error
Subscriptions are not available for this site while you are logged into your current account.
close
Skip to main content
Submit RFP

      What Boards need to get right

      As Boards prepare for their first disclosure on material controls under Provision 29, many are still questioning what good looks like, what their focus should be and what disclosure wording will look like across peers.

      The code update is not simply a reporting change; it is intended to strengthen Board ownership of risk management and internal controls. This means that Boards will need to evidence how they have monitored and reviewed the effectiveness of internal controls through the year to support the point in time disclosure.

      While firms have focused on preparing for the 2026 requirements, Boards should consider draft wording and activities they will perform to allow them to disclose with confidence.

      Sarah Ward

      Partner - Risk & Regulatory

      KPMG in the UK

      Evolving areas of Board challenge

      There are several practical implementation challenges critical to delivering a robust declaration:

      How should we define material controls?
      • Boards must define a robust and repeatable methodology for identifying the controls most critical to managing their most material risk.
      • There is no prescribed number of material controls. The appropriate population is organisation-specific and should reflect the company's risk profile and governance arrangements. Organisations must determine the appropriate balance between entity-level, process-level and risk-specific controls.
      • Ask yourself: Is there agreement to this population, is it largely static to allow for effective assessment and do strong processes exist to monitor performance?
      What is appropriate level of evidence?
      • Boards need confidence that the evidence supporting the declaration is robust and defensible, while ensuring declaration focuses on the basis for the conclusion rather than the underlying evidence.
      • Ask yourself: Are we clear what evidence we will receive across 3LoD to support the disclosure and the timing of this evidence?
      What are the timelines for assurance requirements?
      • The role of management testing, internal Audit and external assurance in testing material controls need to be clearly defined.
      • Management should consider the extent to which they will rely on assurance for the control effectiveness statement required. Provision 29 does not require external assurance, although organisations may choose to obtain assurance over selected elements.
      • Ask yourself: Do our timelines for assurance procedures allow for early warning of potential material errors and are they sustainable?
      What is the level of disclosure required?
      • Disclosures need to meet the Code’s expectations while remaining accurate, transparent and aligned with investors’ interests.
      • Ask yourself: Is the wording sufficient to evidence how the board has discharged their responsibilities?
      • The disclosure is proposed to be prepared in a high-level, thematic narrative style. Rather than listing individual material controls, firms are expected to provide a high-level description of how it has arrived at a population of material controls. The FRC advised that in most cases, they expect the report to be no longer than two pages recognising the importance that reporting remains proportionate and concise.
      • Material controls would only be specifically identified if they have not operated effectively and additional detail on planned remediation is required.
      Where should the disclosures be in the annual report?
      • The Code does not prescribe where the disclosure should appear, although the risk management and internal control report is the most likely location. Board ownership should be clear with many firms including details in the Board/Chair report in 2025, with monitoring responsibilities and supporting detail typically reflected in the Audit Committee report.
      • Relevant sections, including reports from the CFO, CRO, Board Risk Committee, Internal Audit and Group Audit Committee, are expected to have cross-reference the disclosure to strengthen coherence and accountability.

      How should we define material controls?

      • Boards must define a robust and repeatable methodology for identifying the controls most critical to managing their most material risk.
      • There is no prescribed number of material controls. The appropriate population is organisation-specific and should reflect the company's risk profile and governance arrangements. Organisations must determine the appropriate balance between entity-level, process-level and risk-specific controls.
      • Ask yourself: Is there agreement to this population, is it largely static to allow for effective assessment and do strong processes exist to monitor performance?

      What is appropriate level of evidence?

      • Boards need confidence that the evidence supporting the declaration is robust and defensible, while ensuring declaration focuses on the basis for the conclusion rather than the underlying evidence.
      • Ask yourself: Are we clear what evidence we will receive across 3LoD to support the disclosure and the timing of this evidence?

      What are the timelines for assurance requirements?

      • The role of management testing, internal Audit and external assurance in testing material controls need to be clearly defined.
      • Management should consider the extent to which they will rely on assurance for the control effectiveness statement required. Provision 29 does not require external assurance, although organisations may choose to obtain assurance over selected elements.
      • Ask yourself: Do our timelines for assurance procedures allow for early warning of potential material errors and are they sustainable?

      What is the level of disclosure required?

      • Disclosures need to meet the Code’s expectations while remaining accurate, transparent and aligned with investors’ interests.
      • Ask yourself: Is the wording sufficient to evidence how the board has discharged their responsibilities?
      • The disclosure is proposed to be prepared in a high-level, thematic narrative style. Rather than listing individual material controls, firms are expected to provide a high-level description of how it has arrived at a population of material controls. The FRC advised that in most cases, they expect the report to be no longer than two pages recognising the importance that reporting remains proportionate and concise.
      • Material controls would only be specifically identified if they have not operated effectively and additional detail on planned remediation is required.

      Where should the disclosures be in the annual report?

      • The Code does not prescribe where the disclosure should appear, although the risk management and internal control report is the most likely location. Board ownership should be clear with many firms including details in the Board/Chair report in 2025, with monitoring responsibilities and supporting detail typically reflected in the Audit Committee report.
      • Relevant sections, including reports from the CFO, CRO, Board Risk Committee, Internal Audit and Group Audit Committee, are expected to have cross-reference the disclosure to strengthen coherence and accountability.

      What good looks like for 2026

      The below proforma gives an illustration on wording to support the disclosure of Material Controls effectiveness in line with Provision 29. As a guidance, the disclosure should include details of (1) the scope, (2) review and assurance activities, (3) governance oversight responsibility and (4) the Board’s conclusion including declaration. Disclaimer wording is illustrative only rather than preferred wording.

      Guidance:

      The Board should clearly articulate the scope of material controls included within its annual effectiveness review and declaration, in line with Provision 29.

      Example:

      “The Group applies Provision 29 of the UK Corporate Governance Code in relation to internal controls. In adherence with these requirements, the Board carries out a review of the most Material Controls within the Group and makes a declaration of their effectiveness, including any which have not been designed or operated effectively in the year, and the action taken or planned to remediate such controls. Material Controls relates to Operational, Compliance, Financial and Reporting control types.”

      Guidance:

      The Board should highlight how the organisation performs the review and assurance activities over material controls.

      Example:

      “The Board is responsible for the Group’s risk management and internal control framework and carrying out a review of its effectiveness. This includes determining the level and type of risks the Group is willing to take in achieving its strategic objectives, as expressed through the Group’s risk appetite.”

      Guidance:

      The Board should provide a summary of how it has monitored and maintained robust oversight of material controls during the reporting period.

      Example:

      “To support the discharge of the Board’s obligations, the Board Risk Committee and Group Audit Committee are responsible for oversight of the effectiveness of all internal controls, including those identified as ‘Material Controls’. This includes monitoring and reviewing the effectiveness of the framework as well as the effectiveness of Material Controls.”

      Guidance:

      The Board is required to provide a declaration of effectiveness of material controls at the balance sheet date, and a description of any material controls which have not operated effectively as at the balance sheet date, the action taken, or proposed, to improve them and any action taken to address previously reported issues.

      Example:

      Scenario A: Declaration of effectiveness with no disclosable items

      “The Board has assessed the effectiveness of the Material Controls for the period ending 31 December 2026 and has determined that, as at the balance sheet date, the Material Controls, associated controls framework and systems of internal control were sufficiently designed and operating effectively to mitigate the principal risks of the Group.”

      Scenario B: Disclosure of ineffective material control

      “The Board has assessed the effectiveness of the Material Controls for the period ending 31 December 2026 and has determined that as at the balance sheet date, the material controls, associated controls framework and systems of internal control were sufficiently designed and operating effectively to mitigate the principal risks of the Group, except for in respect of [insert ineffective material control]. The Group has a defined control framework to address the risks of this control. The criticality of effective internal control to the long-term sustainability of the Group means our most important [insert ineffective material control] controls collectively are considered a Material Control. During the period, instances have been reported where our [insert ineffective material control] controls have not always operated effectively and we have taken steps to address this, with focused remediation. We have also strengthened the design and scope of the [insert ineffective material control] controls during the period and invested in the sustainable implementation and embedding of these enhancements. This will remain a focus during the year ahead.”

      Scenario C: Continued area of focus and enhancement to be disclosed

      “The Board has assessed the effectiveness of the material controls for the period ending 31 December 2026 and has determined that, as at the balance sheet date, the Material Controls, associated controls framework and systems of internal control were sufficiently designed and operating effectively to mitigate the principal risks of the Group.

      The Board continues to monitor emerging risks. Like other organisations, we operate in an extensive and complex environment. We need to remain resilient in order to support customers, colleagues and stakeholders globally. Throughout the year we have overseen a programme of improvement to further strengthen our [focus area] controls and help reduce the likelihood and impact of risks relevant to that focus area. We continue to enhance our [relevant processes or systems] and are focused on transforming how [relevant activities or processes] are developed, delivered, maintained and tested as part of our investment in the Group’s broader capability. This will remain an area of focus and improvement into 2027.”

      What Boards should focus on now

      With the first year of Provision 29 reporting approaching, Boards should now be focusing on ensuring the governance and challenge processes underpinning the review of material controls are effective and capable of supporting a robust and defensible declaration of control effectiveness.

      forum

      Understand the framework

      • Confirm Board’s and Committees’ understanding of the scope and coverage of material controls, do they align to the principal risks of the business and are you confident of coverage?
      • Clarify assurance and governance responsibilities and the Board’s role in reviewing, challenging and concluding on control effectiveness.
      handshake

      Identify current issues

      • Stakeholders should be clear what the threshold of disclosure is and any weaknesses that may threaten these.
      • Identify any evidence gaps, control weaknesses and remediation actions requiring prioritisation before year-end.
      • Resolve any gaps that could undermine the declaration.
      assignment_turned_in

      Draft and challenge early

      • Prepare a meaningful draft disclosure before year-end reporting pressure builds.
      • Test-run the approval and governance processes with the draft wording.
      • Ensure the Board and Audit Committee have sufficient information to support the declaration.
      group

      Plan for post-year-end events

      Establish a defined process for assessing post year-end events and determining whether they provide evidence of a material control weakness that existed at the balance sheet date. This should include consideration of whether the issue was known or emerging during the reporting period, its impact on the effectiveness declaration, and whether additional disclosure or remediation is required.

      Frequently Asked Questions (FAQs)

      Provision 29 requires a declaration on the effectiveness and/or ineffectiveness of material controls. However, we are not expecting companies to publish a full list of material controls with individual effectiveness ratings. Rather, companies are expected to perform a review of their material controls and assess whether any material weaknesses exist to inform a declaration.

      To support this, many organisations have defined a population of material controls that form the basis of their review, assurance activities and Board oversight. Where weaknesses are identified, companies should consider the severity, any mitigating controls in place, and the overall impact on the effectiveness conclusion.

      Provision 29 requires companies to disclose any material controls that have not operated effectively, including a description of the weakness, planned or delivered actions to remediate the issue, and status of any previously reported weaknesses. 

      Emerging risks and areas of heightened focus are already commonly addressed within annual reports and risk disclosures. In recent years, this included topics such as geopolitical risks, cyber security, operational resilience, climate-related risks and AI.

      The introduction of Provision 29 is not expected to change how organisations highlight these risks. Rather, it requires Boards to assess whether material controls mitigating these risk areas are operating effectively (leveraging existing risk and control management process and materiality criteria).

      While similar themes might emerge across industries, we are not expecting a common disclosure across organisations as each company will need to consider its own control environment, assurance and effectiveness conclusions when determining its disclosure. An area of continued focus as risks evolve does not in itself represent a material weakness.

      Each company is expected to establish a materiality framework that supports both the identification of material controls and the assessment of whether a control weakness may be material.

      In most cases, and our expectation of leading practice, this builds on existing risk management processes and methodologies, including risk prioritisation matrix (or similar).

      Considerations may include impacts on financial performance, solvency, liquidity, operational resilience, regulatory compliance, reputation, and the sustainability of the company's business model. In practice this will be unique to each organisation with no “one size fits all” approach but should be consistent with the way the organisation continues to measure and monitor risk.

      Companies are expected to meet the disclosure requirements of Provision 29 and provide transparent reporting where material control weaknesses exist.

      Where a company believes it is unable to provide a disclosure in the manner envisaged by the Code, it would need to explain its approach in line with the Code's "comply or explain" framework.

      In practice, firms are expected to disclose the existence of a material weakness if one exists. The level of detail provided in the disclosure is not expected to be at an operational level that may increase the risk of a weakness being exploited.

      Under current auditing standards the external auditor is not required to provide a formal opinion on the effectiveness of the company's internal control framework or the Board's Provision 29 effectiveness declaration.

      Instead, the declaration is expected to form part of the annual report.

      Companies are to ensure that their declaration is supported by robust governance, evidence and assurance activities that enable the Board to reach a reasonable conclusion on control effectiveness. In practice the code covers the most material controls within the organisation and so it is likely there will be some coverage of the controls tested by the external auditors. However, this can vary depending on the scope of the audit (including where companies are covered by SOx and/or ICFR requirements).

      If a material control weakness is identified close to the balance sheet date, Boards are expected to assess the nature, severity and duration of the issue, together with the effectiveness of any mitigating controls and remediation actions.

      The key consideration is whether the weakness impacts the Board's conclusion regarding effectiveness as at the balance sheet date. Where a material control has not operated effectively, Provision 29 requires disclosure of the weakness and associated remediation action. Ensuring there is clear understanding of the assessment criteria including scope, materiality thresholds, as well as roles and responsibilities, is important to help ensure these can be completed timely with a high degree of confidence. Some organisations have run “dry run” exercise, or plan to in Q4, to help ensure these are well understood. 

      The FRC have clarified that companies are expected to state the effectiveness of their material controls as per the balance sheet date. There is no requirement to revise your declaration if something later comes to light, nor any expectation that companies report on a material control failure if it has been rectified by the balance sheet date.

      Provision 29 requirements cover any material control weakness. This may include items self-identified through any activities across the 3LODs or by an external party. The Board should determine whether a deficiency represents a material control weakness in isolation or if it is indicative of a broader control weakness (this may include missing controls that are material to the organisation). This should then inform the effectiveness conclusion of a material control.

      Where a material control weakness is identified, Provision 29 requires disclosure of the weakness and the actions taken or planned to address it. We expect the effectiveness conclusions to be based on all available relevant sources of assurance, rather than the auditor's findings alone.

      We expect this to involve establishing a coordinated approach across the three lines of defence, with clear ownership, routine control monitoring, management attestations, assurance reviews and regular reporting on control performance.

      Many firms are also strengthening governance reporting to provide Boards with timely insights into material control effectiveness, emerging issues, remediation activities and areas requiring management attention. In many cases, firms have added/extended responsibilities to the Audit Committee to ensure broader coverage of controls (not only those over financial reporting).

      The objective is to create a continuous and evidence-based view of control effectiveness throughout the year, enabling the Board to support its Provision 29 declaration with confidence.

      We expect this to involve establishing a coordinated approach across the three lines of defence, with clear ownership, routine control monitoring, management attestations, assurance reviews and regular reporting on control performance.

      Many firms are also strengthening governance reporting to provide Boards with timely insights into material control effectiveness, emerging issues, remediation activities and areas requiring management attention. This includes additional testing with many companies deciding to independently test material controls on an annual basis.

      The objective is to create a continuous and evidence-based view of control effectiveness throughout the year, enabling the Board to support its Provision 29 declaration with confidence.

      Firms are considering assurance from a variety of sources, including internal audit. We are seeing many firms build integrated assurance maps to plan their material controls coverage and assimilate the findings of relevant internal audit work into the effectiveness assessment. Often audits are thematic in nature and may not align to the controls as defined, so there is often judgement needed in making the read across. Boards often note that internal audit provides a high quality source of assurance over the material controls and may expect a closer alignment in audit scope and material coverage over time given the material controls are likely to align to the highest priority areas from a risk perspective.

      How can KPMG help?

      Visit our UK SOX Insights page to learn how KPMG can support your organisation with UK SOX readiness, stronger internal controls, and enhanced governance.

      UK corporate governance code

      Sharing our latest thinking to inform your controls transformation
      Read more
      Team reviewing documents in office banner

      Our people

      Sarah Ward

      Partner - Risk & Regulatory

      KPMG in the UK

      Holly O'Neill

      Director

      KPMG in the UK

      Sam Worsley

      Director

      KPMG in the UK

      Our regulatory insights

      Something went wrong

      Oops!! Something went wrong, please try again
      MTD

      Get in touch

      Discover why organisations across the UK trust KPMG to make the difference and how we can help you to do the same.

      Contact us