Provision 29: Why Your Board's GRC Assurance is Likely a Fiction
Effective January 2026, the board must declare the effectiveness of internal controls. If you are still using spreadsheets, you are exposed.
The 2024 UK Corporate Governance Code has finally bared its teeth. Provision 29 requires boards to provide a definitive declaration on the effectiveness of their internal control frameworks. This isn't a "best efforts" request; it's a mandate for evidence-based assurance.
Most boards are operating on a fiction. They rely on "gut feel" and quarterly reports that are outdated the moment they are printed. If your GRC framework cannot provide a real-time view of your risk posture, you cannot honestly sign that declaration.
Governance, Risk, and Compliance (GRC) must be integrated into the workflow of the business. It cannot be an overlay. By the time the auditors arrive in 2027 to review your 2026 performance, it will be too late to fix the evidence trail. The time to build the rigour is now. Integrity is not just a value; it's a verifiable system.
✨ Recommended For You
Why GRC matters: achieving real value from integration in 2026
Discover why GRC matters in 2026. Learn to integrate effective governance, risk, and compliance for lasting resilience in a changing world.
Why Most GRC Software Fails (And What to Do Instead)
Most GRC software tracks known risks but misses what matters. Learn why traditional tools fail under audit and how modern governance should work.
Best GRC Software in the UK (2026): What to Choose and Why
Compare the best GRC software in the UK and understand which tools actually work under audit. Learn what to look for and how to choose a platform that gives real visibility, not just compliance reporting.
Bring your compliance work together
Organise requirements, supporting evidence and follow-up work in Simplif-i.