Is everything under control?
Complying with Provision 29 in practice

The fundamental message which the FRC has been emphasising during the implementation of the 2024 Governance Code is that companies need to think for themselves, and that the message applies equally to the disclosure obligations in Provision 29 (for more details on the FRC’s “Think for yourself” messaging, see our interview with Richard Moriarty, CEO of the FRC in June 2024). There is no one-size-fits-all approach in this regard and the FRC, and other interested stakeholders, have resisted requests to produce a standard template which could be used for the Provision 29 disclosures. 

Instead, what the FRC and others have done is provide guidance on what the disclosures should and should not cover. In its guidance which accompanies the 2024 Governance Code, the FRC covers the three separate aspects of the Provision 29 disclosures, with the majority of the guidance centring on the effectiveness declaration. 

In relation to the summary of the monitoring and review process, the guidance lists the matters which could form part of that summary, which include:

• the type of information received and reviewed by the board;
• who the board has consulted with;
• details of any internal and external assurance received; and
• details of any framework, standard or guideline the board used in its effectiveness review.

In relation to the effectiveness declaration, the guidance includes:

• the board needs to form its own views on effectiveness, based on the evidence received;
• to determine whether a control is operating effectively, the board should have regard to the control’s design and implementation;
• if the board cannot reach a conclusion on effectiveness, this can be explained in the ARA, given the “comply or explain” nature of the Governance Code;
• there is no expectation that the board will disclose information which it views as being confidential or which if disclosed would in its views inadvertently affect the company’s interests.

According to the FRC, a company’s disclosures in relation to its internal controls should be “proportionate, consider the risk appetite of the individual organisation and avoid unnecessary duplication or disclosure of immaterial information”.

The Provision 29 disclosures must not be drafted in a silo but should be considered in the context of other key disclosures set out in the ARA including the principal risks facing the company and the company’s strategy and business model. Given how materiality is assessed in relation to internal controls, the interaction between these controls and the principal risks is a key part of the effectiveness assessment and a company’s strategy and business model will dictate the risks that it is willing to take.

What is required and what is not?

As well as being aware of what needs to be included in the Provision 29 disclosures, companies should be clear what is not required. The FRC has produced a series of “Mythbusters” relating to Provision 29, which cover general reporting and external assurance, as well as one specifically on cyber security. 

• The declaration needs to be made by the whole board (including the non-executive directors), based on the evidence and information provided to it, rather than being made by management or a committee of the board. It is however a declaration of the whole board and there is no requirement for personal attestation from individual board members.
• The declaration of effectiveness does not need to cover all of the controls that a company may have in place – only those controls which the company has identified as being material need to be covered by the declaration. 
• It is not necessary for the board to make a declaration that the internal controls were effective at all points throughout the reporting period – the declaration relates to the effectiveness of the internal controls as at a particular point in time, namely the balance sheet date. That said, board will need to determine, in the light of information already made public, whether any further disclosure is required where there has been an issue with a material control during the reporting period which has since been resolved.
• There is no prescribed wording or formulation to be used for the declaration, nor any set standard to be used against which to declare the effectiveness of the internal control – the declaration must focus on the individual circumstances of the company and reflect the principal risks which the internal controls are designed to address, which will depend upon the company’s overall strategy and its risk appetite. Generally, the FRC anticipates that for most companies their Provision 29 disclosures will be no longer than two pages.
• There is no mandatory section of the ARA in which the declaration must be included – companies should determine which section is most appropriate given the structure of their report. The FRC does note however that the declaration should be clearly signposted.
• There is no requirement for external assurance of the declaration – it will be for individual companies to determine what assurance is appropriate.
• The materialisation of a risk is not an indication that the internal controls were not effective – an effective control will not eliminate a risk entirely but merely tries to manage the potential occurrence of that risk and consequences should it occur.
• Where the board determines, based on the evidence made available to it, that an internal control is not effective as at the balance sheet date, the board will need to establish what action to take to address the deficiency and then describe the nature of the deficiency and the steps taken, and to be taken, in response. These disclosures will need to be considered in the context of the company’s commercial interests and any confidentiality concerns relating to the deficiency. For example, if the assessment identifies that the controls adopted to mitigate cyber risks are not operating in a manner which effectively deals with that risk, the board should not make disclosures which exacerbate the company’s exposure to a cyber attack - for detail on cyber security and Provision 29, see the box below.

The new disclosures required by the 2024 Governance Code represent a significant change from the previous regime. With careful planning and ensuring that the holistic approach is adopted to the drafting of the ARA, boards will be well placed to meet this challenge.