The Financial Reporting Council's UK Corporate Governance Code 2024 introduced one significant change for boards: Provision 29, which applies for financial years beginning on or after 1 January 2026.
What it requires
Boards were already expected to monitor their risk management and internal control framework. Provision 29 goes further. The annual report must now include a declaration of the effectiveness of the company's material controls at the balance sheet date, and describe any material controls that have not operated effectively and what is being done about them.
What this means in practice
- The board needs to be clear which controls are "material" for its business. This covers financial, operational, reporting and compliance controls, not just finance.
- There needs to be evidence behind the declaration: a clear view of the controls, how they are tested, and who provides assurance.
- Cyber and technology controls will often be among the most material, so they need to be in scope.
Why it matters if you are not listed
The Code formally applies to listed companies, on a comply-or-explain basis, but its expectations tend to spread. Investors, lenders, large customers and regulators increasingly ask similar questions. For any board, knowing which controls really matter and how you know they work is simply good governance.
If you are not sure where to start, begin with a short workshop with the board or audit committee to agree your material risks and the controls that address them.