Provision 29 and NED Due Diligence: What You Need to Know
Provision 29 of the UK Corporate Governance Code 2024 requires boards to monitor and annually review the effectiveness of the company's risk management and internal control framework, and to declare in the annual report whether material controls operated effectively as at the balance sheet date. For non-executive directors, the practical question is what evidence to seek before signing off that declaration — whether joining a listed board or serving on one.
The UK Corporate Governance Code 2024, published by the Financial Reporting Council on 22 January 2024, has applied since 1 January 2025, with Provision 29 specifically applicable from 1 January 2026, according to the Financial Reporting Council's UK Corporate Governance Code 2024 page. First reporting on the new Provision 29 requirements will appear in annual reports for accounting periods beginning on or after 1 January 2026, meaning most listed companies will report from 2027 onwards, the FRC states in its Provision 29 Mythbuster, published 29 January 2026.
Key takeaways
- Provision 29 requires the board to monitor and review the effectiveness of material internal controls at least annually, covering financial, operational, reporting and compliance controls.
- Directors declare on material controls only, not all controls, and materiality is company-specific based on factors such as size, business model and complexity, according to the FRC's Corporate Governance Code FAQ.
- The FRC does not expect companies to list material controls or specific testing in the annual report, nor does it mandate external assurance over controls.
- NED due diligence in this context means the questions and evidence a director should seek before relying on the board's Provision 29 declaration, not pre-appointment checks.
- High-quality governance reporting should explain the board's oversight process and outcomes, avoiding boilerplate compliance language, the FRC advises in its March 2026 report on comply-or-explain reporting.
What is Provision 29 and who does it apply to?
Provision 29 sits within Section 4 of the UK Corporate Governance Code 2024: Audit, Risk and Internal Control. The provision states that the board should monitor the company's risk management and internal control framework and, at least annually, review its effectiveness. The monitoring and review should cover all material controls, including financial, operational, reporting and compliance controls, according to the Financial Reporting Council's UK Corporate Governance Code 2024.
The Code applies to companies listed in the commercial companies category or the closed-ended investment funds category, regardless of where incorporated, the FRC confirms. It operates on a comply-or-explain basis, meaning companies must either follow the Code's provisions or explain why they have not done so.
Provision 29 has three reporting requirements for the annual report:
- A description of the board's monitoring and review of the risk management and internal control framework.
- A declaration of effectiveness of material controls as at the balance sheet date.
- Where material controls have not operated effectively, a description of those controls and the action taken or proposed.
This is not a generic "internal controls are effective" statement. The declaration is specific to material controls, and it is made as at a point in time: the balance sheet date.
What counts as a material control?
Materiality is the critical judgement. The Financial Reporting Council's Corporate Governance Code FAQ on Audit, Risk and Internal Control clarifies that directors do not declare over all internal controls, only material controls. What counts as material is for each board to determine and is company-specific.
The FRC lists factors that boards should consider when determining materiality: size, business model, strategy, operations, structure and complexity. There is no prescribed list of material controls, nor a fixed number.
In its Provision 29 Mythbuster, the FRC states that it will not prescribe the number of material controls. The regulator notes that many companies have identified somewhere between 30 and 50 material controls, with some financial-sector companies having more. But this is descriptive, not prescriptive. Companies need to satisfy themselves that the number is right for them.
Material controls can span four categories: financial, operational, reporting and compliance. A board might reasonably consider:
- Financial controls over revenue recognition, expenditure approval, treasury management and financial reporting integrity.
- Operational controls over key business processes, supply chain, health and safety, and customer data handling.
- Reporting controls over the quality and timeliness of internal and external reports.
- Compliance controls over regulatory obligations, data protection, anti-bribery and sector-specific requirements.
The board's job is to determine which controls are material to the company's ability to achieve its objectives and manage its principal and emerging risks.
What does the board need to do under Provision 29?
Provision 29 has two operational requirements and three reporting requirements.
The operational requirements are monitoring and review. The board should monitor the risk management and internal control framework throughout the year. At least annually, it should carry out a formal review of effectiveness.
The Financial Reporting Council's Corporate Governance Code Guidance suggests the review may consider:
- The design and operation of the framework.
- The company's risk appetite.
- Principal and emerging risks.
- The quality of management monitoring.
- The escalation of significant issues.
- Significant control failings or weaknesses.
- Actions taken to improve ineffective material controls.
- Public reporting processes.
The board may use reports from management, internal audit, external auditors or other assurance providers when reviewing effectiveness, the Guidance states. This reflects existing governance practice: boards do not directly test controls. They rely on assurance from those who do.
The reporting requirements apply to the annual report. The board must:
- Describe how it monitored and reviewed the framework.
- Declare whether material controls were effective as at the balance sheet date.
- Disclose any material controls that did not operate effectively, with actions taken or proposed.
The FRC emphasises that it does not expect companies to list material controls or specific testing in the annual report, according to the Provision 29 Mythbuster. Instead, reporting should explain the governance that led to the decision on material controls and the board oversight undertaken.
What Provision 29 does not require
Clarity on what Provision 29 does not require is as important as understanding what it does.
No pre-appointment due diligence mandate. Provision 29 does not require NEDs to undertake due diligence before accepting a board appointment. That is a category error. The provision is about the board's ongoing monitoring and annual review of internal controls, not about director appointment processes.
No prescribed number of material controls. The FRC will not tell companies how many controls should be material. That is a board judgement based on company-specific factors.
No mandated listing of controls. Companies do not need to list their material controls in the annual report, nor detail specific testing. The FRC expects explanatory governance reporting, not a controls inventory.
No mandatory external assurance. External assurance over controls is not mandated by the Code, the Provision 29 Mythbuster confirms. This is a decision for the board and management.
No early adoption requirement. The FRC does not require early adoption. Companies apply Provision 29 for accounting periods beginning on or after 1 January 2026, with first reporting from 2027 onwards for most.
Understanding these boundaries helps NEDs ask the right questions. The risk is not under-compliance with prescriptive rules. The risk is boilerplate reporting that fails to explain what the board actually did.
What should NEDs ask before signing off?
This is where NED due diligence comes in — not as a statutory pre-appointment check, but as the evidence and questions a director should seek before relying on the board's Provision 29 declaration.
The FRC's March 2026 report, Improving the quality of comply or explain reporting, warns that high-quality reporting is preferable to tick-box compliance. Boilerplate compliance language can lack substance and information about governance outcomes. NEDs should probe whether the board has done the work, not just the wording.
The following table sets out the due diligence areas, the evidence NEDs should ask for, and the board questions to raise.
| Due diligence area | Evidence a NED should ask for | Board question to ask |
|---|---|---|
| Material control identification | Paper to the board setting out the methodology for determining material controls, the factors considered, and the list agreed. | "How did management and the board decide which controls are material, and why is this number right for us?" |
| Risk linkage | Mapping of material controls to principal and emerging risks disclosed in the annual report. | "Does each principal risk have one or more material controls, and are there gaps?" |
| Monitoring process | Terms of reference for the audit or risk committee showing how controls are monitored; sample management reports on control exceptions. | "What exception reporting does the committee receive, and how often?" |
| Assurance sources | Internal audit plan and reports relevant to material controls; external auditor management letter points on controls. | "What assurance have we received on the design and operating effectiveness of material controls, and from whom?" |
| Board review process | Minutes or board papers showing the annual review discussion, judgements made, and actions agreed. | "When did the board review effectiveness, what judgements did we make, and where is that recorded?" |
| Control failings | Register of significant control failings or weaknesses; tracking of remediation actions. | "Have any material controls failed in the period, and are we satisfied with the response?" |
| Declaration drafting | Draft declaration text, challenge from the chair or committee, and linkage to the supporting evidence. | "Who drafted the declaration, and what challenge has it received?" |
| Comply-or-explain quality | Narrative explaining governance outcomes, not just process descriptions; disclosure of how materiality was determined. | "Does our reporting explain what we did and why, or only what the Code requires?" |
These questions are not exhaustive. They reflect the governance issues the FRC has highlighted: judgement on materiality, linkage to risk, quality of assurance, and substance of board oversight.
How does Provision 29 change NED responsibilities?
Provision 29 does not create new legal duties for directors. The Companies Act 2006 already requires directors to exercise reasonable care, skill and diligence. The duty to understand the company's internal controls and risk management is not new.
What Provision 29 does is formalise the board's role in overseeing material controls and require a public declaration. That declaration creates a personal accountability point for each director. The question a NED should be able to answer is: "On what basis am I satisfied that this declaration is fair?"
The Financial Reporting Council's Guidance suggests the board may consider the design and operation of the framework, risk appetite, principal and emerging risks, quality of management monitoring, escalation of significant issues, and actions taken to improve ineffective material controls. These are the same areas a NED should probe.
For audit committee chairs, Provision 29 reinforces the committee's role in overseeing the internal control framework. The committee should:
- Receive regular reports on material control exceptions.
- Review the internal audit plan and its coverage of material controls.
- Challenge management's assessment of materiality.
- Ensure the board's annual review is properly documented.
For NEDs without a committee role, the due diligence is no less important. The declaration is a board declaration, not a committee one. Every director should understand the basis for it.
What should NEDs look for when joining a board?
For NEDs considering a board appointment, the due diligence question is: "Is this board ready to make a Provision 29 declaration?"
Questions to explore in the recruitment process include:
- "Has the board identified its material controls, and is there a clear methodology?"
- "What assurance does the board receive on the design and operating effectiveness of those controls?"
- "When did the board last review the internal control framework, and what was the outcome?"
- "Have any material controls failed in recent years, and how did the board respond?"
- "How will the company report on Provision 29, and who is drafting the declaration?"
These questions are not about statutory due diligence on the appointment. They are about whether the board has the governance infrastructure to support a Provision 29 declaration. A NED joining a board that has not thought through materiality, assurance and reporting is walking into a gap.
What role does internal audit play?
Internal audit is a primary source of assurance on internal controls, but Provision 29 does not mandate an internal audit function. Under Provision 26, where there is no internal audit function, the annual report should explain the absence, how internal assurance is achieved, and how this affects external audit.
Where internal audit exists, the board should consider whether:
- The internal audit plan covers material controls.
- Reports are provided to the audit committee on design and operating effectiveness.
- Recommendations are tracked to completion.
- The head of internal audit has direct access to the audit committee chair.
Where internal audit does not exist, the board should consider what alternative assurance sources are available, such as external audit, specialist reviews or management self-assessment. The FRC's Guidance is clear that the board may use reports from management, internal audit, external auditors or other assurance providers. The key is that the board has a basis for its judgement.
How should boards approach the declaration?
The declaration is a statement of fact: material controls were effective (or not) as at the balance sheet date. The challenge for boards is ensuring that the declaration is supported by evidence.
The FRC's March 2026 report on comply-or-explain reporting emphasises that high-quality reporting explains governance outcomes, not just processes. Boards should avoid generic statements such as "the company has a robust system of internal control" without supporting narrative.
A defensible declaration should be able to answer:
- Who determined which controls are material and on what basis?
- How does the board monitor those controls throughout the year?
- What assurance did the board receive on their effectiveness?
- What judgements did the board make in the annual review?
- Where controls failed, what actions were taken?
NEDs should be asking for sight of the evidence behind the declaration, not just the final wording.
What happens if a NED is not satisfied?
If a NED is not satisfied that the board has adequate evidence to support the Provision 29 declaration, the options include:
- Raising concerns with the audit committee chair or board chair.
- Requesting additional assurance or analysis before the declaration is finalised.
- Asking for the concern to be minuted.
- In extreme cases, considering whether to continue serving on the board.
The declaration is a collective board responsibility, but individual directors can still protect the quality of their own decision-making. A NED who has raised concerns, asked for additional evidence and ensured the concern is minuted is better placed to show that they exercised reasonable care, skill and diligence.
How can NEDs organise evidence across multiple boards?
For NEDs serving on multiple boards, the challenge is tracking material control evidence, risk register updates, and committee minutes across different companies and reporting cycles.
This is where organised document management becomes relevant. meetinginsight.ai is a local AI tool that allows NEDs to import board papers, ask questions of the documents, and generate meeting briefings — all without sending data to external servers. For Provision 29, that means being able to:
- Import the board's material control paper and ask: "What methodology did the board use to determine material controls?"
- Import committee minutes and ask: "What exceptions were reported to the audit committee?"
- Import the draft declaration and check it against the supporting papers.
The tool is a preparation aid, not a governance shortcut. It does not replace the NED's judgement, but it can help organise the evidence a director needs to exercise that judgement.
Summary
Provision 29 requires boards to monitor and annually review the effectiveness of material internal controls, and to declare in the annual report whether those controls operated effectively as at the balance sheet date. For NEDs, the due diligence task is to understand the basis for that declaration — the methodology for determining materiality, the assurance on effectiveness, and the governance process behind the board's judgement. The FRC does not prescribe the number of material controls, does not require them to be listed in the annual report, and does not mandate external assurance. The regulator does expect boards to explain their governance process and outcomes, avoiding boilerplate language. NEDs should ask the questions that ensure the declaration is supported by evidence, not just process.