Provision 29: Does Your Governance Team Have the Capacity to Deliver?

Provision 29 of the UK Corporate Governance Code requires boards applying the Code to report on the effectiveness of their material internal controls. For financial years beginning on or after 1 January 2026, that includes a declaration of effectiveness at the balance sheet date.

A great deal of preparation is rightly going into controls, testing and assurance. There is also a practical question for employers: can the people responsible for bringing information to the board deliver the work alongside the existing governance calendar?

Provision 29 does not automatically create a vacancy, and the Company Secretary does not become responsible for every control. But it may expose gaps in coordination, board reporting, available expertise or cover that the current team cannot comfortably absorb.

Provision 29 at a Glance

Question	Practical answer
Who is affected?	Companies applying the UK Corporate Governance Code, including relevant FCA-listed companies. The Code operates on an apply-the-Principles and comply-or-explain basis.
When does the revised provision apply?	Financial years beginning on or after 1 January 2026; first reporting generally from 2027 for December year-end companies.
What must the board report?	How it monitored and reviewed the framework, its declaration on material controls at the balance sheet date, and any ineffective material controls and proposed action.
Which controls?	Those the board considers material, including financial, operational, reporting and compliance controls.
Who remains accountable?	The board for oversight and its declaration; management and control owners for operating controls.
Is recruitment compulsory?	No. Resourcing decisions depend on demonstrated capacity, capability and coordination needs.

What Does Provision 29 Actually Require?

The revised UK Corporate Governance Code asks the board to monitor the risk management and internal control framework and review its effectiveness at least annually. The monitoring and review should cover all material controls.

The annual report should contain three things:

• A description of how the board monitored and reviewed the effectiveness of the framework.
• A declaration of the effectiveness of material controls as at the balance sheet date.
• A description of any material controls that were not operating effectively at that date, together with action taken or proposed to improve them.

The board determines what counts as material in the context of the company’s risks, business model and complexity. The FRC does not prescribe a controls framework or expect businesses to publish every individual control or test.

That distinction matters. The declaration concerns material controls at a particular date, but it must be supported by a credible monitoring and review process during the year. A polished paragraph written at the end of the reporting cycle is no substitute for that evidence.

Why This Becomes a Governance-Capacity Question

A company can have competent risk, finance and internal audit teams and still struggle to bring their work together for the board. Evidence may sit across several systems, committees may meet to different timetables, and unresolved weaknesses need to be followed through before the annual report is signed off.

The practical workload often includes:

• Agreeing the material-controls timetable and who supplies each part of the evidence.
• Coordinating risk, finance, operations, compliance and assurance input.
• Tracking control weaknesses, remediation, decisions and outstanding questions.
• Giving audit or risk committees enough time to review information before it reaches the board.
• Preparing clear papers that distinguish management conclusions from matters requiring board judgement.
• Recording challenge, approvals and follow-up in minutes and action logs.
• Aligning governance disclosures with the wider annual report.
• Maintaining continuity when a key member of the team is unavailable.

The company secretariat is often close to this work because it supports the board process. That does not make it the control owner. If the team is expected to coordinate more reporting, papers and follow-up, the additional workload needs to be recognised rather than quietly added to an already full calendar.

Who Should Own the Work?

There is no universal operating model. Boards retain responsibility for their oversight and declaration; management is responsible for controls within the business. Audit or risk committees will often examine the detail before making recommendations to the board.

Function	Typical contribution
Board	Reviews the evidence, challenges conclusions and approves the annual report disclosure.
Audit or risk committee	Examines the framework, assurance, deficiencies and remediation, and reports to the board.
Management and control owners	Design, operate, monitor and remediate controls across the business.
Risk, compliance and internal audit	Provide specialist risk assessment, monitoring, testing or assurance within their respective mandates.
Finance and reporting	Support reporting controls, financial information and annual-report coordination.
Company secretariat	Coordinates board and committee activity, papers, decisions, records and follow-up.
External specialists	Provide targeted technical support or independent assurance where the company chooses to use it.

Before asking a governance professional to “own Provision 29”, employers should specify which of those activities they mean. Coordinating committee papers is a different assignment from testing the operating effectiveness of controls.

Where Governance Teams Come Under Pressure

Provision 29 preparation rarely arrives on an empty desk. The same people may already be dealing with board cycles, subsidiary governance, transactions, annual reporting, AGM work and routine statutory matters.

Warning signs include:

• Nobody has authority to coordinate the full reporting timetable.
• Evidence arrives late or needs repeatedly reworking for committee review.
• Responsibilities between risk, finance, internal audit and the secretariat remain unclear.
• Control weaknesses and remediation commitments are tracked in different places.
• The board receives conclusions without a clear record of how they were reached.
• Regular governance work is delayed to accommodate the new programme.
• The process relies heavily on one person with little credible cover.
• Technical controls expertise is missing, even though the governance team can coordinate the meetings.
• No dry run has tested whether the reporting process works before the first declaration.

An isolated weak point may be fixed through clearer ownership or better planning. Several of these signs together justify examining the structure, available capacity and specialist support. Our guide to company secretarial team structure explains how to distinguish volume of work, capability gaps and continuity risk.

Check Your Provision 29 Governance Capacity

The assessment below is designed to help an employer identify pressure points in ownership, board process, evidence, technical expertise and available time. It is a resourcing conversation starter, not an assurance opinion or a test of compliance with the Code.

Interactive employer assessment

Provision 29 Governance Capacity Check

Answer 12 questions to identify possible gaps in ownership, board process, evidence and governance capacity. It normally takes three minutes.

✓Your answers remain in this browser. They are not submitted to or stored by Ingen Partners.

Section 1 of 4 25%

Please answer every question in this section before continuing.

Ownership and Coordination

Establish whether somebody can see and coordinate the complete process.

1. Is one named person responsible for coordinating the complete Provision 29 timetable?

Yes Partly No Not sure

2. Are responsibilities across management, finance, risk, internal audit and the company secretariat documented?

Yes Partly No Not sure

3. Does the coordinator have sufficient authority, access and senior sponsorship to obtain information and escalate concerns?

Yes Partly No Not sure

Continue

A result indicating pressure should prompt a closer look at the underlying work. It does not, on its own, mean that another permanent employee is required.

What Kind of Additional Support Might Help?

The right appointment depends on what is missing. A senior governance professional may be exactly what the board needs, but not if the real gap is specialist controls testing.

What needs to be delivered	Potential response
Senior board-facing governance support or short-notice cover	Interim Company Secretary or Deputy Company Secretary
Coordination across functions, committees and deadlines	Governance Manager or experienced governance programme lead
Evidence collection, calendars, actions and documentation	Governance project or programme support
Controls mapping, testing, risk assessment or remediation	Internal controls, risk or assurance specialist
An enduring increase in governance workload	Permanent governance or company secretarial appointment
A defined reporting peak or uncertain longer-term need	Interim, fixed-term or project-based support

An interim can protect the reporting timetable while an employer decides whether the requirement will continue after the first declaration. For more on defining such an assignment, see our Interim Company Secretary hiring guide.

A permanent role makes more sense where responsibilities have increased for good, the governance function was already close to capacity, or the business has outgrown its existing structure. In some cases the answer will be to improve coordination rather than recruit.

How to Brief a Provision 29-Related Appointment

“Provision 29 support” is not a complete job brief. It tells a candidate very little about the work, seniority or authority involved.

Before going to market, establish:

• Where preparation stands: the reporting year, key deadlines and any work already completed.
• What is not being delivered: board coordination, controls expertise, reporting, evidence management or ordinary governance work displaced by the programme.
• Who already owns what: the division of responsibility between management, finance, risk, internal audit, legal and the secretariat.
• What the individual will produce: timetables, committee papers, decision records, remediation logs, technical assessments or other agreed outputs.
• Authority and access: the committees, executives and control owners they can work with, and matters they can escalate.
• Other demands: the existing board calendar, annual reporting and business-as-usual requirements that must continue.
• Duration and success measures: immediate milestones and what good performance would look like after three, six and twelve months.

A Company Secretary with strong board judgement may be the right person to improve governance coordination. That does not make them an internal controls specialist. Equally, someone who can design and test controls may not have the experience to advise the Chair or manage the governance process surrounding board decisions.

Our corporate governance recruitment guide covers the wider choices around seniority, essential experience and how to approach the candidate market.

Avoid Leaving the Board Process Until Year-End

The board needs reliable information throughout the year, not a bundle of retrospective explanations assembled shortly before the annual report is approved.

The FRC’s Corporate Governance Code Guidance makes clear that boards should undertake their own monitoring using reporting from management and relevant assurance functions, rather than relying solely on the company’s embedded monitoring processes.

For the governance team, this means protecting sufficient time for committee scrutiny, making it clear when decisions are needed, recording challenge and ensuring remediation commitments return to the board when appropriate. Where evidence is incomplete, that issue needs to be visible early enough for management and the board to respond.

Provision 29 does not mandate external assurance of material controls. The board and management must decide what level of assurance is appropriate. The statutory auditor’s opinion on the financial statements does not extend to the Provision 29 declaration.

Build Capacity That Lasts Beyond the First Declaration

Most organisations do not need a large new Provision 29 team. They need proportionate responsibilities, dependable evidence, clear routes to the board and enough skilled people to keep the process working alongside other priorities.

For some employers, a better timetable and clearer ownership will be sufficient. Others may need additional governance capacity, an interim appointment or specialist controls and assurance expertise. The useful starting point is an honest assessment of which work is falling short and why.

Ingen Partners supports employers with permanent, interim and senior company secretarial and governance recruitment. If the evidence points to a governance staffing requirement, our Company Secretarial and Governance Recruitment service can help define the role and identify suitable professionals.

Provision 29 Frequently Asked Questions