UK Provision 29: Board Declaration on Material Controls (2026 Reporting Cycle)
Why 2026 Is the Evidence-Building Year
The rest of the 2024 UK Corporate Governance Code applied from financial years beginning 1 January 2025. Provision 29 — the material-controls declaration — was deferred a year, and that year is now. For calendar-year companies, 1 January to 31 December 2026 is the first covered period; the declaration lands in the annual report published in early 2027. Non-calendar year-ends follow their own first covered year (April 2026–March 2027 for March year-ends, and so on).
The FRC’s January 2026 Mythbuster is explicit: reporting against the new provision is expected “in the following year” — meaning now is for building evidence, not drafting prose. Boards that start assembling the file in late 2026 will discover the gaps too late to remediate within the assessment year.
Pair with Board of Directors, Audit Committee Handbook, Audit Committee Charter, and Board Meeting Minutes.
The Three Disclosures (Know Exactly What You Must Sign)
Provision 29 requires the annual report to contain:
- How the board monitored and reviewed the effectiveness of the risk management and internal control framework through the year — the process narrative, with enough specificity to evidence it happened (reviews held, reports received, deep dives commissioned).
- The declaration itself: whether the board considers material controls to have operated effectively as at the balance sheet date — a point-in-time statement about a defined population, not a whole-year clean bill of health.
- Failures and fixes: any material controls that did not operate effectively, with the remediation or improvement actions taken — described plainly enough that a shareholder can judge seriousness and response.
As-at precision matters: a control remediated in February does not change a 31 December assessment, and a March breakdown does not invalidate it — but both belong in the narrative around the declaration. Agree these dating and materiality conventions with the audit committee before the dry run, not during drafting.
The Seven-Step Preparation Framework
Step 1 — Refine principal risks (Q3 2026)
The declaration population derives from principal risks, so stale risk registers poison everything downstream. Refresh the register now: retire risks that no longer threaten the model, add AI, cyber, supply-chain, and climate-transition exposures where material, and write each risk with an owner, an appetite statement, and measurable indicators — see Enterprise Risk Management and Risk Officer Mandate. A material control that maps to no principal risk will not survive scrutiny; a principal risk with no mapped controls is a declared gap.
Step 2 — Define risk appetite and indicators
For each principal risk, set appetite in numbers where possible (liquidity floors, tolerance for control exceptions, incident thresholds) and name the indicators the board watches. Appetite without indicators is decoration; indicators without appetite are noise. Minute both — the minutes are evidence that the board set the bar it now claims to have met.
Step 3 — Identify and map the material-control population
Working from the risks, inventory candidate controls across all four families — financial, operational, reporting, compliance — then apply the materiality filter: would failure threaten the business model, solvency, liquidity, or shareholder value? Expect roughly 30–50 controls (the FRC’s observed range), but justify the count from your risks, never target a number. Document excluded controls with reasons; the exclusion log is as important as the population list, because it shows the line was drawn deliberately. Reuse existing SOX documentation where it maps — see Internal Controls Framework and SOX 404 — but do not assume SOX coverage equals Provision 29 coverage: operational and compliance controls are the usual gaps.
Step 4 — Map assurance coverage across the three lines
For every material control, record who provides assurance and when: first-line self-assessment and management testing, second-line compliance and risk oversight, third-line internal audit plan coverage. The map’s most valuable cell is the empty one — controls with no independent coverage. Those get testing scheduled or an explicit, minuted acceptance of the gap. Coordinate with Internal Audit Framework planning and Q1 Audit Prep so the same evidence serves audit, committee, and declaration purposes.
Step 5 — Run a dry run (Q4 2026, not Q1 2027)
Execute the full cycle once before it counts: monitoring write-up, effectiveness testing to a trial balance-sheet date, deficiency aggregation, and a draft declaration with the weaknesses section populated honestly. The dry run’s deliverable is a gap list with owners and dates — control descriptions that can’t be evidenced, testing with no reviewer sign-off, remediation without retest windows. Fix the process while failure is free.
Step 6 — Engage the external auditor early
No attestation is required, but the auditor reads the annual report and must consider consistency with audit findings. A material weakness in the audit that never appears in the declaration is a credibility event. Share the draft population and severity thresholds with the engagement team in Q4, reconcile differences in terminology (audit “deficiencies” vs board “ineffective controls”), and confirm nothing in the declaration contradicts the audit file. See External Audit PBC for the evidence-sharing mechanics.
Step 7 — Draft declaration wording with agreed thresholds
Agree in advance what “material” and “operated effectively” mean for this company: which deficiency severities trigger disclosure, how partial-year operation is treated, and how remediated-before-year-end controls are described. Draft three versions now — clean, qualified with named weaknesses, and explain for any non-compliance — so February drafting is selection, not invention. Have counsel review the final language against the testing file: every sentence in the declaration should trace to evidence, and every material weakness in the file should appear in the text (or be explained as remediated with retest proof).
The Company Secretary’s Operating Role
The company secretary typically owns the machinery, not the judgments:
- Evidence assembly: maintain the control inventory, testing schedule, and deficiency log as a single version-controlled file — the declaration’s audit trail.
- Board-paper drafting: monitoring write-ups, dry-run results, and declaration drafts that separate fact (what was tested, when, by whom) from recommendation, so the board’s discussion — minuted — is visibly independent.
- Cross-functional coordination: chasing control owners for evidence, aligning internal audit timing with the declaration calendar, and keeping counsel, auditors, and the committee on the same definitions.
- Minutes that evidence oversight: record challenge, dissent, and follow-ups on weaknesses — auditors, and potentially litigants, read these minutes as the record that the board did the work, not just signed the page. See Board Minutes standards.
Common First-Cycle Failures (and Preventions)
| Failure | Prevention |
|---|---|
| Population is SOX controls relabelled; operational/compliance gaps unmapped | Step 3 from principal risks, not from last year’s binder |
| Testing finishes after year-end with no retest window | Dry run in Q4; schedule retesting before the balance-sheet date |
| Remediation claimed without retest evidence | No closure without independent re-performance — see Whistleblower for persistent-issue escalation |
| Declaration language the evidence can’t support | Trace every sentence to testing; counsel reviews against the file |
| Auditor reads the draft in February and disagrees | Engage in Q4; reconcile terminology and severity thresholds early |
FAQ
Does Provision 29 require auditor attestation like SOX 404?
No. The declaration is the board’s, on a comply-or-explain basis. But the external auditor considers consistency between the declaration and audit findings — treat early engagement as mandatory in practice.
How many material controls should we declare on?
No prescribed number. Justify the population against principal risks; the observed range is roughly 30–50, but the right number is the one you can evidence and defend.
Next Steps
- Freeze the principal-risk refresh and appetite statements this quarter, with owners and indicators minuted.
- Lock the material-control population and three-lines assurance map, then run the Q4 dry run against a trial balance-sheet date.
- Engage the external auditor on population and thresholds before year-end, and draft all three declaration variants while remediation time remains.
