The UK Corporate Governance Code is the rulebook that sits behind how listed companies are run at a board level.
For anyone sitting on a UK board, or advising one, understanding the Code is essential background. It is the framework your governance will be judged against.
This article explains what the Code covers, who it applies to, and what changed in the 2024 update, with a focus on Provision 29, the new internal controls requirement that most boards are still getting to grips with.
For the full text, the Financial Reporting Council (FRC) maintains the official UK Corporate Governance Code, and that should always be your primary reference.
The UK Corporate Governance Code is maintained by the FRC. It sets out standards of good practice for board leadership and defines what shareholders, regulators, and the wider market expect from a board, including:
The Code operates on a "comply or explain" basis. Companies must either follow each provision, or explain publicly why they have taken a different approach. This differs from the Charity Governance Code, which uses "apply or explain" because meeting its recommended practice is not a regulatory requirement.
Comply or explain is a deliberate design choice. Governance in the UK has never worked on a rigid, tick-box model. The Code assumes that a one-size-fits-all rulebook would produce compliance theatre instead of better governance.
The current version, the UK Corporate Governance Code 2024, has applied since 1 January 2025 and replaces the 2018 edition. Provision 29 is the exception: it applies a year later. The Code is organised into five sections:
Each section contains both Principles, which are broad statements of good governance, and Provisions, which are the more detailed standards companies are expected to comply with or explain against.
Provision 29, which we cover in detail below, sits in the Audit, Risk and Internal Control section.
The Code applies to companies listed in the commercial companies category or the closed-ended investment funds category of the UK Listing Rules, whether they are incorporated in the UK or elsewhere. Before the 2024 listing reforms this was commonly described as a "premium listing". These companies must apply the Code's Principles and either comply with each Provision or publish a clear explanation of why they have not.
It does not apply as a legal requirement to private companies, smaller AIM-listed businesses, or charities. Two things are worth knowing:
If you are a board chair, chief executive, or non-executive director who sits across several boards, including charity and private company boards, you will have encountered Code-derived language and expectations even where the Code itself does not formally apply.
Similarly, if you serve as a trustee alongside a listed-company NED role, you will likely find governance conversations shaped by Code thinking regardless of the entity type.
Charities working through their own updated standard may want to see how it compares in our Charity Governance Code 2025 update. For the thinking that sits underneath any code, see our guide to the principles of good governance.
The 2024 revision followed a 16-week FRC consultation in 2023. That consultation responded to the government's Restoring Trust in Audit and Corporate Governance reform proposals, which were prompted by a run of high-profile corporate collapses and questions about whether board oversight was catching problems early enough.
The changes eventually made to the Code were lighter than the original proposals suggested. A few matter for every director:
Of these, Provision 29 has caused the most scrutiny inside boardrooms, largely because it changes who is accountable for the answer as well as what the answer needs to say.
Provision 29 of the UK Corporate Governance Code asks the board to state, in the annual report, whether the company's material controls were effective as at the balance sheet date. The monitoring and review behind that statement covers financial, operational, reporting and compliance controls. The board must also describe how it monitored and reviewed the framework, and describe any material controls that did not operate effectively and what has been done about them.
It applies to financial years beginning on or after 1 January 2026. The FRC's Provision 29 mythbuster confirms that first reporting will come in 2027 for companies with a calendar year, and that early declarations are not required. That sounds like plenty of notice, but the declaration covers a whole year of activity, so the real preparation starts earlier than the date suggests.
Under the 2018 Code, boards already had to monitor and review the risk management and internal control framework. Provision 29 now adds a declaration on the effectiveness of material controls, and the board must be ready to defend it.
This also changes who owns the statement. Management has usually drafted and signed off this section of the annual report. Now the board owns it, so directors need to understand the evidence well enough to explain it and challenge it.
The FRC's mythbuster clears up several misreadings:
The FRC has since published further mythbusters on the auditor's responsibilities (June 2026) and on cyber reporting (September 2026), both worth reading if you are shaping your first declaration.
Treating this as a box-ticking exercise for late 2026 will leave boards short of evidence. Testing the material controls and building a regular monitoring routine takes a full reporting cycle. A company with a December year-end needs those processes running from January 2026 to make a declaration it can stand behind in its first annual report.
Provision 29 applies to companies that follow the UK Corporate Governance Code, so most boards reading this are not legally required to comply. The idea behind it still applies. A board should understand its material risks and be able to show how it monitors them.
Other sectors already ask similar questions:
The wording differs between these frameworks, but each expects a board to be able to show its oversight with evidence, and not simply say it is in place. A well-kept risk register is often the first piece of that evidence.
Many NEDs and trustees sit on a listed board and on one or two charity or private company boards. The control frameworks and evidence trails built for Code compliance on the listed board can often be adapted for the others.
A trustee who has been through a Provision 29 preparation cycle will also spot control gaps faster on a charity board that has never been asked these questions directly. Boards that want to test their own effectiveness more broadly can start with our guide to the board effectiveness review.
Provision 29 and the broader Code depend on the same underlying capability: a board that can show what it knew, when it knew it, and how it responded. That means an accurate record of what was discussed, what was escalated, what decisions were taken, and what actions followed. It needs to be held somewhere a board can retrieve and evidence it months or years later, and not buried in an inbox or a folder of Word documents with inconsistent version histories. Good minutes are a large part of that record.
BoardPro gives boards a single, structured record of papers, minutes, decisions, and actions. That audit trail turns a Provision 29 declaration, or any governance assurance, from a scramble into a retrieval exercise. If you are weighing up tools, our guide to board management software explains what to look for.
Explore BoardPro for your board
Board management software built for the way small and mid-sized UK boards actually work, from agenda to action.