Navigating the New UK Corporate Governance Code: What You Need to Know in 2025 (Part 2)

The Financial Reporting Council (FRC) published the revised Code in January 2024, with changes taking effect from 2025 and 2026. While the update takes a "limited but targeted" approach, don't let that fool you – the introduction of the material internal controls requirement represents a fundamental shift in how boards need to think about risk management and internal controls. 

 

Whether you're a board director, company secretary, or compliance professional, understanding these changes and their implications is crucial for your organisation's governance framework. 

If you're responsible for governance in an organisation affected by these changes, here's my practical advice on how to approach implementation. 

 

Before you can identify material internal controls, you need to understand your significant risks. This means conducting a comprehensive risk assessment that goes beyond traditional financial risks to encompass operational, compliance, and reporting risks across all areas of your business. 

 

I recommend starting with your existing risk register if you have one, but don't assume it's comprehensive enough for this purpose. You'll need to consider risks that could materially impact your ability to achieve strategic objectives, maintain operational effectiveness, comply with regulations, and produce reliable reporting. 

 

The FRC has deliberately left the definition of "material internal controls" to board judgement, which means you need to develop your own criteria. In my experience, material controls are those that most effectively address your material risks – controls that, if they failed, could have a significant impact on your business. 

 

This isn't just about financial materiality (though that's part of it). You need to consider what's material in terms of operational, regulatory, and reputational risks. A control that prevents a regulatory breach might be material even if the financial impact is relatively small. 

 

Once you've identified material risks, you need to map the controls you have in place that address them. This includes: 

 

 

Don't underestimate the importance of entity-level controls. In many cases, these are your most critical controls because they set the foundation for everything else. 

 

Boards need to determine what level of assurance they require over material controls. This might include: 

 

 

The key is to ensure your assurance approach provides sufficient confidence to support the board's annual declaration. This isn't about creating unnecessary bureaucracy. Rather, it's about having reliable information on which to base important decisions. 

 

Effective implementation requires ongoing monitoring, not just annual assessment. You need systems and processes that provide regular information about control effectiveness to both management and the board. 

 

This should integrate with your existing management reporting and board reporting cycles. The goal is to embed control monitoring into business-as-usual activities, not create a separate compliance exercise. 

 

Implementing a comprehensive material controls framework requires specialist knowledge and significant effort. Many organisations will need to enhance their internal capabilities or engage external support. 

 

Areas where specialist expertise is often needed include: 

 

 

If you're a smaller organisation, remember that proportionality is built into the Code. Your approach should be tailored to your size, complexity, and risk profile. 

 

This might mean: 

 

Having worked with boards, audit committees, and leadership teams across multiple sectors – from financial services and construction to charities and regulatory bodies – I understand both the challenges and opportunities that these Code changes represent. 

 

My approach to governance support is fundamentally practical. I don't believe in creating governance frameworks that look impressive on paper but don't work in practice. Instead, I focus on helping organisations build robust, proportionate controls that actually strengthen their operations while meeting regulatory requirements. 

 

The services I provide directly support Code compliance preparation: 

 

 

 

 

 

 

My cross-sector experience means I understand how governance challenges vary across different types of organisations. For instance, a charity's approach to material controls will differ from that of a financial services firm, and both will differ from that of a multinational construction company. No matter the size or sector, I help organisations find the right approach for their specific circumstances. 

 

What sets my approach apart is the combination of technical expertise with practical implementation experience. I understand the theory, but more importantly, I know how to make it work in real organisations with real constraints. 

While the material controls provisions don't take effect until 2026, smart organisations are starting their preparation now. Remember, the lead time is an opportunity to strengthen your governance framework in ways that deliver real business benefits, rather than merely fulfilling a compliance exercise. 

 

Whether you need help with initial gap analysis, framework design, or ongoing implementation support, I can provide the expertise and practical assistance to ensure you're ready. 

 

So, if you want to lean on some external expertise, feel free to contact me to discuss how I can support your organisation's specific needs. I’m available by phone on 07576 829 591 or via email at amy@corporateassist.co.uk to arrange a consultation regarding your governance and compliance requirements. 

 

Every organisation's governance journey is different, and I look forward to helping you find the right path forward.