As the implementation of Provision 29 of the UK Corporate Governance Code gets well under way, we are seeing increased activity from firms that are either directly impacted by the requirements or are seeking to enhance their risk management and reporting frameworks.
At the same time, the FCA is showing increasing interest in firms' risk management frameworks and how effectively they operate in practice.
What Is Provision 29 of the UK Corporate Governance Code?
For those unfamiliar with the provision, Provision 29 was introduced as part of the 2024 UK Corporate Governance Code updates. However, it only applies to reporting periods commencing on or after 1 January 2025, meaning reporting begins in 2026.
It requires certain listed companies, including those in the FTSE 350, closed-ended investment funds, and commercial companies listed under the UK Listing Rules, to report on the effectiveness of their material risk management controls as part of their annual report and accounts.
This has led to a flurry of activity across the market, as the requirement operates on a comply-or-explain basis and firms are understandably keen to avoid scrutiny from the Financial Reporting Council (FRC) and other regulators, including the FCA.
The requirements of Provision 29 include:
- Providing a declaration on the effectiveness of material controls.
- Disclosing any material weaknesses identified, including how they have been, or will be, remediated.
- Producing a resilience statement outlining principal risks, mitigation plans, and a forward-looking assessment of resilience.
- Extending oversight to non-financial controls.
Where Firms Are Struggling
Across the market, we are seeing strong top-down risk assessments and structured risk taxonomies. However, these are often not sufficiently linked to, or supported by, bottom-up risk assessments, leaving weaknesses within firms' risk management frameworks.
How Thistle Initiatives Can Help
At Thistle Initiatives, we help firms assess their corporate governance and risk management frameworks to ensure they are fit for purpose and aligned with regulatory expectations.
Our team can support firms in meeting both their corporate governance obligations and the FCA's risk management requirements under SYSC, providing practical, proportionate solutions that strengthen governance while supporting broader business objectives.
