Provision 29 implementation guide
UK SOX compliance: what Provision 29 actually requires.
Separate the shorthand from the requirement, then build the controls, evidence, testing and board record needed for a defensible declaration.
The short answer
“UK SOX” is not a UK statute. The current requirement is Provision 29 of the 2024 UK Corporate Governance Code for in-scope listed companies, operating on a comply-or-explain basis.
Published 24 August 2026 · Official material checked 24 August 2026
Start with the legal boundary
UK SOX is shorthand—not a UK statute.
The phrase “UK SOX” became a convenient label for proposals to strengthen UK internal-control accountability after major corporate failures. It can still be useful as a search term or programme name, but it is too imprecise to define the obligation. Teams should identify the exact framework, provision, reporting perimeter and effective date they are implementing.
The current board-reporting requirement is Provision 29 of the 2024 UK Corporate Governance Code. The Code applies to companies listed in the commercial companies category or the closed-ended investment funds category, whether incorporated in the UK or elsewhere. It does not automatically apply to every UK company or every private company.
The Code operates on a comply-or-explain basis through the UK listing framework. That flexibility does not remove the need for a clear reporting position. A departure should be explained meaningfully, including the context, rationale, risks, mitigating action and expected timescale where relevant.
Earlier policy discussions sometimes bundled statutory director duties, audit reform and a controls statement under the same “UK SOX” label. In January 2026, the government said it would not consult on audit-reform legislation. Provision 29 remains a live Code requirement and should be implemented on its own terms.
Provision 29 in plain English
Monitor, review and report on material controls.
The board should monitor the company’s risk management and internal control framework and review its effectiveness at least annually. That work covers all material controls, including financial, operational, reporting and compliance controls. The annual report then has three connected outputs.
Monitoring and review
Describe how the board monitored the risk management and internal control framework and reviewed its effectiveness.
Effectiveness declaration
Declare whether the material controls were effective as at the balance sheet date—not whether every control worked perfectly throughout the year.
Ineffective material controls
Describe any material controls that were not effective at that date, the improvement action taken or proposed, and action on previously reported issues.
The declaration date matters
The declaration addresses effectiveness as at the balance sheet date. The monitoring narrative still needs to explain the annual process and how the board reached its conclusion.
Material does not mean only financial
A financial-controls programme may be a useful base, but the stated population also includes material operational, reporting and compliance controls.
Provision 29 and US SOX
Reuse the machinery. Do not copy the scope blindly.
A mature US SOX programme can provide control documentation, testing discipline, deficiency management and assurance experience. Provision 29 still requires a separate analysis of scope, materiality, board responsibility and reporting.
The implementation record
Build evidence the board can interrogate.
Provision 29 does not prescribe one framework or one number of controls. That makes the decision trail more important, not less. The record should explain how the company moved from risks to material controls, how those controls were tested, what failed and why the board was able to make its declaration.
Scope population
Define the listed parent, relevant group entities, business units, processes, systems and reporting perimeter. Record exclusions and the reason for each one.
Risk and materiality rationale
Connect principal and emerging risks to the controls the board considers material. Preserve the criteria, judgement, challenge and approval behind that population.
Control record
For each material control, retain its objective, risk, owner, operator, frequency, evidence, dependencies, systems and expected reviewer.
Design and operation testing
Separate whether a control is suitably designed from whether it operated. Record the sample, period, tester, result, exception and reviewed evidence.
Deficiencies and near misses
Capture failures, weaknesses, near misses and compensating controls. Assess severity consistently and preserve who decided whether a matter was material.
Remediation
Assign an accountable owner, milestones, dependencies, target date, retest and closure approval. Keep unresolved items visible to the board at the reporting date.
Board oversight
Package the population, testing, exceptions, assurance and open judgements so the board can challenge management and reach its own conclusion.
Annual-report traceability
Link every statement in the draft disclosure back to approved evidence. Freeze the reporting-date view while preserving later corrections and subsequent events.
A practical 2026 sequence
Work backwards from the balance sheet date.
01 · Scope
Confirm perimeter and materiality
Map risks, entities, processes and candidate controls. Agree decision rights and the evidence standard before testing begins.
02 · Operate
Run and evidence the controls
Make ownership, frequency and evidence explicit. Resolve missing or weak records early enough to change the operating process.
03 · Test
Challenge effectiveness
Test design and operation, classify exceptions, assess compensating controls and complete remediation or document the open position.
04 · Declare
Prepare the board conclusion
Give the board a reconciled reporting-date view, unresolved judgements, assurance and disclosure traceability for challenge and approval.
Provision 29 applies to accounting periods beginning on or after 1 January 2026. For a calendar-year company, 2026 is the first full operating period and the related disclosure will generally be published in the 2027 annual report. Companies with a different year end should calculate the first applicable period from their own accounting-period start date.
Common implementation traps
Avoid a disclosure project with no control system behind it.
Treating a peer count as the target
The FRC does not prescribe a number. Start from the company’s risks and materiality decisions, then justify the resulting population.
Restricting scope to financial controls
Provision 29 expressly includes material operational, reporting and compliance controls alongside financial controls.
Assuming the external auditor owns the declaration
The board makes its own assessment. External assurance is a board and management decision, while auditor duties remain separate.
Testing without retaining reviewed evidence
A completion tick does not establish what operated, for which period, who reviewed it or what happened when an exception appeared.
Writing the annual report before reconciling exceptions
Open deficiencies, retests and remediation must be aligned to the balance sheet date and the board’s final effectiveness conclusion.
Compliance and control software
Evaluate the record, not the dashboard.
Demonstrate one material control from risk selection through operation, testing, exception, remediation, board reporting and export. Score every manual handoff and any conclusion the product cannot explain from the underlying evidence.
One control universe
Can risks, material controls, owners, evidence, tests, deficiencies and remediation remain linked without spreadsheet joins?
Point-in-time history
Can the team reproduce what the board knew and what each material control’s status was at the balance sheet date?
Evidence quality
Can reviewers distinguish an uploaded document from evidence that has been checked, approved, period-matched and retained?
Testing workflow
Can design testing, operating-effectiveness testing, samples, exceptions, review and retesting be recorded separately?
Judgement and challenge
Does the record show who proposed, challenged and approved materiality, effectiveness, severity and remediation decisions?
Board reporting
Can directors move from the declaration to the underlying risks, controls, evidence, exceptions and unresolved actions?
Change control
Are changes to risks, controls, owners, systems and test plans versioned with approval and effective dates?
Export and exit
Can the company export the complete record, including history and attachments, without depending on a vendor-generated summary?
Official context
Sources used for this guide.
The original Code and FRC publications are authoritative for the requirement. The FRC’s AI-converted HTML pages can aid accessibility but explicitly direct readers back to the original PDF as the verified source.
Frequently asked questions
UK SOX and Provision 29 FAQs.
What is UK SOX?
UK SOX is market shorthand for UK internal-control reform, not the name of a UK statute. In current implementation work it commonly refers to Provision 29 of the 2024 UK Corporate Governance Code, which asks in-scope boards to monitor and review their risk and internal control framework and report on material controls.
Who must comply with Provision 29?
The 2024 UK Corporate Governance Code applies to companies listed in the commercial companies category or the closed-ended investment funds category, wherever incorporated. Those companies apply the Code through the UK listing framework on a comply-or-explain basis. Private companies are not automatically brought into Provision 29 simply because they operate in the UK.
When does Provision 29 apply?
Provision 29 applies to accounting periods beginning on or after 1 January 2026. For a company with a calendar financial year, the first full period is therefore 2026 and the related Provision 29 annual-report disclosure will generally appear in 2027.
Does Provision 29 require external assurance?
No automatic external-assurance requirement is written into Provision 29. The board and management decide whether external assurance is needed and to what degree. Existing auditor responsibilities remain separate, so companies should define the assurance model deliberately rather than assume the statutory auditor will make the board’s declaration.
How many material controls should a company have?
The FRC does not prescribe a target number. The board determines which controls are material for the company’s circumstances, including its size, business model, strategy, operations, structure and complexity. Peer counts may provide context, but they do not replace a company-specific risk and materiality rationale.
Is Provision 29 the same as US SOX?
No. Companies can build on an established US Sarbanes-Oxley control approach, but Provision 29 is a UK Corporate Governance Code provision and covers material financial, operational, reporting and compliance controls. The FRC says Provision 29 goes beyond the financial-controls reporting expected under US SOX.
Can compliance software make the Provision 29 declaration?
No. Software can organise risks, controls, evidence, testing, deficiencies, remediation and board reporting, but the board must make its own assessment. A system should make the evidence and judgement trail inspectable; it should not turn incomplete records into an automated legal or effectiveness conclusion.
What evidence supports a Provision 29 declaration?
The evidence should support the board’s view of the framework and each material control at the balance sheet date. A practical record includes scope and materiality decisions, control ownership and design, operating evidence, testing and review, failures and near misses, remediation, assurance work, board challenge and traceability into the annual-report disclosure.
This guide is general information, not legal, audit or accounting advice. Scope, applicability, materiality, assurance and disclosure require company-specific judgement and appropriate professional review.
See controls, evidence and remediation in one reviewable record.
Bring one material control and its current evidence trail. We’ll show how Atlas can organise ownership, testing, exceptions, remediation and board reporting without replacing the board’s judgement.