Provision 29: The countdown is on – are you where you need to be?
With an ever-evolving regulatory landscape, it is easy for boards to be overwhelmed with yet another new requirement. Such overwhelm can lead to minimalist adoption of new requirements which adds little value and fails to address the core reason for the change. The updated Provision 29, applicable for periods commencing on or after 1 January 2026, was introduced principally to increase boardroom focus and accountability on risk and control. It builds upon the foundation of board responsibility already in the 2018 Code but introduces new transparency and accountability elements which place the spotlight on how boards discharge their responsibilities and what the outcome was.
As a reminder, key changes now in effect include:
- A new declaration: boards are asked to provide a declaration on the effectiveness of material controls as at the balance sheet date. This is a significant step towards greater accountability that will feature in your 2026/27 annual report.
- Expanded scope: the boards monitoring and review activity should cover all material controls, which now specifically includes controls over financial and non-financial reporting in addition to financial, operational and compliance controls.
- Transparency on control failures: boards must describe any material controls which have not operated effectively at the balance sheet date, detailing the actions taken or proposed to improve them, and addressing previously reported issues.
Preparing for the new Provision 29 requires a proactive and comprehensive strategy and here are seven key areas to focus on:
- Refine principal risks: Challenge your existing list of principal risks and refine them to ensure they accurately reflect your current risk profile in today's volatile environment.
- Define risk appetite: Clearly articulate the risk appetite for each principal risk and identify risk indicators to flag when a risk moves out of appetite.
- Identify material controls: Ensure your population of material controls is appropriately focused and mapped to your principal risks. Continuously challenge and refine the number of controls.
- Understand assurance: Gain a clear understanding of the levels and nature of assurance provided by your three lines of defence for identified material controls (including the extent of reliance on self-certification).
- Plan a dry run: Schedule an effective dry run of the entire process, from identifying material controls through to drafting the declaration. This will help identify issues early and facilitate stakeholder engagement.
- Engage stakeholders: Involve all relevant stakeholders, including external auditors, throughout the preparation process.
- Prepare a draft declaration: Begin drafting the declaration early and share with the full board to agree appropriate and acceptable wording, particularly concerning the threshold for reporting ineffective material controls.
The FRC's consistent message for boards to "think for yourselves" remains paramount. There is no right or wrong answer here. This isn't about adopting a generic template; it's about developing and explaining a tailored approach that reflects your business's unique circumstances and how risks are identified, assessed and managed. The focus should be on demonstrating a proactive and accountable approach to risk management and internal control across the organisation to help strengthen resilience and build greater trust with stakeholders. With reporting for 2026/27 now on the horizon, the time for robust preparation is here, ensuring your business is ready for this new era of accountability.
For practical guidance on preparing for these changes, read our article.
