Provision 29

The UK Corporate Governance Code now asks boards to declare, once a year, that their material internal controls are effective. Saying so is straightforward. Evidencing it is the hard part.

This is live now

Provision 29 applies to financial years beginning on or after 1 January 2026. A company on a calendar financial year is in its first affected year today, and will make its first declaration in the annual report published in 2027. The evidence that supports that declaration is being generated — or not — right now.

What Provision 29 asks for

Provision 29 of the UK Corporate Governance Code 2024 asks the board to monitor its risk management and internal control framework and, at least annually, review its effectiveness. The board then reports in the annual report, including a declaration of the effectiveness of the material controls as at the balance sheet date.

Two features of it matter more than the rest:

The Code operates on a comply or explain basis. A board that departs from Provision 29 discloses the departure, explains why, and says when it expects to comply. In practice, an explanation is read closely.

Timeline

January 2024 The FRC publishes the UK Corporate Governance Code 2024.
Financial years beginning on or after 1 January 2025 The rest of the 2024 Code takes effect.
Financial years beginning on or after 1 January 2026 Provision 29 takes effect, one year behind the rest of the Code.
2027 reporting season First declarations appear in annual reports.

Who it applies to

The Code applies to companies listed in the commercial companies category and the closed-ended investment funds category of the UK Official List, from the date of listing.

It reaches further than that in practice. Groups apply it below the listed parent, and private companies preparing for a listing, operating under the Wates Principles, or answering questions from an audit committee tend to be asked the same questions early.

The evidence problem

Most boards already have controls covering conduct and speaking up: a whistleblowing line, a code of conduct, a policy, mandatory training. What they frequently cannot produce on demand is evidence that those controls operated effectively across the year.

Absence of reports is not evidence of effectiveness. A speak-up channel that received nothing all year is ambiguous: it may mean nothing happened, or it may mean people did not trust it. A declaration resting on the first reading, when the second is true, is precisely the failure Provision 29 is aimed at.

The questions an audit committee will ask are practical ones. Did the channel work? Did people use it? What came in, and what happened next? How long did issues take to reach someone with authority? Were any themes recurring? Can we show the board saw them?

Where Heardsafe fits

Heardsafe is designed to make conduct and speak-up controls evidenceable rather than merely present.

What Provision 29 pushes onWhat the platform produces
Does the control operate? SafeVoice captures concerns confidentially and turns them into structured, timestamped records — usage data that shows a channel is genuinely in use, not merely available.
Did anything material go unseen? ClearView surfaces themes and recurring signals across a workforce, including patterns spread thinly enough that no single report would trigger review.
Can the board demonstrate oversight? BoardView presents signals and their handling at board level, leaving a record of what was escalated, when, and what followed.
Was review carried out at least annually? Continuous capture and audit logging give a year-round trail to review, rather than a reconstruction assembled shortly before the balance sheet date.
Being straight about the limits. Heardsafe does not make your controls effective and cannot make a declaration on your board's behalf. It produces evidence about one part of your control environment — conduct, culture and speaking up. Deciding what is material, reviewing effectiveness, and making the declaration remain the board's, advised by your own auditors and counsel.

Questions worth asking before your first declaration

  1. Are conduct and speak-up controls inside your materiality boundary? If not, what supports excluding them?
  2. If your channel received few or no reports this year, how do you distinguish a healthy organization from a distrusted channel?
  3. Can you evidence what was raised, how it was handled, and how long it took — for the whole year, not a sample?
  4. Can you show the board or audit committee actually saw recurring themes?
  5. If a material control had not operated effectively, would you have found out in time to disclose it?

Talk to us

If you are preparing a first Provision 29 declaration and want to discuss the conduct and speak-up portion of the evidence base, email help@heardsafe.com or call 1-844-524-5174.

Not legal or audit advice. This page is a plain-language summary of a published governance code and is not legal, audit or compliance advice. Heardsafe is not a law firm. Provision 29 obligations rest with the board, and its precise application to your company depends on facts we do not have. Read the Code and the FRC's guidance in full, and take advice from your own advisors. We have aimed for accuracy and welcome corrections at help@heardsafe.com.

Source: Financial Reporting Council, UK Corporate Governance Code 2024 and associated guidance — frc.org.uk. Last reviewed August 2026.