The 2024 UK Corporate Governance Code introduces targeted changes to the governance framework for companies within its scope, including a strengthened approach to risk management and internal controls. Most provisions apply to financial years beginning on or after 1 January 2025, with the revised requirements under Provision 29 applying to financial years beginning on or after 1 January 2026.
The Financial Reporting Council (FRC) published the revised Code in January 2024, describing the changes as a “limited but targeted” revision. The Code retains its principles-based approach while introducing changes in areas including board leadership, composition, remuneration and risk management and internal control.
One of the most significant changes is the revised Provision 29, which strengthens the expectations around the board’s monitoring and review of the risk management and internal control framework and introduces new annual reporting requirements concerning material controls.
This article looks at the principal changes introduced by the 2024 Code, with particular focus on Provision 29, what it requires from boards and how organisations within scope can approach the governance and evidence needed to support their reporting.
What's Changed? The key updates at a glance
The 2024 revision represents what the FRC describes as a “limited but targeted” update to the UK Corporate Governance Code. Rather than fundamentally restructuring the Code, the changes focus on particular areas where the FRC considered clarification or strengthening was required.
Changes include amendments relating to board leadership and company purpose, diversity and inclusion, governance reporting and directors’ remuneration, including provisions concerning malus and clawback arrangements.
The most significant change for many organisations is the revised approach to risk management and internal control, particularly Provision 29. This strengthens the expectations placed on boards for monitoring and reviewing the effectiveness of the risk management and internal control framework and introduces specific annual reporting requirements in relation to material controls.
Most provisions of the 2024 Code apply to financial years beginning on or after 1 January 2025. Provision 29 applies to financial years beginning on or after 1 January 2026, giving organisations additional time to establish the processes, evidence and governance arrangements needed to support the board’s reporting.
The new material controls requirement: Provision 29 explained
Provision 29 requires the board to monitor the company’s risk management and internal control framework and, at least annually, carry out a review of its effectiveness. The monitoring and review should cover all material controls, including financial, operational, reporting and compliance controls.
The annual report should explain how the board has monitored and reviewed the effectiveness of the framework. It should also include a declaration of effectiveness of the material controls as at the balance sheet date.
Where material controls have not operated effectively as at the balance sheet date, the annual report should describe the material control failures identified and the action taken, or proposed, to improve them. It should also address any action taken in relation to material control failures previously reported.
This means that boards need an appropriate basis of evidence for making the declaration. The Code does not prescribe a single control framework or testing methodology; the approach will depend on the company, its principal risks, the nature of its material controls and the governance arrangements supporting board oversight.
What are Provision 29 changes in practice
Provision 29 places greater emphasis on the board being able to demonstrate how it has monitored and reviewed the effectiveness of the company’s risk management and internal control framework. The annual declaration also brings the effectiveness of material controls more explicitly into the company’s external reporting.
Importantly, material controls are not limited to financial controls. Boards need to consider the material financial, operational, reporting and compliance controls that support the company’s objectives and management of its principal risks. Determining which controls are material therefore requires judgement and should reflect the circumstances of the individual company.
The Code remains principles-based and does not prescribe a particular controls framework or assurance model. This gives companies flexibility in how they identify, monitor and obtain assurance over their material controls, while requiring the board to have an appropriate basis for the statements it makes in the annual report.
Who does the updated Corporate Governance Code affect?
The UK Corporate Governance Code applies to companies within the scope of the FCA’s Listing Rules requirements relating to the Code. This includes companies in the commercial companies category and the closed-ended investment funds category, regardless of where they are incorporated.
Companies within scope report against the Code on a “comply or explain” basis. This means that where a company chooses to depart from a Provision of the Code, it should provide a clear explanation of the reasons for doing so and how its alternative arrangements are consistent with good governance.
Companies that are subject to other internal control requirements, including those arising from overseas listings, may already have established controls and assurance arrangements. However, they still need to consider the specific requirements of the UK Code, including the scope of material financial, operational, reporting and compliance controls under Provision 29.
Organisations outside the formal scope of the Code may also find aspects of it useful when considering their own governance arrangements. However, the Code is designed for companies within its regulatory scope, and its provisions should not automatically be treated as requirements or a universal governance framework for charities, private companies or other organisations.
Why material controls matter beyond the annual declaration
Provision 29 creates an annual reporting requirement, but the underlying governance work extends beyond preparing the declaration itself. To make an informed statement about the effectiveness of material controls, the board needs appropriate information about the company’s risk management and internal control framework and the operation of the controls considered material.
This creates an important connection between the company’s principal risks, its material controls, the assurance available over those controls and the information ultimately provided to the board. Where those elements are not clearly connected, it may be more difficult for the board to understand whether the framework is operating effectively and whether it has an appropriate basis for its annual reporting.
The process can also highlight practical governance issues. Responsibilities for controls may not always be clearly documented, evidence may be held across different teams, assurance activity may not align with the controls the board considers material, or weaknesses identified during the year may require further action and monitoring.
A structured approach therefore supports more than the year-end declaration. It can help organisations establish clearer ownership, maintain appropriate evidence, identify gaps in assurance and provide boards with more coherent information about the effectiveness of the risk management and internal control framework.
This does not mean that every control needs to be treated in the same way. The focus of Provision 29 is on material controls, and the Code allows companies to apply judgement in determining what is material in the context of their own circumstances.
Supporting the practical work behind Provision 29
Provision 29 requires boards to have an appropriate basis for their annual reporting on the effectiveness of material controls. Supporting that assessment can involve considerable practical work across different functions within the organisation.
Corporate Assist can provide additional capacity alongside existing Governance, Risk, Compliance, Finance and other relevant teams. This might include coordinating information from control owners, maintaining control and evidence registers, supporting the collection and organisation of assurance information, tracking identified gaps and agreed actions, and bringing together the information required for board or committee review.
Corporate Assist can also support wider governance projects connected with risk management and internal controls, helping organisations bring structure to information, documentation and action tracking where additional resource is needed.
Responsibility for identifying the company’s material controls, assessing their effectiveness, determining the assurance required and approving the statements made in the annual report remains with the company, its board and the appropriate internal or specialist advisers.
If your organisation needs additional capacity to support the practical governance work associated with Provision 29 or a wider risk and internal control project, please get in touch to discuss your requirements.
Continue to Part 2: UK Corporate Governance Code 2024: Practical Implementation of Provision 29 - Part 2
Share this post: