UK year-end reporting: auditors and boards face first real test of Provision 29

The arrival of Provision 29 of the 2024 UK Corporate Governance Code was a significant shift in how listed companies are expected to think about internal controls. While organisations have long been required to maintain appropriate risk management and control frameworks, Provision 29 moves the discussion beyond the existence of controls and towards demonstrating their effectiveness.

Although the provision came into force for financial years beginning on or after 1 January 2026, only now are many organisations reaching the point at which they must determine whether they have sufficient evidence to support the declarations made in their annual reports.

For companies with a 31 December 2026 year-end, the upcoming reporting cycle will be the first examination of how prepared boards are to make the required disclosures. As a result, auditors, audit committees, general counsel, compliance teams and internal audit functions are likely to find Provision 29 featuring prominently in year-end discussions.

What does Provision 29 require?

Provision 29 requires boards to monitor the company's risk management and internal control framework and carry out a review, at least annually, of its effectiveness. The review must cover all material controls, including financial, operational, reporting and compliance controls. Boards must then explain in the annual report how they have assessed the framework, provide a declaration on the effectiveness of material controls and disclose any material control deficiencies that have been identified.

Importantly, the provision does not prescribe what constitutes a "material control". That assessment is left to each board based on the organisation's specific risks, operations and circumstances.

Why 2026 year-end reporting matters

For those with a 31 December 2026 year-end, the reporting process is likely to raise a number of practical questions:

• which controls are sufficiently important to be considered "material"?
• what evidence exists to support a conclusion that those controls operated effectively throughout the year?
• where control testing has not been performed, can the board confidently make an effectiveness declaration?
• how should control deficiencies and remediation activities be described in public disclosures?

  It is worth noting that these are not purely compliance questions. They go directly to the heart of governance, accountability and the information that boards are prepared to stand behind publicly. This in turn will drive closer collaboration between risk management, compliance, finance, operations and internal audit, as boards seek to ensure they have sufficient evidence to support their public declaration on the effectiveness of material controls.

Why auditors will be critical to the conversation

Provision 29 is not an audit requirement, and auditors are not being asked to provide attestation on internal controls, as is the case in the US under the Sarbanes-Oxley Act. Nevertheless, auditors are likely to encounter Provision 29-related issues during year-end engagements.

Boards preparing their annual reports will need to consider the evidence supporting their effectiveness declarations. Audit committees are likely to seek assurance over the robustness of management's assessment processes. Internal audit functions may also be asked to increase controls testing, while external auditors may find themselves discussing the maturity of control frameworks, remediation activity and governance disclosures with management and those charged with governance.

Where there are gaps between management's assessment of effectiveness and the available evidence, it is clear that Provision 29 may become a significant area of focus during year-end reporting.

The importance of compliance controls

One common misconception is that this new provision is primarily about financial controls. The UK Corporate Governance Code is clear that material controls extend beyond finance and can include operational, reporting and compliance controls.

For many organisations, particularly those operating in regulated sectors, material controls may include areas such as:

• fraud prevention and detection;
• anti-bribery and corruption frameworks;
• sanctions compliance;
• anti-money laundering controls;
• whistleblowing arrangements; and
• third-party risk management processes.

Consequently, compliance and legal functions may find themselves playing a much more prominent role in helping boards assess and evidence control effectiveness.

From existence to effectiveness

Perhaps the most significant aspect of Provision 29 is the change in mindset it encourages. Historically, organisations have often focused on whether a control framework exists. Provision 29 asks a different question: can management demonstrate that its most important controls are operating effectively and produce evidence to support that conclusion?

That mindset shift inevitably places greater emphasis on controls testing, internal audit activity, data analytics, remediation programmes and governance documentation. In doing so, Provision 29 also creates a closer link between principal risks, control frameworks and board reporting.

Future outlook

The declaration itself may be only a few lines in an annual report, but the work required to support it can be substantial. Organisations are having to connect principal risks, material controls, testing results and remediation activities in a way that can withstand scrutiny from boards, auditors and investors.

As the first wave of Provision 29 declarations approaches, we are likely to see varying levels of readiness across the market. Some organisations will have mature frameworks supported by well-established testing and assurance programmes, while others may identify evidencing gaps, inconsistent documentation or uncertainty around what constitutes a material control. These gaps and uncertainties need to be addressed before boards can make their first declarations with confidence.

For auditors and others involved in year-end reporting, this provision is much more than a governance update. It has the potential to become a major reporting theme for the 2026 reporting season, particularly for companies with a 31 December year-end that are preparing to make their first public declarations on the effectiveness of material controls.

The coming months will provide the first meaningful indication of how boards intend to approach their Provision 29 declarations, and whether organisations are ready to support them with the evidence that stakeholders increasingly expect.