The declaration covers operational controls too. Provision 29 asks the board to review all material controls, including operational ones, and the auditor will not test them for you.
Evidence has to be dated. The board declares effectiveness as at the balance sheet date, so every material control needs evidence from the period that ends there.
Use the final quarter well. Confirm the list, set the evidence standard, rehearse with the audit committee, and fix what you can before the balance sheet date.
The audit committee is running a dry run of the company’s first Provision 29 declaration. On the screen is a list of 40 material controls, most of them financial, each with a test file behind it. Then a non-executive director points at one line: the permit-to-work control that stands between the business and a fatality on site. “How will we know it worked on the balance sheet date?” she asks.
Nobody has an answer that fits on the slide. The evidence exists, but it is spread across permit books, site systems and spreadsheets at 30 locations.
That is the gap the provision exposes. Most guidance on it is written for finance teams, and financial controls come with test files. Operational controls carry much of the risk in construction, infrastructure, transport and mining, and their evidence sits in the field. This guide covers what the provision requires, what counts as a material control, how to evidence operational controls for the declaration, and what to do in the final quarter before your first balance sheet date.
What Is Provision 29?
Provision 29 of the UK Corporate Governance Code 2024 requires the board to monitor the company’s risk management and internal control framework and, at least annually, review its effectiveness across all material controls, including financial, operational, reporting and compliance controls. In the annual report, the board must describe how it did that, declare whether its material controls were effective as at the balance sheet date, and describe any that were not, with the action taken or proposed.
That is three things in the annual report:
- The board describes how it monitored and reviewed the effectiveness of the framework.
- The board declares whether material controls were effective as at the balance sheet date.
- The board describes any material control that did not operate effectively, the action taken or proposed to improve it, and progress on issues reported before.
The wording comes straight from the Code, as quoted in the FRC’s Provision 29 Mythbuster. The second bullet is the new part. Boards have long been asked to review the framework; they have not been asked to stand behind a declaration about specific controls on a specific date.
Who It Applies To, and When
The requirement applies to companies reporting under the UK Corporate Governance Code 2024, for financial years beginning on or after 1 January 2026. A company with a December year-end reaches its first balance sheet date on 31 December 2026. One with a March year-end reaches it on 31 March 2027.
The FRC expects reporting against the provision from 2027 onwards and does not require early adoption. So the first declarations will appear in annual reports published in 2027, but the evidence behind them is being built now, during the financial year itself.
Public bodies do not report under the Code; central government works to the HM Treasury Orange Book instead.
What Counts as a Material Control?
The Code does not define a material control, and the FRC will not give opinions on which controls a company should choose. That is a decision for the board, tied to the company’s principal risks and business model. In practice, a material control is one whose failure would let a principal risk land with serious consequences for the business, its people or its reporting.
How many material controls companies are identifying
The FRC says the majority of companies it has engaged with have identified somewhere between 30 and 50 material controls. Forvis Mazars reports a market trend of 50 to 60, grouped into 15 to 20 focus areas. Treat both as context, not a target. The FRC is explicit that there is no requirement to compare your number with other companies.
Operational material controls in asset-heavy sectors
The Code names four categories: financial, operational, reporting and compliance. Most published examples are financial, fraud and cyber controls. In construction, infrastructure, transport and mining, the controls that stand between a principal risk and a serious outcome are often operational. These are controls companies in those sectors might consider, not a prescribed list.
| Sector | Principal risk | Possible material control | Evidence as at the balance sheet date |
|---|---|---|---|
| Construction | A fatality or serious injury on site | Permit to work for high-risk activities such as lifting, working at height and live services | Permits sampled across sites and the final quarter, showing approval, isolation and close-out before work, with exceptions and their actions |
| Infrastructure and utilities | Prolonged loss of service from a critical asset failure | Risk-based maintenance of critical assets | Scheduled maintenance on critical assets completed to plan, with every overdue work order explained and risk-assessed |
| Transport | A major safety incident caused by fatigue or competence gaps | Fatigue management and competence assurance for safety-critical staff | Rosters checked against fatigue limits across the period, and current competence records for everyone on safety-critical duties |
| Mining and resources | A catastrophic failure of a major hazard, such as a tailings or ground failure | Critical control verification | Verification records for each critical control against its performance standard, with failed checks closed out |
Key distinction: the board's review versus the audit
The auditor's controls work covers what matters for the financial statements. The board's review covers every material control, including operational ones the audit never looks at.
How to Evidence Material Controls for the Declaration
A declaration is a claim about a date, so the evidence has to answer two questions for each material control. Would the control change the risk if it ran as designed? And did it actually run that way, consistently, across the period that ends at the balance sheet date?
Assess design and operation separately, because they fail in different ways. A sound permit system that nobody follows on night shifts fails on operation. A permit system that ignores stored energy fails on design, however well it is followed. The method is set out step by step in how to assess control effectiveness.
Then make the evidence fit the declaration:
- Date every piece of evidence to the period ending at the balance sheet date, because a clean audit from last year says nothing about this one.
- Sample where failure is most likely, such as remote sites, night shifts and contractors, not only the head office.
- Weight independent evidence above self-assessment for the controls the board is least sure of.
- Use indicators between formal tests, so that drift shows up before the balance sheet date rather than after it. Key risk indicators give that running signal.
Then bring the three lines together. Control owners attest, the second line challenges and monitors, and internal audit tests the controls that matter most. The board needs one view of all three, not three reports in three formats.
This is where a register kept in documents breaks down. The control, its tests, the evidence, the exceptions and the actions sit in different files and drift apart between reviews. Purpose-built risk management software keeps risks, controls and evidence together, with board-level reports drawn from current data rather than assembled by hand each quarter.
A declaration is only as strong as the evidence behind the control the board is least sure of.
What the Provision 29 Declaration Must Contain
The reporting has three parts: how the board monitored and reviewed the framework, the declaration itself, and any material controls that were not effective. The FRC adds three expectations that shape how you write it.
First, keep it short. In most cases the FRC expects Provision 29 reporting to run to no more than two pages, proportionate to the company’s risks and appetite, with no duplication and nothing immaterial.
Second, there is no template. The FRC will not provide wording for declarations. A declaration that is clearly signposted, and shows the board’s oversight and confidence in its material controls, meets the requirement.
Third, you do not have to list your material controls or the testing behind them. The FRC wants the governance that led to the choice of controls and the oversight the board carried out, not an inventory.
If a material control was not effective at the balance sheet date, say so, with the action taken or proposed. A control that failed during the year but was put right before the balance sheet date does not have to be reported, although issues already public during the year should be addressed. And if something comes to light after the balance sheet date, there is no requirement to revise the declaration.
What Auditors Will and Will Not Do
The FRC’s Mythbuster on the auditor’s responsibilities, published in June 2026, settles most of the questions boards have been asking.
- The auditor’s opinion on the financial statements does not cover the Provision 29 statement.
- The statement is other information under ISA (UK) 720, which the auditor reads and considers for material inconsistencies with the financial statements and what the audit found.
- The auditor is not required to test the design, implementation and operating effectiveness of your material controls, although they may test some controls as part of the audit.
- A significant deficiency found in the audit does not automatically contradict a board’s conclusion that its material controls were effective.
The practical consequence is the one that matters most for operational controls. The FRC describes the auditor’s controls scope as much narrower than the board’s, because it covers only what is relevant to the financial statements. For the operational controls in the table above, the evidence behind the declaration is the company’s own.
The auditor will read your declaration. The evidence behind it is yours alone.
Your Provision 29 Plan for the Final Quarter Before Your Balance Sheet Date
Whatever your year-end, the last three months before your first balance sheet date decide how strong the declaration can be. Five steps use them well.
- Confirm the list. Agree the material controls with the board, and record the rationale that links each one to a principal risk.
- Set the evidence standard. For each material control, decide what evidence is enough, how much of it, who checks it, and which part of the period it must cover.
- Rehearse the declaration. Take a draft to the audit committee while there is still time to test. The gaps a rehearsal exposes are cheaper to close in this quarter than in the next.
- Fix what you can, and plan to disclose the rest. A control put right before the balance sheet date does not need reporting. One that is still failing on that date needs a description and an action.
- Draft the reporting early. Write the monitoring and review description now, keep the whole section near two pages, and leave the declaration itself until the evidence is in.
What the board is building, across those five steps, is the traceable link from an organisation’s objectives through its risks, controls, actions and assurance to the indicators that show whether it is performing. Provision 29 simply asks the board to show it.
Put Your Declaration on Firm Ground
Clew is a risk and assurance platform built around the Golden Thread, so every material control traces back to the principal risk it manages and forward to the evidence and actions behind it. Risk and assurance teams in construction, infrastructure and utilities, mining and resources, and transport use Clew to keep that line intact between reviews. For the detail behind your first declaration, download Clew’s Provision 29 guide, or explore Clew’s risk management software.
Frequently Asked Questions
What is Provision 29?
Provision 29 is part of the UK Corporate Governance Code 2024. It requires the board to review the effectiveness of the risk management and internal control framework across all material controls, and to declare in the annual report whether those controls were effective as at the balance sheet date. It applies to financial years beginning on or after 1 January 2026.
How many material controls should a company have?
There is no required number. The FRC says most companies it has engaged with have identified between 30 and 50, and some advisers report 50 to 60. The right number is the one that covers your principal risks, and there is no requirement to compare with other companies.
Does the annual report have to list material controls and the testing done?
No. The FRC does not expect companies to list their material controls or state the specific testing carried out. The reporting should explain the governance behind the choice of material controls and the oversight the board undertook.
Does the board need external assurance over material controls?
Not necessarily. The Code does not say testing of material controls must be supported by external assurance. That is a decision for the board and management, and it can change from year to year or apply to only part of the framework.
Does the auditor test material controls under Provision 29?
The auditor is not required to test the design, implementation and operating effectiveness of the material controls the board identifies. The auditor reads and considers the Provision 29 statement as other information, although they may test some controls as part of the financial statement audit.
Related Resources
- Clew’s Provision 29 guide goes deeper on the requirement and the board’s role.
- Balancing risk, control and assurance under the UK Corporate Governance Code sets the provision in the context of the wider Code.
- What directors actually need to see in a risk report covers the board’s view.
- Reporting risk to the board is Clew’s white paper on board-level risk reporting.
- How to assess control effectiveness sets out the five-step method.
