From 2026, boards of UK-listed companies will be required to publicly declare whether their material controls are effective. The new requirements under Provision 29 of the UK Corporate Governance Code fundamentally change the visibility of the assessment of internal control effectiveness, with significant implications for corporate liability and the role of audit in the process.
In June 2026 the Financial Reporting Council (FRC) published revisions to three audit standards, revising requirements in respect of audit reports and auditor responsibilities in terms of the Provision 29 statements.
We discuss below the key aspects of the new requirements, the impact on external audit and wider implications, including risks under the Economic Crime and Corporate Transparency Act 2023 (ECCTA).
What Is Provision 29?
From Jan. 1 2026, companies applying the UK Corporate Governance Code 2024 are required to include in their annual report a declaration by the board of directors on the effectiveness of their material controls (the Provision 29 statement).[1]
The annual report must explain how the board has monitored and reviewed the effectiveness of the company’s risk management and internal control framework throughout the year and include the board’s declaration on whether the company’s material controls were effective as at the balance sheet date. Where any material controls have not operated effectively, the report must also describe the relevant control deficiencies together with the actions taken, or proposed, to remediate them. The board’s review extends across all material controls, including financial, operational, reporting, and compliance controls.
The Provision 29 statement forms part of the “Other Information” contained within the annual report and therefore falls within the scope of ISA (UK) 720, requiring auditors to consider whether it is materially inconsistent with the audited financial statements or with the knowledge obtained during the audit.[2]
What Are the Changes to Audit Standards?[3]
The FRC has revised ISA (UK) 700, ISA (UK) 701, and ISA (UK) 720 to enhance auditor reporting and clarify auditors’ responsibilities in relation to the board’s declaration on the effectiveness of material controls.
A key change is the introduction of paragraph 16-3 of ISA (UK) 701, which requires auditors of companies applying the UK Corporate Governance Code to explain in the auditor’s report how the entity’s system of internal control affected the audit. This represents a notable shift in auditor reporting, providing greater insight into how the organisation’s control environment has influenced the audit.
What Is a Material Control?
The code does not provide guidance as to what constitutes a material control and boards will need to determine their own list of material controls. The FRC has provided guidance that material controls might include controls over risks that could threaten an organisation’s business model or solvency, external reporting that could lead investors to make investment decisions, fraud, and critical IT risks.[4]
What Are the Auditor’s Responsibilities Regarding Provision 29 Statements?
It is important to emphasise that the auditor is not required to perform a separate audit of the board’s declaration or to express an opinion on the effectiveness of the company’s system of internal control.
Rather, the auditor is required to read the statement and consider whether it is materially inconsistent with either the audited financial statements or the knowledge obtained during the audit.
Where a material inconsistency is identified, the auditor must discuss the matter with management and follow the requirements of ISA (UK) 720. This will typically involve requesting that management, and where appropriate those charged with governance, investigate the matter and either amend the Provision 29 statement or explain why the auditor’s concerns are unfounded. The auditor will then evaluate any additional evidence or explanations provided to determine whether the inconsistency has been resolved.
If the board does not amend what the auditor considers is a materially misstated Provision 29 statement, or the auditor concludes the inconsistency remains unresolved, the auditor must take appropriate action. Depending on the circumstances, this may include describing the material misstatement of the “Other Information” in the audit report and communicating the matter to those charged with governance.
Does Provision 29 Mean Auditors Will Need to Test More Controls?
The short answer is no. The requirements for auditors regarding the testing of controls have not changed and this will remain focussed on controls relevant to the financial statements.
As part of their statutory audit, the auditor may test the design and operating effectiveness of financial controls where this forms part of their response to identified risks of material misstatement. In some cases, the controls tested by the auditor as part of this work may also constitute material controls identified by the board under Provision 29.
What if the Board Reports an Ineffective Material Control?
It is important to note that where the board discloses that a material control has not operated effectively, this does not automatically require the auditor to carry out additional testing or result in a modification of the audit opinion. Any further audit response will be determined based on the specific circumstances of the engagement.
Where there is a disclosure that a material control has not operated effectively, the first consideration is whether the control is relevant to the financial statement audit. If so, the auditor will need to consider whether the disclosure constitutes new information, which affects their audit risk assessment.
Depending on the circumstances, the auditor may determine that additional audit procedures are necessary in response to the revised risk assessment. This will depend on the nature of the control deficiency, its potential impact on the financial statements, and the auditor’s professional judgement.
What if the Auditor Identifies a Significant Control Deficiency?
If a significant deficiency in internal controls is identified during the audit, this forms part of the auditor’s knowledge when assessing the board’s Provision 29 statement. However, an identified significant deficiency, even where it relates to the same area as a material control identified by the board, does not automatically mean that the board’s declaration that its material controls are operating effectively is incorrect.
Auditors must exercise professional judgement when assessing whether a significant deficiency gives rise to a material inconsistency. In doing so, they will consider the nature and significance of the deficiency, whether any remediation was completed before the balance sheet date, and discussions with management and those charged with governance.
Only where the identified deficiency results in the board’s Provision 29 statement being materially inconsistent with the auditor’s knowledge obtained during the audit would further action under ISA (UK) 720 be required. If, having discussed the matter with management and where appropriate those charged with governance, the auditor remains of the view that a material inconsistency exists, the auditor may need to describe the issue in the audit report.
ECCTA 2023 Implications
In 2025 the ECCTA 2023 introduced a new corporate offence of failure to prevent fraud for large organisations. This established a strict liability corporate offence for organisations if an associated person (widely defined to include employees, agents, subsidiaries, and third-party service providers) commits a fraud intending to benefit the company. The only available defence for organisations where the above circumstances are established is that it had reasonable fraud prevention procedures in place.[5]
The Provision 29 requirements mean that organisations applying the code will now need to explicitly declare whether their material internal controls are operating effectively. Where the board reports that this is not the case, a reasonable procedures defence is likely to be difficult particularly if the control is relevant to fraud.
Further, the requirements open the possibility that the auditor may take a differing view to the board and conclude that the Provision 29 statement is materially inconsistent with their knowledge from the audit. Where this is the case and the issue is not resolved, it may be communicated in the audit report. This could result in regulatory scrutiny and undermine an adequate fraud prevention procedures defence under ECCTA.
Practical Implications for Organisations
The introduction of the Provision 29 requirements places greater emphasis on the board’s ability to demonstrate that its declaration is supported by a robust and well-documented assessment of the organisation’s material controls.
The board’s assessment of controls should not be treated as an annual compliance exercise. Continuous monitoring of material controls throughout the year will place organisations in a stronger position to support the board’s declaration and respond to any issues identified before year end. Early engagement and co-operation with external audit are also likely to be helpful to avoid differing assessments emerging late in the audit process.
Key Takeaways Regarding the Role of Audit
Auditors must consider the board’s Provision 29 statement alongside the evidence obtained during the audit and determine whether there is a material inconsistency. This does not mean that auditors must now perform a separate audit of internal controls.
Auditors will have to include in their report for the first time a description of how the company’s internal controls have affected the audit, increasing transparency in this area. The further detail likely to be included in audit reports on internal controls could lead to greater regulatory scrutiny and may have implications under ECCTA.
References
[4] FRC Corporate Governance Code guidance 29 January 2024, paragraph 272
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC, its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
