Where does a board’s assurance for Provision 29 come from?

What does the board base its own monitoring on?

The board bases its own monitoring on regular reporting and other communication with management, internal audit, external audit and other appropriate functions, the FRC says in its guidance. The board may also draw on information that emerges from the external audit in the ordinary course.

The board should then form its own view on that evidence, and the guidance says it can only reach a reasonable conclusion on whether the controls are effective. Where it cannot determine whether a material control is effective, it can say so in the annual report, as the comply or explain basis of the Code allows.

The guidance also expects a significant control issue to be reported to the board even once it has been remediated. Near misses should reach the board too: occasions when the internal control system only narrowly achieved the desired outcome, especially where that happened repeatedly during the year.

How far can a board rely on internal audit?

A board can rely on internal audit for much of its assurance where the function is resourced for it. In a first year of declarations, internal audit can come under pressure to carry out the control testing that management should do itself. A board should be able to tell the assurance management gives apart from the assurance internal audit gives, and see whether the plan still fits the role of the function.

The FRC says in its guidance that external assurance may not be necessary where a company has an effective internal audit function that is appropriately resourced to provide assurance over the framework. An internal audit plan that shows which material controls it covers, and when, is easier for the board to rely on.

If the head of internal audit also runs part of the control framework, the Global Internal Audit Standards require someone else to provide assurance over it whenever it falls within the scope of internal audit.

Does the external audit give the board any assurance?

The external auditor reads the declaration alongside the rest of the annual report, but its opinion on the financial statements does not cover the declaration, the FRC said in a June 2026 note on the responsibilities of the auditor. Nor is the auditor required to test the design, implementation or operating effectiveness of the material controls.

Any other assurance is for the board to choose. The guidance says there is “no requirement or expectation” that companies obtain external advice or assurance on the effectiveness of the material controls, and a board may wish to discuss its choice with investors.

Separately, the FRC has revised its auditing standards for audits of periods beginning on or after 15 December 2026. Auditors of companies that follow the Code will then describe how the controls of the company affected the audit, and report in the audit report any very serious control deficiencies they identify. For a calendar-year company, that first applies to the year after its first declaration.

Which controls count as material?

The board decides which controls are material, and the FRC expects in its guidance that they will differ from one company to the next. Provision 29 asks the board to monitor and review all material controls at least annually, including financial, operational, reporting and compliance controls, and the guidance suggests they could include controls over:

• principal risks, those that could threaten the business model, future performance, solvency, liquidity or reputation
• external reporting that is price sensitive or could lead investors to make investment decisions
• fraud, including override of controls
• information and technology risks, including cybersecurity, data protection and new technologies such as artificial intelligence

Alongside the declaration, the annual report describes how the board monitored and reviewed the framework, and any material controls not operating effectively as at the balance sheet date, with “the action taken, or proposed, to improve them and any action taken to address previously reported issues”.

The FRC will not suggest a number of material controls or provide wording for declarations, does not expect companies to list the controls or the testing carried out, and expects the report in most cases to run to no more than two pages. Its September 2026 note on cyber adds that the declaration should leave out commercially sensitive information and specific details of the technical controls behind the cyber resilience of the company, and that “point-in-time assurance does not imply enduring protection”.

What if a control fails just before the year end?

For a Provision 29 declaration, a control that fails just before the year end is judged by its position at the balance sheet date. The FRC does not expect a company to report a material control failure that was put right by that date, but where a material control issue remains at the balance sheet date it expects to see it reported in the annual report, with the action taken or proposed. The same FRC note adds that it would expect to see “reporting against publicised issues from across the course of the year”, because shareholders and stakeholders would already be aware of them.

The declaration covers information collected before and on the balance sheet date, and procedures carried out afterwards may also be relevant to making it. There is no requirement to revise it if something later comes to light, and the cyber note from the FRC adds that the provision creates no separate requirement to report every cyber incident or breach.

What should be settled before the first declaration?

Before its first declaration, a board should settle its material controls and the evidence behind each, while there is still time to fix what that evidence shows. Before the balance sheet date that declaration speaks to, the board should be able to name each material control, the evidence it will rely on and who will provide it.

Provision 29 applies to companies required to report against the Code, those listed in the commercial companies and closed-ended investment funds categories, and is relevant to any other company that chooses to apply the Code in full.

The provision covers financial years that start on 1 January 2026 or later, and the FRC does not require early adoption. For a company whose financial year began on 1 January 2026, the first balance sheet date is 31 December 2026, and the declaration appears in the annual report for that year, published in 2027. Companies with March or June year-ends reach their first balance sheet date under the provision in 2027.

Each source opens in a new tab.

• Financial Reporting Council, UK Corporate Governance Code, January 2024: Provision 29 and footnote 9 (p.13); application dates (pp.3 and 5)
• Financial Reporting Council, Corporate Governance Code Guidance, published 29 January 2024, last updated 3 June 2026, paragraphs 262, 263, 270, 272, 274, 275, 276, 289, 295, 296, 297, 298 and 300
• Financial Reporting Council, Provision 29 Mythbuster: Preparing to report, 29 January 2026
• Financial Reporting Council, Mythbuster: the auditor’s responsibilities in respect of the Provision 29 statement, 24 June 2026
• Financial Reporting Council, Provision 29 Mythbuster: Focus on Cyber, 23 September 2026
• Financial Reporting Council, International Standard on Auditing (UK) 700, revised May 2026, published 24 June 2026 (effective for audits of periods commencing on or after 15 December 2026)
• Financial Reporting Council, news release on the revised auditing standards, International Standards on Auditing (UK) 700, 701 and 720, 24 June 2026
• Financial Reporting Council, Annual Review of Corporate Governance Reporting 2025, 13 November 2025 (reporting on the new Provision 29 from 2027)
• The Institute of Internal Auditors, Global Internal Audit Standards, published 9 January 2024, Standard 7.1, requirements