Provision 29: Build the Evidence Before the Board Declaration

Provision 29: Build the Evidence Before the Board Declaration

A board cannot reach a credible conclusion on material controls from a year-end folder assembled in a hurry. Evidence must exist because controls operated, exceptions were recorded and the framework was monitored and reviewed.

The Financial Reporting Council says Provision 29 of the 2024 UK Corporate Governance Code applies to financial years beginning on or after 1 January 2026. The Code calls for the board to monitor and review the risk management and internal control framework, and to include a declaration on the effectiveness of material controls in the annual report. The FRC’s guidance explains the reporting expectations, including disclosure where material controls did not operate effectively and actions taken or proposed. FRC, UK Corporate Governance Code 2024 FRC, Provision 29 Mythbuster

Define materiality for this company

Do not import a generic controls list and call it complete. Identify the material controls in the context of the organisation’s risks, structure and reporting. For each control, record the risk addressed, accountable owner, frequency, evidence expected, reviewer and escalation route.

A policy is not evidence of operation. Specify what a successful control leaves behind: a reconciliation, approval, access review, exception report, meeting record or other relevant artefact. Record the period covered and retain the version that was actually reviewed.

Run the review throughout the year

Set a calendar that matches control frequency and board reporting. Review exceptions, late attestations, testing results, incidents and assurance findings as they arise. A missing evidence item is an exception to manage, not a silent green status.

Make weaknesses decision-ready

For a control that did not operate as intended, capture the period, issue, impact assessment, interim safeguard, accountable executive, corrective action and target date. State what evidence will show the issue is closed. Escalate repeated failures and overdue remediation.

Do not use an optimistic label to conceal a gap. Distinguish between a control that worked, a control with an identified deficiency and a control for which evidence is insufficient. Those are different states and need different responses.

Give the board a concise, challengeable view

The board needs a clear account of the monitoring and review undertaken, the material controls in scope, open weaknesses and the basis for its conclusion. It does not need an unfiltered data dump. Make the chain visible from risk to control, from control to evidence, and from exception to decision.

The hard test is whether a director can challenge the basis of the declaration without relying on unsupported assurances. If not, improve the evidence chain now. Assurance is not a document produced at year end. It is the record of controls being owned, operated, reviewed and corrected.