Provision 29 of the 2024 UK Corporate Governance Code applies to financial years beginning on or after 1 January 2026. For companies with a December year-end, that means the year now under way is the first one the board will have to cover in a declaration on the effectiveness of its material controls. The annual report that carries it will be published in 2027, but the evidence that supports it has to be generated in 2026. With a little over two months to go, the question for most boards is not whether they understand the requirement. It is whether they could defend the statement if a shareholder, a regulator or a journalist asked how they reached it.
What the board is being asked to say
Provision 29 asks the board to describe how it has monitored and reviewed the effectiveness of the risk management and internal control framework, to make a declaration of effectiveness of the material controls as at the balance sheet date, and to describe any material controls that have not operated effectively, together with the action taken or proposed. It covers financial, operational, reporting and compliance controls. It is not a UK version of Sarbanes-Oxley: there is no requirement for external audit attestation, and the Code operates on a comply or explain basis.
The FRC has deliberately not defined what a material control is, and it has not prescribed the wording of the declaration. That flexibility is helpful, but it moves the hard judgements onto the board. A board that cannot explain why it treated some controls as material and others as not is in a weak position, whatever the declaration says.
Where the evidence usually falls short
In our experience the gaps are rarely in the control framework itself. They sit in the evidence that the framework operated through the year.
Material controls that are really risks. Many firms have produced a list of material controls by taking the principal risks and listing the controls mapped to them in the risk register. The result is often a list of control descriptions that have never been tested, owned by people who did not know they were on the list.
Grouping without testing. Grouping controls into themes is a sensible way to keep the population manageable. It only works if each group can still be monitored and tested as a unit. A theme such as "third-party oversight" is not a control.
Year-end attestation in place of monitoring. A single management sign-off in January is not monitoring. The declaration is made as at the balance sheet date, but the board must describe how it monitored effectiveness during the period. That narrative needs dated evidence behind it.
No route for deficiencies. Boards need a defined threshold for when a control failure becomes material, and a process for escalating it. Without one, deficiencies identified in the last quarter either get missed or force a late scramble.
What internal audit should be doing now
Internal audit is not responsible for the declaration, and it should not be positioned as the sole source of assurance behind it. Its role is to help the board understand how much reliance it can place on the evidence it has.
Before year-end, that means three things. First, an independent view on the material controls population: is the selection method reasonable and documented, and are there obvious omissions? Second, targeted testing of the controls carrying the most weight, prioritising those where first and second line evidence is thinnest. Third, a clear statement to the audit committee on what internal audit has and has not covered, so that the board does not assume a level of assurance that does not exist.
Audit functions should also look at their own plan. If the 2027 plan is being finalised now, it should be built around the material controls population, with a coverage map that shows which controls will be tested by whom and when. That map is one of the most useful documents a board can have when it comes to signing the second declaration.
The first year sets the baseline
Investors and proxy advisers will read first-year declarations closely, and they will compare them. Boards that disclose a small number of material control weaknesses alongside a credible remediation plan are likely to be better regarded than those whose declaration reads as if nothing could go wrong. The aim is a statement that is honest, specific and defensible, and that can be repeated next year without being rewritten.
Getting specialist support
We work with boards and audit committees on the evidence behind their governance statements, from independent reviews of the material controls population to targeted testing and board-level reporting. If your first declaration is approaching and you want an independent view of whether the board can stand behind it, we are happy to talk it through.
