What's Happening?
The UK Corporate Governance Code's Provision 29 now requires boards of large UK-listed companies to report on the effectiveness of their risk management and internal control frameworks. This mandate, stemming from the Economic Crime and Corporate Transparency
Act (ECCTA), introduces criminal liability for failing to prevent fraud and necessitates a declaration on the effectiveness of material controls as of the balance sheet date. For groups whose financial year began in January 2026, the first declarations are due in early 2027. The provision emphasizes that boards must take a definitive position on whether material controls were effective, rather than merely describing the control environment. Financial reporting controls are explicitly within scope, covering financial, operational, reporting, and compliance domains. The framework operates on a 'comply-or-explain' basis, but with an expectation that companies can evidence the effectiveness of their financial reporting controls, as investors and audit committees are unlikely to respond favorably to explanations of ineffectiveness.
Why It's Important?
This development is highly significant for U.S. companies with UK listings or substantial operations, as it sets a precedent for enhanced corporate governance and financial accountability that could influence global standards. The requirement for boards to declare the effectiveness of material controls, rather than just describing them, elevates the standard of proof and places greater responsibility on senior leadership. This will likely lead to increased scrutiny of internal control systems, particularly in areas like account justification, analytical review, and manual journal entries, which UK CFOs have already identified as needing strengthening. For U.S. businesses, this could mean a need to re-evaluate their own internal control frameworks and documentation practices to align with these more stringent expectations, especially if similar regulations are adopted in the U.S. or by international accounting bodies. The emphasis on demonstrable effectiveness will drive investment in robust financial reporting systems and standardized review processes, impacting technology adoption and operational procedures.
What's Next?
Companies, particularly those with UK listings or significant UK operations, must prioritize establishing clear, standardized, and evidenced control processes. The current reporting period serves as the evidence base, meaning groups with a January 2026 financial year start need to ensure their controls are robust now for declarations in early 2027. A recommended sequence for the close perimeter includes designating material close controls, standardizing work programs and documentation, instrumenting these programs on platforms that generate audit trails, and rehearsing effectiveness reviews internally. This proactive approach aims to build a strong evidence base rather than assembling it retrospectively under pressure. The shift from 'we do this' to 'we can demonstrate this operated' will necessitate a re-evaluation of existing tools, with spreadsheets and inboxes being deemed insufficient for evidencing control effectiveness. This will likely drive demand for dedicated solutions that provide defined, consistently performed, evidenced, and reviewable control processes.
Beyond the Headlines
Provision 29 represents a fundamental shift in the philosophy of corporate oversight, moving from a descriptive to a declarative model of control effectiveness. This has deeper implications for corporate culture, fostering a greater emphasis on transparency, accountability, and the integrity of financial reporting at all levels. The challenge lies not just in implementing new controls, but in transforming how organizations perceive and manage risk, embedding a culture where control effectiveness is continuously monitored and evidenced. This could lead to a re-evaluation of the roles and responsibilities within finance teams, with a greater focus on assurance and the operational aspects of control. The 'comply-or-explain' mechanism, while offering flexibility, places significant reputational pressure on companies to demonstrate robust controls, potentially influencing investor confidence and market perception. Ultimately, this initiative aims to reinforce public trust in capital markets by ensuring that financial statements are backed by demonstrably effective internal controls.
