What do boards expect to declare under Provision 29?

With first declarations at least a year away, unsurprisingly few of the audit committee chairs interviewed could speak to their precise contents as the details of the declaration are still being worked out. 

The Financial Reporting Council (FRC) has also deliberately avoided giving detailed guidance or templates. Jock Lennox, Board Chair at Johnson Service Group, supports that overall approach, but believes that, “To set expectations, there should be some example of what this should or shouldn’t look like.”

Others are more phlegmatic. “It is encouraging that the FRC is not expecting ‘one size fits all’,” says Doug Webb, Audit Committee Chair at Johnson Matthey and United Utilities audit committee member. “If another company in the same sector does it a different way, it doesn’t mean either of you are wrong. But it would be good in a year or two to see if you can learn anything from what others have done.” 

There is generally value in following developing practice, another audit committee chair says, with external auditors also having a valuable perspective. But the key is to remember what the declaration is ultimately for: to give stakeholders confidence that the board is satisfied with the control framework. 

With that in mind, there are nonetheless a few key questions to consider as the declaration gets closer.

How long should the declaration be?

Some lean towards minimalism. “The annual report is already far too cumbersome, and the more cumbersome it becomes the less useful it is. This is about whether we are comfortable as responsible custodians of the company to say that things are in control. I’d veer away from detailed reporting of any small deviation unless it is material to an overall judgement about the control environment,” says John Ramsay, Audit Committee Chair at Babcock.

Byron Grote, Audit Committee Chair at IHG, says there’s a balance to be struck: “I don’t think it would be few sentences, but I don't think it'd be 10 pages, either. I believe it'll be relatively short, but it needs enough to provide the reader with an understanding of the process you've gone through.”

At United Utilities, Webb explains how the company has tested the water in its 2025 Annual Report, with two pages outlining 13 principal risks, their material controls, and the governance assurance structures around them. 

“The feedback from the FRC was that that felt about right. They don’t want pages and pages on each control. The declaration may not necessarily list each material control but gives a flavour of the controls and the assurance around them,” Webb says. 

At what point can you say a risk is adequately controlled?

Sarbanes-Oxley reporting on controls defines what counts as material weaknesses that must be declared, but the same can’t be said of Provision 29. “There isn’t that same black and white about what is a clean certification and what isn’t,” one audit committee chair says. 

Most boards will have colour-coded dashboards showing which controls are certified as operating properly, and most will show up green. However, “If it’s 100% green, you’re not testing properly. So, the question is, how many reds and ambers can you have before you need to start qualifying your statement? Where do you draw the line?”

Qualifying a statement about the effectiveness of a control will likely draw unwanted attention, but boards have a duty towards transparency and it is not as straightforward as picking a numerical threshold, the audit committee chair adds, not least because some material controls are more material than others. When issues arise, it requires the board’s judgment and a process for discussion that doesn’t solely rely on quantitative measures.

How do we ensure Provision 29 doesn’t turn into a tickbox exercise?

In the first article of this series, we heard concerns that Provision 29 might devolve into a laborious compliance exercise, despite the explicit intent to the contrary. 

This may become more likely over the years as the certification and declaration process becomes routine, with the risk that boards fail to update their frameworks even as circumstances change. 

To prevent this, it’s important to bake in regular audit committee reviews – several suggested twice a year – and to keep asking challenging questions, so that it remains a ‘living’ document.

“There’s always the possibility that issues will come up during the year, when you decide you need to add a control that you believe is material. Just because issues are easily identifiable on 1st January it doesn’t mean the same issues are there on 31st December. It’s important that there are periodic reviews and ongoing questions into whether the controls are adequate,” Grote explains.

The level of ongoing vigilance may depend on what happens the first time a listed company fails or suffers a drastic setback because it wasn’t adequately controlled after the board declared it was. 

It is unlikely that an FRC investigation around Provision 29 will be the board’s main concern, says Andrew Kemp, Audit Committee Chair at The Berkeley Group and Chair of Audit Committee Chairs’ Independent Forum (ACCIF). The shareholders will demand answers, and “there will be other things the company in question did wrong that the FRC will be more interested in,” Kemp explains.

Provision 29 declarations therefore shouldn’t be seen as a way to cover the board from liability, but as part of a process to protect and strengthen the company. 

“The detail of the declaration is relatively low value,” Kemp says. “I don’t think investors will get comfort from a public statement. They’ll get comfort in knowing that this has been done properly and that the board has really thought about its control processes.”