Provision 29: Building the Evidence Behind the Declaration

The first Provision 29 declarations will be signed in 2027, on evidence a board can only build during 2026. For a December year-end, the balance sheet date the declaration speaks to is 31 December 2026. The declaration is a statement of fact about that date, and the evidence behind it accumulates across the year or does not exist at all.

The declaration is personal

The Financial Reporting Council deliberately declined to prescribe what counts as a material control. Materiality is a board judgement, calibrated to the firm’s risk profile. Across the FTSE 350, boards are typically identifying between 30 and 60 material controls, with most settling around 35 to 40, and that population must be reviewed and approved annually.

The liability context has hardened around the signature. The Court of Appeal’s 2025 ruling in Saxon Woods Investments Ltd v Costa weakened the “honest belief” defence for directors; transparency and due process are the legal standard now. The Economic Crime and Corporate Transparency Act’s failure-to-prevent-fraud offence is fully operational, linking control failure directly to criminal exposure. A director who signs an effectiveness declaration the evidence does not support is making a false statement in the annual report.

The judgement cannot be delegated

The FRC expects the board to reach its own conclusions on control effectiveness. That task cannot be handed to management, to internal audit, or to external consultants, and the FRC expects boards to seek out control weaknesses actively rather than wait to be told about them.

Nor can the external auditor supply the answer. Independence rules restrict the firm that audits the financial statements from building the board’s assurance over the controls behind them. The board needs a source of challenge that is independent of management, independent of the audit relationship, and senior enough to test the judgements directors will personally sign against. That is the position Marentis Labs is built to occupy.

Evidence, not description

Describing the control framework no longer discharges the obligation. A declaration a sceptical reader would accept rests on five things:

• Materiality criteria the board has formally approved, reconciled to the principal risks disclosed in the Strategic Report.
• A unified assurance map that draws first-line attestations, second-line monitoring, and internal audit findings into one board-ready view of every material control.
• Failure thresholds agreed before testing begins, so year-end wording reflects the tested state of controls rather than a negotiation about it.
• A year of minuted, independent challenge showing the board engaged with control effectiveness as a live question, not a year-end formality.
• Declaration wording stress-tested against the evidence pack before the formal reporting cycle starts.

Adjacent regimes feed the same signature. A material error in a DORA Register of Information, or an unexamined third-party climate model under SS5/25, is a failure of a material compliance control, and it can undermine a declaration signed in good faith. The scoping exercise has to treat these as one obligation, whatever the org chart says.

A fixed-scope route to readiness

The Provision 29 Readiness Diagnostic is delivered through Diagnostic SGaaS: fixed scope, four to eight weeks, principal-delivered. The engagement covers four stages.

Materiality scoping. Review of the proposed material control population against principal risks, with the board’s approval criteria documented to a standard the FRC’s guidance anticipates.

Evidence chain review. Assessment of the assurance map against the Marentis Risk Maturity Model™, identifying where evidence is missing, stale, or resting on description rather than testing, with a remediation route attached to every finding.

Declaration dry run. Draft declaration wording presented to the Audit Committee with the evidence pack behind it, challenged through the Red Team Protocol™ before the real reporting cycle applies the same pressure.

Remediation roadmap. A prioritised, board-approved plan closing the gaps the dry run surfaces, sequenced against the balance sheet date.

Boards that want continuous support through the declaration cycle, including the minuted record of independent challenge the signature draws on, extend into Retained SGaaS. The diagnostic stands alone; nothing obliges the extension.

The window is closing on 2026 year-ends

A dry run is now standard practice among FTSE 350 audit committees preparing seriously for the first cycle. Boards that begin scoping in Q3 will not have sufficient testing depth to sign a defensible declaration by year-end. Starting in the first half of the year leaves time to test, remediate, and retest; starting later leaves time to describe.

Provision 29: common questions

When does Provision 29 take effect?

It applies to financial years beginning on or after 1 January 2026. For a company with a December year-end, the first declaration covers the year to 31 December 2026 and appears in the annual report published in 2027.

What counts as a material internal control?

The FRC left materiality to board judgement, calibrated to the firm’s risk profile and stakeholder impact. FTSE 350 boards are typically identifying 30 to 60 material controls, most settling around 35 to 40, spanning financial reporting, operational, reporting, and compliance controls. The population must be reviewed and approved annually.

Can internal audit or our external auditor prepare the declaration for us?

No. Internal audit and external assurance provide inputs, but the FRC expects the board itself to reach independent conclusions on control effectiveness, and independence rules restrict the external auditor from constructing the assurance it will then audit. Independent, board-level challenge has to come from outside both relationships.

What does the Marentis Labs diagnostic deliver?

A fixed-scope, four-to-eight-week engagement covering materiality scoping, an evidence chain review against the Marentis Risk Maturity Model™, a declaration dry run with the Audit Committee, and a prioritised remediation roadmap. Every finding travels with its remediation route.

How is the engagement priced?

Pricing is bespoke and quoted after an initial conversation, fixed for the scope agreed. Marentis Labs does not publish rate cards; scope flexes, the fee does not.