Provision 29: How Boards can prepare for the changes

Provision 29 raises the bar from oversight to evidenced assurance, asking boards to be clear about which controls are material, how effectiveness has been assessed, and what the board is declaring.

Effective for periods beginning on or after 1 January 2026, Provision 29 increases scrutiny and expectations from regulators, investors and wider stakeholders, particularly around the quality and specificity of reporting.

What is Provision 29?

In practical terms, Provision 29 requires boards to:

• Monitor and review the effectiveness of the organisation’s risk management and internal control framework
• Assess and declare whether material controls are designed and operating effectively
• Provide transparent disclosures explaining how the assessment was performed and what it covered

This is a shift from a largely process-driven approach (“a review took place”) to an outcomes-based expectation. Boards must be able to provide evidence supporting their view that material controls were effective across the financial period.

Many companies have already started mapping principal risks and identifying key control areas. The next and more demanding phase is ensuring controls operate consistently, assurance is reliable, and reporting meets the market’s expectations.

Why Provision 29 matters for Boards

Provision 29 elevates Board accountability. It calls for a clearer “line of sight” between:

1. The company’s most significant risks
2. The controls that mitigate them
3. The assurance the board relies on to make its declaration

It also increases the importance of high-quality narrative reporting. In its Annual Review of Corporate Governance Reporting (Nov 2025), the Financial Reporting Council (FRC) highlighted that many companies still provide minimal disclosure, with only 40% giving meaningful detail on what the review covered or who conducted it.

For boards, this creates both a risk and an opportunity:

• Risk, because weak or generic disclosure can undermine confidence and invite scrutiny.
• Opportunity, because a well-structured approach can strengthen governance, improve resilience, and enhance stakeholder trust.

The four biggest challenges boards face under Provision 29

What boards can do now: practical next steps

To move from planning into execution, boards and executive teams can focus on four practical actions:

1. Confirm the scope and definition of material controls
   Agree a methodology (and rationale) that links material controls to principal and critical risks.
2. Build a proportionate assurance model
   Create an assurance map that shows coverage, reliance and evidence by control type and risk level.
3. Run a “dry run” of testing and reporting
   Identify gaps in evidence, inconsistencies in documentation, and areas needing remediation before the formal declaration period.
4. Align with existing frameworks and tooling
   Integrate with ICFR and other governance frameworks to minimise duplication and improve consistency.

How we can help

Provision 29 is ultimately about building confidence for boards and stakeholders that material controls are working effectively. For many companies, the biggest challenge is not intent, but creating a robust, repeatable approach to defining materiality, collecting evidence, aligning assurance and producing board-ready disclosure.

Forvis Mazars can support boards and executive teams with:

• Material controls scoping and rationalisation (including pillar-based approaches)
• Designing assurance maps and testing strategies aligned to board expectations
• Readiness assessments, dry runs and remediation planning
• Reporting support to strengthen clarity, structure and evidence trails

Get in touch