Will Provision 29 prove valuable?

Provision 29 of the updated UK Corporate Governance Code requires boards to declare that they are satisfied their company has material controls in place to manage its principal risks. Since its announcement several years ago, there has been much discussion – if little detailed guidance – about the steps needed to prepare for the first declarations, which will feature in 2026 annual reports.

But how do boards see Provision 29? What decisions have they taken so far, and what debates are still to be settled? For this series of five articles, we interviewed members of the Audit Committee Chairs’ Independent Forum (ACCIF), a voice for FTSE 350 audit committee chairs, to find out.

We began by asking them about the state of play, and whether they think the process will ultimately prove valuable. 

A progress report

Our research shows boards at various stages of preparedness. All have decided their overall approach and principal risks. Some are currently defining material controls and matching them to risks; others have moved onto assurance mapping. In two cases, the process was near complete, with one audit committee chair saying, “we could make a declaration now, if push came to shove.”

Most non-executive involvement so far has been through the audit committee, rather than the full board. “My sense is that those detailed conversations with boards are yet to happen in the main,” says Andrew Kemp, Audit Committee Chair at The Berkeley Group and Irwin Mitchell, member of the audit committee at Spirax Group and Chair of ACCIF. 

He expects those conversations will happen in the first half of 2026, ahead of the first declarations in 2026 Annual Reports published early in 2027. 

Large, mature companies tend to be further along, particularly those already reporting under Sarbanes-Oxley (SOX) in the US. Most interviewees have direct experience with SOX and are acutely aware of its differences from Provision 29 – the former is rules-based and covers only financial controls; the latter is principles-based, and covers all types of control across operations, financial, compliance and reporting.

The same awareness cannot be assumed of other board members, however, especially if they don’t sit on audit committees.    

“If people are used to a SOX environment, they will probably assume this is something similar, until proven otherwise. Those who haven’t been involved with SOX really have nothing to compare this with,” explains Jock Lennox, Board Chair at Johnson Service Group and former audit committee chair of Barratt Redrow. 

Is Provision 29 good for business?

The SOX comparison highlights a key intended benefit of Provision 29. Both are designed to reduce the chances of corporate failure. Unlike SOX, though, Kemp says that “one of the inspired things about this regulation is that there isn’t boiler plate guidance” about how to define material controls, how many there should be, how to assure them or what to declare. This is important because even two similar businesses, with the same principal risks, can legitimately have different material controls. 

“The answers need to be generated by the board’s thinking, rather than applying a set of rules,” he says. 

All of our interviewees embrace this sentiment. “It has led to better debate about what our principal risks really are and how they could affect the company, as well as how we’re mitigating them,” says Mary Reilly, Audit Committee Chair at Essentra and Gemfields, and former audit committee chair at Mitie Group. 

There are operational benefits too, she adds, from formalising control frameworks: “Standardising processes across the organisation has brought a lot of commercial effectiveness and efficiency.”

BP Non-Executive Director Simon Henry, who was formerly audit committee chair at Rio Tinto, CFO of Shell, and a board member at Lloyds Banking Group, hopes Provision 29 will get some boards thinking about risk differently in general.    

“Companies outside the financial sector don't often have what I call quantified discussions on risk appetite,” Henry says. “Even if you don't have quantitative outcomes in terms of risk appetite, it’s important for a board to discuss where we’re comfortable.”

Pitfalls and potential

A positive outcome isn’t guaranteed. Henry points to unintended consequences that could arise if, despite the intention behind it, Provision 29 gradually turns into an “institutionalised, process-driven tickbox” exercise.

“There are quite a lot of people in the system whose risk appetite is nil, and their advice will always be to reduce your risk and have more controls. But that’s not how you should be running a business,” Henry says.

“It will take strong conviction from some boards to say, ‘No, our job is to run a business and to get rewarded for the risks we take.’ Just be clear and transparent about what those risks are, and accept that incidents happen, no matter how good your controls are. The important thing is to keep the risk outcomes within agreed risk appetite guard rails,” he adds.

Other interviewees anticipate less change. For Doug Webb, Audit Committee Chair at Johnson Matthey and member of the audit committee at United Utilities, Provision 29 merely encourages practices that well-controlled companies already follow. 

“It is getting everyone to the level at which the best companies are already operating. The process causes you to reflect, but has it caused us to make fundamental changes to how we’re running the business or thinking about controls? Not yet. It will, though, increase the visibility for the board as a whole to the specific material controls against the principal risks in a more structured way than has perhaps been done before,” Webb says.

Matthew Lester, Board Chair of Kier Group and Audit Committee Chair of ICG, believes that board-level reflection can make Provision 29 valuable, but only if it comes with the mindset that rigorous analysis of controls should improve rather than impede a business.

“I've found this whole journey illuminating. It’s aligned nicely with what we would have usefully done anyway, but it’s a good reality check of where we are versus where we might have hoped to be,” Lester says. 

Ultimately, Provision 29 will only be as useful as boards make it. Seen as another hoop to jump through, that’s all it will be. But seen as a genuine opportunity to refresh a board’s view of its control environment and whether its principal risks are still relevant, then it can be genuinely worth the time and effort.