For UK premium-listed companies with a calendar year-end, the first annual report under a new board-level assurance requirement is now being drafted. Provision 29 of the 2024 UK Corporate Governance Code asks boards to declare whether the company’s material internal controls were effective. It is easy to read as a finance and audit-committee matter. For security leaders, it is a new route by which cyber control failures can become a board-level disclosure issue.
What Provision 29 Requires
The 2024 Code applies to financial years beginning on or after 1 January 2025. Provision 29 is the exception: it commences a year later, for financial years beginning on or after 1 January 2026. Under it, the board must monitor the company’s risk management and internal control framework and, at least annually, review its effectiveness. It must also make a declaration on the effectiveness of material controls as at the balance sheet date.
Two details matter for planning. First, the Financial Reporting Council (FRC) says the scope of the framework is unchanged, but the declaration now concerns material controls rather than the whole framework. Second, law firm commentary on the revised Code notes that boards must expressly refer to material controls relating to reporting, both financial and non-financial, including narrative reporting.
Where Cyber Fits, and Where It Does Not
The material sources reviewed for this article do not single out cyber security by name, and the FRC has not published a list of controls that must be in scope. Advisers describing the Provision say boards decide the scope for themselves, tied to principal risks, the business model and stakeholder interests. The FRC has also declined to supply model declaration wording.
That ambiguity is the governance risk. If cyber is a principal risk in the annual report, as it is for most large listed companies, it is hard to defend a material controls scope that ignores the controls that protect the systems producing the company’s reported numbers and operational resilience. Whether a given control is “material” is a board judgement, and it will be tested against the company’s own risk disclosures. The practical reading is an inference from the Code’s structure, not an FRC statement that cyber is mandatory scope.
The Questions Directors Are Likely to Ask
Expect audit and risk committees to move from “are we secure?” to “which controls do we rely on, and how do we know they worked?” CISOs should be ready to answer the following.
- Which cyber controls are material? Examples to put forward for discussion include privileged access, backup and recovery for financial and operational systems, change management on systems feeding reporting, and third-party access.
- What is the evidence of operation, not just design? A policy is a design statement. Boards making a declaration need testing results, exception rates and remediation tracking.
- What happened to deficiencies? The Code expects boards to describe how they dealt with any material weakness. A known control gap with no owner or timeline is a disclosure problem, not only a security one.
- Who gave assurance? Internal audit, second-line testing and external assessments each carry different weight. Be explicit about which is which.
Aligning With Existing Reporting
Most security functions already report on controls through frameworks and metrics. The work is mapping, not reinvention. Controls reported to the board through a structured model, such as the approach in our board cyber risk reporting framework, can be tagged as material or non-material and linked to the principal risk they mitigate. That gives the audit committee a single view, and avoids a separate cyber assurance track that diverges from the one the finance team is using.
The regulatory landscape is also tightening around the same boards. The UK Cyber Security and Resilience Bill, covered in our briefing on its implications for CISOs, would add statutory duties for operators in scope. A control environment that can support a Provision 29 declaration is a sensible foundation for those obligations as well.
A Practical Plan for the Next Quarter
- Agree scope early. Meet the CFO, general counsel and head of internal audit to propose which cyber controls belong in the material set, and record the rationale.
- Test what you will declare. Run operating-effectiveness testing before year-end, not after the auditors ask.
- Document deficiencies and ownership. Every known gap needs an accountable executive, a deadline and a status the committee can see.
- Keep disclosures consistent. Statements in the principal risks section, the viability statement and the controls declaration should not contradict one another. Inconsistency is what regulators and plaintiffs’ lawyers look for after an incident.
The Bottom Line
Provision 29 does not create a new cyber rule. It changes who has to stand behind the evidence. A board that must declare its material controls effective will want proof from the people who run them, and a CISO who arrives with a scoped, tested and documented set of cyber controls will be a far more useful partner to the audit committee than one who arrives with threat statistics. The first reporting cycle will set the precedent, so it is worth getting the scope conversation started now.