Implementing Provision 29 requires more than identifying material controls. Companies need practical arrangements for linking controls to principal risks, establishing ownership, gathering appropriate evidence, monitoring effectiveness and providing the board with the information needed to support its annual reporting.
Provision 29 of the 2024 UK Corporate Governance Code applies to financial years beginning on or after 1 January 2026. It strengthens the expectations around the board’s monitoring and review of the risk management and internal control framework and requires specific reporting about the effectiveness of material controls.
For companies within scope, the practical challenge is translating those requirements into arrangements that provide the board with appropriate information and evidence. This involves considering how material controls are identified, how responsibilities are allocated, how their operation is monitored and how assurance and reporting are brought together.
This article looks at some of the practical considerations involved in implementing Provision 29 and developing an approach that reflects the company’s circumstances, principal risks and existing governance arrangements.
If you have not already read Part 1, UK Corporate Governance Code 2024: Key Changes and Provision 29 - Part 1 provides an overview of the principal Code changes and the requirements of Provision 29.
Practical steps for implementing Provision 29
Start with the principal risks
Identifying material controls should be considered in the context of the company’s principal risks and the objectives those controls support. Existing risk management arrangements therefore provide an important starting point for understanding where material controls may sit across the organisation.
Companies can review their existing risk registers and related governance information to understand how financial, operational, reporting and compliance risks are currently identified and managed. The purpose is not necessarily to create a new risk framework for Provision 29, but to establish a clear connection between the company’s principal risks, the controls that help manage them and the information available to support board oversight.
Determine which controls are material
Provision 29 does not prescribe a fixed definition or list of material controls. Determining which controls are material requires judgement by the board, taking account of the company’s circumstances and the matters that are important to its risk management and internal control framework.
This assessment should consider material financial, operational, reporting and compliance controls. A control may be material because of the significance of the risk or objective it supports, the potential consequences if it fails, or its importance to information and reporting relied upon by the board and other stakeholders.
The assessment should also be capable of being explained and supported. Maintaining a clear record of how material controls have been identified, the rationale for their inclusion and how they relate to the company’s risks and governance arrangements can provide useful evidence for subsequent monitoring, review and board reporting.
Map and document the relevant controls
Once material controls have been identified, organisations need a clear record of what those controls are, what they are intended to achieve and where responsibility for their operation sits. Existing control registers, risk and control matrices, policies, procedures and other governance records may already contain much of this information.
The documentation should be proportionate to the organisation and sufficiently clear to support ongoing monitoring and review. Depending on the control, useful information might include the control owner, the risk or objective it supports, how and when the control operates, the evidence generated by its operation and the arrangements for monitoring or assurance.
Controls may operate at different levels and through different parts of the organisation, including business processes, governance arrangements and technology. The important point for Provision 29 is not to fit every control into a prescribed category, but to understand the material controls within the company’s framework and maintain sufficient information to support their oversight.
Consider the monitoring and assurance needed
The board needs appropriate information to support its monitoring and annual review of the risk management and internal control framework and its reporting on material controls. Companies should therefore consider what monitoring, testing and other sources of assurance are appropriate for the material controls they have identified.
Existing arrangements may already provide relevant evidence. Depending on the nature of the control and the organisation’s governance structure, this could include management monitoring, evidence produced through the operation of the control, control-owner reporting, compliance monitoring, internal audit work or external assurance.
The appropriate approach will not necessarily be the same for every material control. Companies can consider the significance and nature of the control, the risks associated with its failure, the evidence already available and whether additional assurance is needed to give the board an appropriate basis for its review and reporting.
It is also useful to establish how weaknesses or failures identified through monitoring and assurance will be recorded, escalated and tracked. This helps connect the assurance process with remediation activity and the information ultimately provided to the board.
Integrate monitoring and board reporting
Monitoring material controls should form part of the company’s ongoing risk management and internal control arrangements rather than being treated solely as a year-end exercise. Companies should consider how information about the operation and effectiveness of material controls will be reported through existing management, committee and board reporting arrangements.
The information provided should enable relevant management and governance bodies to understand the status of material controls, significant weaknesses or failures identified, action being taken to address them and any matters requiring escalation. The frequency and level of reporting will depend on the nature of the controls, the risks involved and the company’s existing governance arrangements.
Clear reporting arrangements can also help maintain the connection between monitoring activity during the year and the board’s annual review and declaration. Where issues arise, maintaining an appropriate record of the matter, the action taken and subsequent monitoring provides evidence of how the organisation has responded.
Consider resources and responsibilities
Implementing and maintaining the arrangements needed to support Provision 29 can involve contributions from several parts of the organisation. Governance, Risk, Compliance, Finance, Internal Audit, operational teams and control owners may all hold information or responsibilities relevant to the company’s material controls.
It is therefore useful to establish clear responsibilities for identifying and documenting controls, providing evidence, carrying out monitoring or assurance activity, addressing weaknesses and reporting information through the appropriate governance structure.
Organisations should also consider whether existing teams have sufficient capacity to coordinate this work alongside their usual responsibilities. Where additional resource is needed, external support can provide practical capacity for activities such as coordinating contributions, maintaining control and evidence registers, organising information, following up outstanding actions and supporting project delivery.
Specialist advice may be appropriate where the organisation requires legal or regulatory interpretation, technical risk or control expertise, internal audit or independent assurance. Those responsibilities should remain clearly distinguished from the practical coordination and governance support surrounding the process.
Apply a proportionate approach
The Code is principles-based, and companies should apply its provisions in a way that reflects their individual circumstances. The arrangements supporting Provision 29 therefore do not need to look identical across every company within scope.
Companies can take account of factors such as their size, complexity, business model, principal risks, existing governance arrangements and the nature of their material controls when determining how those controls are documented, monitored and reported.
Proportionality should not, however, be confused with reducing the requirement itself. The board still needs an appropriate basis for its annual review and reporting. The practical approach used to achieve that can reflect the company’s circumstances and make appropriate use of governance, risk, control and assurance arrangements that are already in place.
Organisations outside the formal scope of the Code may choose to draw on aspects of this approach when reviewing their own risk management and internal control arrangements, but they should do so in the context of the governance and regulatory requirements that apply to them.
How Corporate Assist can support Provision 29 projects
Implementing Provision 29 can involve a substantial amount of coordination across governance, risk, compliance, finance, internal audit and operational teams. Information about risks, controls, assurance and actions may already exist across the organisation, but bringing it together into a structured and maintainable record can require additional capacity.
Corporate Assist can provide practical project and governance support alongside the teams and specialist advisers responsible for the substantive assessments. This can include coordinating contributions from different functions and control owners, maintaining control and evidence registers, organising supporting documentation, tracking gaps and agreed actions, and helping to prepare information for management, committee and board review.
Support can also include maintaining project plans and trackers, following up outstanding information and actions, coordinating review activity and helping to establish practical processes for keeping control and assurance information up to date.
Where a Provision 29 project identifies matters requiring legal, regulatory, technical risk, internal audit or independent assurance expertise, those assessments remain with the organisation and its appropriate specialist advisers. Corporate Assist can support the surrounding process by coordinating information, recording outcomes and tracking the actions that arise.
Responsibility for determining which controls are material, assessing their effectiveness, deciding what assurance is required and approving the company’s annual reporting remains with the company, its board and the relevant risk owners and advisers.
Depending on the nature of the project, this work may form part of Corporate Assist's Corporate Governance Support, Compliance & Risk Support or Corporate Project Support services.
Building a sustainable approach to provision 29
Provision 29 should not be viewed solely as a year-end reporting exercise. The board’s declaration is supported by the risk management, control, monitoring, assurance and reporting arrangements operating throughout the year.
Establishing clear connections between principal risks, material controls, control ownership, evidence, assurance and board reporting can help make those arrangements easier to maintain and review. Where weaknesses or gaps are identified, clear action tracking and follow-up also help maintain an appropriate governance record of how they have been addressed.
For many companies, much of the underlying information and governance activity may already exist. The practical challenge is bringing the different elements together in a way that is proportionate, clearly documented and capable of supporting ongoing board oversight and annual reporting.
If your organisation needs additional capacity to coordinate a Provision 29 project or support the practical governance work surrounding risk management and internal controls, please get in touch to discuss your requirements.
Share this post: