Provision 29: Preparing for your first internal controls declaration

As part of an update to the UK Corporate Governance Code, Provision 29 requires the boards of all companies with a premium listing on the London Stock Exchange to provide an annual report reviewing the effectiveness of their internal controls and risk management framework.

As boards start preparing to report, we explore what they need to know and what they can be doing now to start their preparation.

What is Provision 29?

Provision 29 introduces enhanced requirements for how boards assess, monitor and report on internal controls and risk management. Annual reports must contain:

1. An explanation of how the organisation’s risk control frameworks are monitored and reviewed
2. A declaration of how effective the business’ material controls are
3. Disclosure of any material control failings, including why they occurred and what is being done to address them

Provision 29 applies to accounting periods beginning 1 January 2026, meaning that many premium listed companies will be preparing to make their first declaration.

Failing to comply with Provision 29’s requirements could lead to reputational damage, share price volatility, and increased regulatory scrutiny from the Financial Reporting Council (FRC).

How can boards prepare now?

Early preparation is key to delivering a robust and supportable declaration. Boards should focus on the following areas:

• Defining material controls – Boards are responsible for determining which controls are material, as there is no prescribed list. Typical material controls can include those relating to:
  • Accounting and financial reporting
  • Operational and regulatory risks
  • IT systems and data integrity
• Assessing the current control environment – A comprehensive review of the existing control framework is essential. This includes evaluating whether:
  • Documentation is current and complete
  • Controls are operating consistently and effectively
  • There are any gaps, duplication or over‑reliance on manual processes
• Strengthening monitoring and assurance – Consider whether reporting gives a clear view of the effectiveness of controls, how any issues are escalated, tracked and resolved, and internal audit’s role in ensuring independent assurance is provided.
• Embedding board ownership – As Provision 29 is the board’s responsibility, it would be beneficial to be actively engaged by setting expectations and making sure the organisation has sufficient evidence to support the declaration.
• Undertaking a ‘dry run’ – Producing a practice declaration ahead of time can help identify gaps, test processes and ensure the organisation is prepared well in advance of reporting deadlines.

We’re here to help

Provision 29 represents a significant shift in governance expectations. Starting early will help boards strengthen their control environment and avoid last-minute challenges.

If you would like to discuss how these changes may affect your organisation - or how to ensure you are fully prepared - please get in touch with our specialist Risk Assurance team or speak to your usual Azets adviser.