Corporate reporting – FRC guidance on Provision 29 in the UK Corporate Governance Code and cyber security controls

The FRC’s guidance comes ahead of new internal control disclosures being required in UK listed company annual reports

The FRC has published a second Mythbuster in relation to Provision 29 of the UK Corporate Governance Code 2024, this time focusing on cyber security, which the FRC identifies as a significant issue for companies.

Provision 29 of the Governance Code applies to financial years beginning on or after 1 January 2026 and requires the board to include in the annual report: 

• a description of how the board has monitored and reviewed the effectiveness of the company’s risk management and internal control framework;
• a declaration on the effectiveness of the material controls as at the balance sheet date; and
• a description of any material controls which have not operated effectively, the remedial action taken or proposed in relation to these controls and any action taken to address issues previously reported on.

The FRC says that it is likely that many companies will view controls relating to cyber security as being material, and therefore within the scope of the Provision 29 regime. The Mythbuster therefore discusses various cyber security-related issues for Provision 29 purposes, including:

• the FRC’s expectations in relation to disclosures about cyber controls. It confirms that there is no obligation to include commercially sensitive information or specific details on the technical controls;
• confirmation that the Provision 29 declaration does not require boards to guarantee cyber security; and
• what companies should do in the event of a cyber breach.

In July 2026, the FRC published a Mythbuster on auditors’ responsibilities in relation to Provision 29 disclosures – see our blog post here.

For more details on Provision 29, see our snapshot here.