Provision 29 Starts with Evidence, Not a Declaration

Provision 29 Starts with Evidence, Not a Declaration

A board declaration is the final sentence, not the control process. For companies applying the UK Corporate Governance Code, Provision 29 requires the board to report on the effectiveness of material controls. The provision applies to financial years beginning on or after 1 January 2026. The FRC expects the assessment to be based on monitoring and review, not assertion. FRC, UK Corporate Governance Code 2024 FRC, Corporate Governance Code Guidance

Decide what is material for this business

Material controls are company-specific. The board needs a defensible view of which controls matter to the company’s risks, business model, operations, reporting and compliance. Do not begin with a generic library and assume every listed control is material. Start with the risks that could undermine the organisation’s strategy, reporting or critical operations, then identify the controls that respond to them.

Record the rationale for scope, the owner of each control, how it operates, how often it is tested and what evidence demonstrates performance. A control description without an operating record is not evidence of effectiveness.

Build the evidence trail through the year

Bring together monitoring results, internal audit or assurance findings, incidents, near misses, complaints, reconciliations and management reviews where relevant. Make the source, date, period covered and responsible owner clear. Challenge evidence that is stale, incomplete or produced by the same person who operates the control without independent review.

The board does not need a warehouse of documents. It needs a concise, traceable account showing what was tested, what the results were, what was challenged and how the conclusion follows from the evidence.

Do not bury exceptions

List material weaknesses, failures and gaps plainly. For each one, show the impact, interim safeguards, accountable executive, remediation action, target date and evidence required to close it. If a control was not effective at the relevant date, the board should not disguise that conclusion with an optimistic narrative.

Escalate overdue remediation and repeated exceptions. A control can look fine in a policy document while failing in practice. Test whether people followed it, whether the evidence is reliable and whether the control actually addresses the risk it was designed for.

Make the annual conclusion reviewable

The board should be able to explain how it monitored and reviewed the framework, its declaration about material controls at the balance sheet date, and any controls that were not effective with actions taken or proposed. Keep the distinction clear between a management assertion and a board conclusion supported by evidence.

Provision 29 is not served by a last-minute paper asking directors to approve a conclusion they cannot test. Set the scope, evidence owners and review cadence early. If the evidence is weak, say so and fix the control environment instead of polishing the wording.