Provision 29 of the UK Corporate Governance Code requires boards to declare the effectiveness of their material internal controls annually. GRCxAI's purpose-built Principal Risks & Uncertainties module automates compliance end-to-end. Link principal risks to operational risks and controls, track board review cycles, measure control effectiveness with real evidence, and generate AI-powered Annual Report disclosures. Turn a complex governance obligation into a streamlined, auditable process your board can rely on.
Provision 29 is part of the UK Corporate Governance Code, revised by the Financial Reporting Council (FRC) in January 2024. It is the most significant governance change in the latest Code revision, applying to accounting periods beginning on or after 1 January 2026.
Previously, boards stated that controls existed. Under Provision 29, the bar is significantly higher. Boards must now:
Monitor the company's risk management and internal control framework continuously throughout the year — not just at annual review time.
Review the effectiveness of all material controls at least annually. This covers financial, operational, reporting, and compliance controls — not just financial.
Declare the effectiveness of material internal controls in the Annual Report & Accounts. Boards are personally accountable for this declaration.
Evidence that controls worked, how they were monitored, and what proof backs the declaration. Compliance is assessed on evidence of control effectiveness, not just existence of policies.
Who must comply: All companies with a premium listing on the London Stock Exchange, on a "comply or explain" basis. In practice, this affects all FTSE 350 companies and many others that voluntarily adopt the Code.
Non-compliance: Companies that cannot comply must provide a public explanation to shareholders. There is no option to simply ignore the requirement.
Often called "UK SOX" due to parallels with the US Sarbanes-Oxley Act, Provision 29 brings internal controls management out of the finance silo onto the boardroom agenda.
Boards are personally accountable for the declaration on control effectiveness. This is not a delegated responsibility — it sits at the highest level of corporate governance.
Compliance is assessed on evidence of control effectiveness, not just the existence of policies. Boards must prove controls work, not simply state they are in place.
Unlike US SOX which focuses on financial controls, Provision 29 covers all material controls: financial, operational, reporting, and compliance. The scope is comprehensive.
Non-compliance requires public explanation to shareholders. The declaration appears in the Annual Report & Accounts, visible to investors, regulators, and analysts.
This is not an annual tick-box exercise. Boards must demonstrate ongoing, continuous monitoring of risk management and internal control systems throughout the year.
Based on the UK Corporate Governance Code (FRC, January 2024), the UK Companies Act 2006, and FRC Guidance on Risk Management, Internal Control and Related Financial and Business Reporting.
Provision 29 compliance requires a structured, evidence-based approach across five interconnected pillars. GRCxAI maps directly to each one.
Identify and characterise all principal risks and uncertainties facing the organisation. This includes strategic, operational, financial, compliance, reputational, ESG, cyber, and geopolitical risks.
Link material controls to each principal risk with documented ownership. Establish clear accountability and ensure every risk has appropriate mitigating controls with named owners.
Test controls for effectiveness with recorded evidence and a complete audit trail. This is the critical shift from "controls exist" to "controls work" — the core of Provision 29.
Board and committee review cycles with documented governance trail. Ensure board-level visibility through Audit Committee, Risk Committee, Board, and Executive Committee assignments.
Formal statement in the Annual Report on control effectiveness, backed by evidence from all preceding pillars. The declaration must be evidence-backed and regulator-ready.
GRCxAI includes a purpose-built Principal Risks & Uncertainties (PRU) module designed from the ground up for UK Corporate Governance Code Provision 29 compliance. Ten integrated capabilities cover the full compliance lifecycle.
Classify principal risks across a comprehensive taxonomy designed for Provision 29 reporting:
Quantify risk at three levels with dynamic calculation from linked operational risks:
Principal risks are strategic composites. GRCxAI lets you link each to multiple operational risks from the full Risk Register:
Map controls directly to each principal risk and track their effectiveness over time:
Full board governance lifecycle tracking for Provision 29 compliance:
Clear, named accountability at two levels ensures no risk falls through the cracks:
Purpose-built fields for managing the ARA (Annual Report & Accounts) process:
GRCxAI uses Claude AI to auto-generate Annual Report-ready Provision 29 disclosures:
Ongoing risk monitoring tools to satisfy the continuous oversight requirement:
Every change is logged to support regulatory audit and FRC inspection requirements:
GRCxAI uses Claude AI to auto-generate Annual Report-ready Provision 29 disclosures from your live risk data. Board-appropriate language suitable for external publication to shareholders, regulators, and analysts.
Every action is audit-logged. Every review is documented. Every declaration is evidence-backed and regulator-ready.
A comprehensive checklist of every Provision 29 capability built into GRCxAI.
See how GRCxAI transforms Provision 29 compliance from a manual, error-prone process into a streamlined, auditable workflow.
Provision 29 applies to financial years beginning 1 January 2026. Map risks. Track controls. Evidence effectiveness. Declare with confidence.
The complete platform for UK Corporate Governance Code compliance.