Provision 29: The Final Countdown

Provision 29 – one of the most crucial aspects of the new UK Corporate Governance Code, is coming to the end of its trial/bedding-in period. From 1st January 2026, it will apply in full to all relevant companies. 

Held back a year by regulators due to its more complex and burdensome nature, UK businesses in the “commercial companies” or “closed-ended investment funds” categories will soon be bound by the provision in full. They must approach it on the same “comply or explain” basis, like every other part of the code.

Provision 29 is a core component of the UK’s Corporate Governance code – often considered the oldest and most extensive such code in the world. 

Successive UK governments, from opposite ends of UK politics, have both supported reform of this code, and the new version entered into force on 1st January 2025. Provision 29 was one exception. 

The provision is all about risk management and internal controls. It strengthens rules already in place, making them more thorough:

• Before, companies were simply required to monitor and review their risk control frameworks. Soon, their annual reports need to thoroughly explain how they did this. 
• Before, boards simply had to include some kind of reference to material controls (we’ll talk about this more below) in their reporting. Soon, they’ll have to include a specific declaration of the effectiveness of these controls. 
• Before, the annual report simply needed to contain a broad review of risk and controls. Soon, it will need to include a dedicated discussion of all material controls that haven’t worked as they should have, and what’s being done to correct that.  

Recognising the scale of what was being asked, the Financial Reporting Council delayed implementation of provision 29 by one year, but that time is now almost up.

The ideal scenario is that boards and their audit committees have used 2025 effectively. It wasn’t a break; it was a vital time to get ready. 

There has been a lot of commentary among experts about doing “dry runs” of these new reporting compliance obligations during the year, to identify weak spots and ensure there would be no problems when reporting started for real. Any company that did that should be comfortable enough with its 2026 responsibilities. 

However, for firms that are not so ahead of the curve, the future requirements are immediate and immutable.

The board must ensure that it has the capacity to produce the extra, detailed reporting. If responsibilities need to shift or training needs to happen, get it done. 

Crucially, boards must be absolutely sure of what they understand to be the company’s material controls, as these will matter a lot in the new updates.

The greatest challenge of provision 29 is the one that lacks clarity and causes the most debate. It’s the concept of ‘material controls’. 

The lack of clarity isn’t a fault; it’s just the nature of the provision. The FRC deliberately chose not to provide a rigid definition of ‘material’ to avoid a tick-box mentality. 

This places a significant burden of judgment squarely on directors. They need to navigate through subjective, company-specific circumstances to find the things that matter to stakeholders and report properly on them. 

When asking what defines a material control for a company, the final question is simple: Look at each control and ask, “If this failed, would the impact be big enough that investors need to know quickly?”

• Link to principal risks. Risks that are strong enough to threaten a company’s business model, solvency or reputation are relevant here. Any controls mitigating these risks are therefore “material”.
• Their impact on and off the balance sheet: The financial lens is a crucial measuring tool for material control, but directors should not restrict themselves to it. Instead, they should look more holistically, recognising that modern governance also involves shareholder sentiment, consumer attitudes, and a company’s public profile.

From 1 January 2026, the UK corporate governance regime shifts from implicit monitoring to explicit accountability.

For those companies that have used 2025 to test their capabilities for this provision, the focus is on perfecting what they have been preparing. For those that haven’t given it much thought, the urgent goal is to ensure you know what material controls matter and ensure you have the skillsets and capacity to report on them.