps and agree the remaining work before year end.
How should the board identify material controls?
The board determines which controls are material for its company. There is no prescribed definition or target number. Start with principal risks, but also consider controls whose failure could materially affect reporting or other stakeholder interests even where the underlying risk is not classified as principal.
The FRC’s 2025 reporting review also notes that material controls may extend beyond those relating directly to principal risks.
The Code Guidance identifies possible areas including principal risks, external reporting, fraud and technology risks. Cyber security, data protection and artificial intelligence may therefore be relevant. The assessment should reflect the company’s circumstances, rather than treating this as a checklist of controls every company must have.
Management may undertake the identification and assessment work. The board must understand and challenge the proposed scope. A useful paper explains why each proposed control matters, what it addresses and why significant exclusions are reasonable.
Avoid turning the exercise into a counting target. In its January 2026 Mythbuster, the FRC reported that most companies in its engagement were suggesting 30 to 50 material controls, with some identifying more. This is an observation, not a recommended range.
What is the Company Secretary’s role?
The Company Secretary helps the board organise its oversight and record its decisions. This does not make the governance function the owner of the controls or the provider of the underlying assurance. The role is to support a clear process through which the board reaches its judgement.
Clarify responsibilities. Identify the work undertaken by management, matters reviewed by committees and decisions reserved for the board. Committee recommendations should make the board’s decision easier to understand, with unresolved questions clearly identified.
Improve information flow. A board paper should distinguish the conclusion requested from the evidence supporting it. It should identify significant exceptions, gaps in assurance and actions still outstanding. Where the paper relies on management confirmation, the board should understand its basis and limitations.
Connect the annual cycle. Schedule material-control discussions and agree how significant issues reach the board between scheduled meetings. Allow time for challenge and follow-up before the annual report is drafted.
Record the judgement accurately. Minutes should capture significant concerns, the reasoning behind decisions and agreed actions. They should be supported by papers and assurance records. The aim is a useful record, without producing a transcript.
What should companies do before their first material controls declaration?
Four priorities help turn the reporting requirement into an organised governance process: agree the material controls, establish assurance, schedule oversight and maintain an evidence trail. The following is a practical approach to consider, rather than a prescribed FRC implementation method.
1 Identify and agree the material controls
Bring the proposed scope to the appropriate committee and board with the rationale. Cover the full range of material controls and explain how the assessment goes beyond financial controls and the principal-risk list where necessary.
Keep the assessment current. Acquisitions, new systems or changes to reporting may justify revisiting which controls are material. Record the reason for changes and identify who will update the associated assurance work.
2 Establish how assurance will be obtained
Assurance is the evidence and assessment that give the board confidence in its conclusion. Depending on the control, sources may include management, internal audit, risk or compliance functions, and external providers.
The Code does not mandate external assurance over material controls. The board should consider whether its overall evidence is sufficient, including gaps, overlaps and reliance on a single source.
The external financial statement audit is a separate process. The FRC’s June 2026 guidance on auditor responsibilities confirms that the Provision 29 statement constitutes other information for audit purposes and is not itself covered by the auditor’s opinion on the financial statements. Discuss the auditor’s responsibilities and any separate assurance engagement explicitly when planning the work.
3 Embed oversight into the board and committee cycle
Agree reporting and review points, with clear routes for escalating significant control issues. The board should have time to question findings and consider further action.
A dry run can be valuable. Test the proposed declaration against available evidence before year end. Identify what remains uncertain, who owns the follow-up and when the board will receive an update.
Keep the assessment date distinct from the evidence timetable. Work completed after year end may provide evidence about a control at year end; fixing a control after that date does not make it effective retrospectively.
4 Build a coherent evidence trail
Board papers, minutes, assurance reports and action tracking should collectively show what was considered and how the board reached its conclusion. A minute recording approval cannot substitute for the underlying assessment.
The following hypothetical example illustrates how the governance function can make an unresolved issue visible. It is not a prescribed control or testing programme.
| Stage | Hypothetical evidence or finding | Governance follow-up |
| Scope | Management proposes a recovery-testing control for a business-critical system as material. | Record the board’s rationale for including it. |
| Assurance | A test finds that recovery took longer than the company’s agreed tolerance. | Obtain the assessment of significance and identify further work needed. |
| Committee review | Management proposes improvements and a retest. | Record the recommendation, owner, deadline and escalation route. |
| Year-end conclusion | The available evidence still does not demonstrate effective operation. | Put the unresolved finding before the board for its assessment and reporting decision. |
The useful question at each stage is specific: what does the board need to decide, and which evidence supports that decision?
What happens if a material control is ineffective?
An ineffective material control does not automatically mean non-compliance with Provision 29. The board must assess and report the position appropriately, including remedial action. It should also account for action on previously reported issues, rather than considering only failures outstanding at the current year end.
For preparation, keep three questions distinct:
- Is a material control ineffective at the balance sheet date?
- Did an issue become public during the year?
- Was an issue reported previously, with action to update?
The FRC’s January 2026 Mythbuster indicates that an issue rectified before the balance sheet date would not ordinarily require reporting simply as an ineffective control at that date. However, publicised issues during the year and action taken in relation to previously reported issues may still require appropriate disclosure.
For example, closing a previously reported issue does not remove the need to consider reporting the action taken. Maintain a record of prior disclosures alongside the current list of unresolved problems.
Frequently asked questions
Must the annual report list every material control?
No. The FRC does not expect a list of material controls or the details of specific tests. Provision 29 reporting should explain the governance and oversight supporting the board’s conclusion.
How long should Provision 29 reporting be?
The FRC expects the whole Provision 29 report to be no longer than two pages in most cases. That includes the supporting commentary, not just the declaration. This is an expectation of proportionate reporting, not a fixed page limit. Both answers are set out in the January 2026 Mythbuster.
Can the audit committee take responsibility for the declaration?
The audit committee can review evidence and recommend a conclusion. The declaration remains the board’s responsibility. The Code’s allocation of responsibilities should guide how the committee reports to the board.
How can Beyond Governance help?
If your board needs a clearer process for its first material controls declaration, talk to our Boardroom Advisory team about reviewing responsibilities, information flow and the evidence supporting board decisions.
Effective preparation gives the board a clear view of what it knows, what remains uncertain and what needs to happen before it reaches its conclusion.
