error
Subscriptions are not available for this site while you are logged into your current account.
close
Skip to main content
Submit RFP

      What challenges are you facing right now?

      As a board member, audit committee chair or risk leader, demonstrating confidence in your organisation's internal controls has never been more important.

      Under Provision 29 of the UK Corporate Governance Code, companies must be ready for the enhanced requirements of Provision 29. Premium listed companies must provide a declaration on the effectiveness of their risk management and internal control framework.

      The revised requirements apply to accounting periods beginning on or after 1 January 2026, making now the time to assess whether your governance, controls and assurance arrangements are fit for purpose.

      What is Provision 29?

      In UK law, “Provision 29” refers not to statutory legislation but to a specific provision of the UK Corporate Governance Code – the set of principals and standards for good boardroom practice in listed companies. In its updated form, Provision 29 introduces enhanced expectations regarding internal controls and board-level reporting.

      Who does Provision 29 apply to?

      Provision 29 applies to companies that report against the UK Corporate Governance Code, including UK-listed companies within the Code's scope.

      While the requirement is aimed at the board, its impact extends across the organisation to all teams playing a role in generating the evidence and assurance needed to support the board's assessment.

      This includes teams working in:

      • Finance
      • Risk
      • Internal audit
      • Compliance
      • Operations

      Even companies not directly within the scope of the Code are increasingly looking to align with Provision 29 as a recognised benchmark for strong corporate governance, effective controls and stakeholder confidence.

      What are the key Provision 29 requirements?

      Provision 29 raises the bar for board accountability over risk management and internal controls. Rather than simply describing their approach, boards will need to demonstrate how they have assessed the effectiveness of their framework and provide a clear declaration in the annual report.

      To comply with Provision 29, boards must:

      • Monitor and review the effectiveness of the risk management and internal control framework throughout the reporting period.
      • Carry out an annual assessment of the effectiveness of the framework, covering financial, operational, reporting and compliance controls.
      • Provide a declaration in the annual report stating whether the material controls operated effectively as at the balance sheet date.
      • Describe the approach taken to monitoring and reviewing controls, including the process used to support the board's assessment.
      • Disclose any material controls that have not operated effectively, together with the actions being taken to address identified weaknesses.
      • Maintain sufficient evidence and assurance to support the board's conclusions and demonstrate confidence in its declaration.

      For many organisations, compliance will require more than a year-end review. Boards will need access to reliable information on the design, operation and performance of controls throughout the year, supported by robust governance, testing, documentation and assurance activities.

      As a result, finance, risk, compliance and internal audit teams are likely to play a critical role in helping boards meet the requirements and support effective decision-making.

      How KPMG can help with Provision 29

      Preparing for Provision 29 requires a coordinated approach across governance, risk, controls and assurance. Our multidisciplinary teams can help you assess readiness, close gaps and build confidence in your compliance journey:

      Strengthen financial control frameworks, enhance documentation and testing, and improve management reporting to provide the evidence and assurance needed to support the board's annual declaration.

      Learn more

      Assess and enhance your risk and compliance frameworks, ensuring key risks, controls, assurance and monitoring are aligned to Provision 29. Identify gaps, strengthen governance and support robust oversight to meet evolving regulatory expectations.

      Learn more

      Provide independent assurance over the design and effectiveness of controls, helping boards build confidence in their assessment process and identify opportunities for improvement.

      Learn more

      Review operational controls across critical business processes, helping to embed accountability, improve control effectiveness and generate evidence to support board reporting and decision-making.

      Learn more

      Related services and support for Provision 29

      The UK has an updated version of its Corporate Governance Code which, under Provision 29, introduced a new board level declaration on material controls effectiveness.

      Our latest thinking is shown below:

      Be the competition that others want to beat — with outcome-driven functional transformation made possible by KPMG Powered Enterprise.
      Read more

      How can you transform your finance function to deliver efficiency, insight and value to the organisation?
      Read more

      Provision 29 FAQs

      • Provision 28 of the 2024 Code explicitly calls out emerging risks when compared to its previous version in 2018. The change here calls for enhanced review and reporting of emerging risks and corresponding controls to mitigate those risks.
      • The changes to controls also signal the Board to include within it’s annual reporting, a description of - (a) how the Board has monitored and reviewed the effectiveness of the control framework, (b) declare the effectiveness of the material controls, and (c) disclose any material controls considered not to be operating effectively, with the actions taken or proposed to improve them and any actions taken to address previously reported material control lapses/gaps.

      • Controls are processes, policies, procedures, practices, or mechanisms (whether entity level, manual/management review, automated, and IT dependent) implemented by a company to ensure that set business objectives are met. This is the entirety of controls in a company.
      • Whereas key controls, which is a subset of controls, are deemed critical to the sustenance of the company’s core operations and long-term business objectives and model.
      • While the FRC does not provided a specific definition, in general material controls are a chosen set of key controls that are designed to address material risks that impact the long-term sustainability of company’s business model and is approved by the Board. A material control may consist of one or more key controls (i.e., they operate in aggregate to avert the material risk) and in control nature could be an ELC, MRC, or set of controls which are manual and IT dependent or automated.
      • Note that the “effectiveness declaration” required in the revised Provision 29 of the Code is for weaknesses noted in material controls.

      • The FRC does not dictate a single definition of material controls, instead it provides views on material controls across multiple publications.
      • KPMG recommends that Boards consider views published by the FRC and establish their own definition of material controls, which will consequently set out the actions necessary to make the declarations of effectiveness.

      Three key steps will provide the Board comfort over the “effectiveness declaration”

      1. A sound enterprise risk management process which continuously surveys and identifies internal and external risks.
      2. A sound internal control.
      3. A Board approved industry standardised internal control framework to provide the Board confidence on control coverage and optimisation.

      Our people

      Nehal Jilka

      Partner - Controls & Technology Risk Leader

      KPMG in the UK

      Sarah Ward

      Partner - Risk & Regulatory

      KPMG in the UK

      Marina Krumbholz

      Partner, Technology Risk

      KPMG in the UK

      MTD

      Get in touch

      Discover why organisations across the UK trust KPMG to make the difference and how we can help you to do the same.

      Contact us