The Financial Reporting Council published a new UK Corporate Governance Code in January 2024. Most of it applies to financial years beginning on or after 1 January 2025. One provision was given an extra year: Provision 29, on risk management and internal controls, applies to financial years beginning on or after 1 January 2026. For companies that run large capital programmes, it brings the project controls function much closer to the board.
What Provision 29 asks for
The board should monitor the company's risk management and internal control framework and, at least once a year, review whether it works. The review should cover all material controls: financial, operational, reporting and compliance controls.
In the annual report, the board should then give:
- a description of how it has monitored and reviewed the framework;
- a declaration of whether the material internal controls were effective as at the balance sheet date; and
- a description of any material controls that did not work as at that date, what has been done or is planned to fix them, and what has been done about issues reported before.
Who it applies to
The Code applies on a "comply or explain" basis to companies with shares in the commercial companies category of the UK listing rules, and many other companies choose to follow it. Comply or explain means a company can depart from a provision if it explains why, but boards and investors generally expect Provision 29 to be met.
What counts as a material control?
The Code does not list them. Each board decides which controls are material for its own company, using its judgement about what could have a serious effect on the business, its shareholders and other stakeholders. The FRC's guidance supports this but does not prescribe a list. For a company with a large capital programme, the programme will usually be one of the biggest risks on the books, so some of its controls are likely to be material.
Controls on a capital programme
Here are examples of controls a board might treat as material for a capital programme. Every company will have its own set.
| Control | What it protects | Evidence it works |
|---|---|---|
| Estimates are approved at the right level before a budget is set | Committing money without proper approval | Approval records with approver, date and value band |
| Changes are assessed on the programme and approved before they are spent | Cost growth from unapproved change | A change register linked to the schedule and the budget |
| Contingency is only drawn down with approval | Reserves used to hide overspend | Drawdown records against the risk they cover |
| Nobody approves their own estimate, transfer, forecast or certificate | Fraud and error | Separation of duties enforced by the system |
| Forecasts are reviewed every period | Late surprises on the final cost | Forecast history with reviewer and date |
| Payment certificates are checked before payment | Paying for work not done | Assessments, certificates and a second approver |
| The schedule meets quality standards | Unreliable dates driving decisions | Regular schedule quality checks, such as the DCMA 14 points |
Testing controls with project data
A declaration of effectiveness needs evidence. Asking each control owner to say "it worked" once a year is weak evidence. Much stronger is to test the control against the data itself, every period. For example:
- check every approved change has an approver who is not the person who raised it;
- check every contingency drawdown has a linked risk and an approval within its value band;
- check every certificate had a second approver before payment; and
- check forecasts on each control account were reviewed in the period.
Tests like these can run automatically. Their results, with the records they looked at, become the evidence. Failures go to a deficiency log with an owner and a date to fix.
The three lines
Many companies organise this using three lines. The first line is the people who run the programme and own the controls. The second line is the functions that oversee them, such as risk, finance and commercial assurance. The third line is internal audit, which gives the board independent assurance. A good controls register shows which line owns, checks and audits each control.
A simple year for the board
- Set the scope. Agree which programme controls are material, and who owns each one.
- Test every period. Run the tests, keep the evidence, and log any failures.
- Attest. Control owners confirm each period that their controls ran, with the evidence to hand.
- Fix and follow up. Track each deficiency to closure, and retest.
- Review and declare. At year end, the board reviews the evidence and the deficiencies and makes its declaration as at the balance sheet date.
Where Primer fits
Primer's Governance and controls module keeps the controls register, runs tests on the project data, records attestations and deficiencies, and drafts the year-end pack. Separation of duties is enforced on every approval. See Governance and controls.
This guide is general information, not legal, contractual or financial advice. Always check the source documents for your own contract or company.