Understanding Provision 29: A cornerstone of effective compliance and risk management

In association with:

Introduction

Regulators and stakeholders alike are raising the bar on how organisations manage risk and resilience. It’s no longer enough to claim strong governance: boards must prove it. That’s where Provision 29 becomes so important, as it sets out clear expectations for board accountability on internal controls 

Our partner Protecht helps organisations meet this expectation by providing a platform that gives boards real-time visibility and assurance over their risk and control environment. By turning governance requirements like Provision 29 into actionable insights, we empower boards to evidence strong oversight and build stakeholder confidence. 

What is Provision 29?

The UK Corporate Governance Code's upcoming Provision 29 requires the board to declare internal control effectiveness. This requires more than process.

The board should monitor the company’s risk management and internal control systems and, at least annually, carry out a review of their effectiveness and report on that review in the annual report.

UK Corporate Governance Code

In essence, Provision 29 places the responsibility for risk management and internal control squarely with the board, while empowering compliance and risk professionals to operationalise that responsibility across the organisation.

Why Provision 29 matters for boards and business leaders

Provision 29 is not just about board-level reporting. It has direct, day-to-day implications for how compliance professionals manage risk, ensure accountability, and maintain regulatory alignment. 

Let’s break down its core value across key areas: 

1 . Embeds risk culture across the organisation

Compliance isn’t confined to the legal or risk team; it’s an organisation-wide mindset. Provision 29 encourages the development of integrated systems where risk ownership is shared and supported by clear reporting lines, training, and leadership oversight.

2 . Reinforces regulatory compliance

Provision 29 supports compliance with a broad range of legislation and standards, such as: 

• SOX
• UK and EU GDPR
• FCA/PRA regulations
• Anti-Money Laundering (AML) and Counter-Terrorism Financing (CFT) laws

By aligning internal control systems with Provision 29, organisations demonstrate proactive compliance, reducing the risk of regulatory breaches. 

3. Drives transparency and accountability 

Provision 29 establishes a top-down accountability model. Boards are responsible for monitoring risk controls, which in turn mandates transparency from the operational level upward. This creates a strong foundation for whistleblowing, internal audits, and corrective action mechanisms.

4. Builds audit-ready compliance frameworks

With Provision 29's emphasis on ongoing review and reporting, compliance professionals are better prepared for audits, internal or external. It also supports the documentation of controls, incident management, and policy enforcement, all key components in demonstrating compliance maturity. 

5. Safeguards reputation and resilience

Reputational damage often stems from governance failures. Provision 29 empowers compliance teams to take a preventive rather than reactive approach, enabling early identification and mitigation of emerging risks. This is vital in an era where stakeholders demand both ethical conduct and operational resilience. 

How Protecht supports Provision 29 implementation

Protecht provides end-to-end solutions that help organisations operationalise the principles behind Provision 29: 

• Monitor and evidence internal control effectiveness: Give your board the evidence it needs to declare that controls are effective. 
• Streamline assurance across the three lines: Clarify roles, eliminate duplication and prove coverage across the business. 
• Create a single source of truth for risk and control: Unify fragmented processes into a connected, organisation-wide framework. 
• Enable confident, board-level reporting: Deliver data-driven, board-ready assurance for Provision 28 and Provision 29 compliance. 

Controls you can trust. Evidence the board can sign.

Protecht offers an integrated solution aligned with COSO and ISO 31000, featuring risk-control mapping, automated testing, real-time dashboards, and more. Our Provision 29 solution gives you the tested controls, mapped risks, and clear assurance pathways to back that declaration with confidence. 

Discover Protecht’s Provision 29 solution: 

https://www.protechtgroup.com/en-gb/uk-corporate-governance-code

Protecht's Provision 29 internal controls maturity checklist provides a structured, practical assessment to help you evaluate your control environment. 

Download now