UK Corporate Briefing July 2026

FRC Mythbuster: Auditor Responsibilities under Provision 29 of the UK Corporate Governance Code

Provision 29 of the UK Corporate Governance Code (the “Code”) is a new provision in the 2024 Code requiring Boards to include, in the annual report, a declaration of the effectiveness of the company’s material controls.  To enable companies time to develop their approaches to internal controls, this provision was deferred and applies for financial years beginning on or after 1 January 2026.

The FRC’s ‘mythbuster’ sets out the auditor’s responsibilities in respect of this provision by way of a Q&A. In summary:

• The auditor’s opinion on the financial statements will not cover the Provision 29 statement. The requirements of the relevant UK auditing standards have not been changed or extended in response to changes to the Code.
• The Provision 29 statement constitutes 'other information' for the auditor’s purposes (i.e. financial or non-financial information, other than the financial statements and the auditor’s report, included in the annual report). Under ISA (UK) 720, the auditor's responsibilities are to read and consider the statement alongside the other information in the annual report. The auditor’s objective is to consider whether there is a material inconsistency between the other information and the financial statements or the auditor’s knowledge obtained in the audit. The auditor applies professional judgement to determine what procedures, if any, are needed; performance of those procedures does not represent an assurance engagement.
• Although there may be some overlap, the controls identified by the Board under Provision 29 and those identified by the auditor as part of the audit are not identical and serve different purposes. The Board is required to monitor the company’s risk management and internal control framework and review its effectiveness across all material controls, including financial, operational, reporting and compliance controls. By contrast, the auditor need only obtain an understanding of internal control sufficient to identify and assess the risks of material misstatement of the financial statements. The scope of the auditor’s work in respect of controls is therefore much narrower.
• The auditor's responsibilities in respect of the Provision 29 statement are limited to reading and considering it as other information, and do not extend to testing the design, implementation or operating effectiveness of the material controls identified by the Board. The auditor may, however, choose to test the operating effectiveness of controls as part of their response to assessed risks in the audit, which may include controls that are also material controls under Provision 29.
• Any significant deficiency in internal control identified during the audit forms part of the auditor’s knowledge obtained in the audit. The auditor takes this into account when considering whether a material inconsistency exists between the Provision 29 statement and that knowledge, having regard to their overall understanding of the deficiency, the results of management’s remedial actions prior to the balance sheet date, and any communications with management or the board and audit committee. A significant deficiency, even where it arises in the same area as a material control, does not necessarily contradict the Board concluding that material controls are effective. Where the auditor concludes that the deficiency does not undermine the Board's statement, no further action may be required. However, if the deficiency calls into question statements made in the other information, the auditor must evaluate whether this gives rise to a material misstatement and respond accordingly.
• Where the Board discloses an ineffective material control in the Provision 29 statement in an area relevant to the auditor’s risk assessment, the auditor considers whether this is new information inconsistent with the audit evidence on which the auditor originally based its risk assessment. The auditor may need to undertake additional procedures to understand the nature and impact of the ineffectiveness and how it may affect the risk assessment.
• For listed entities, the UK Listing Rules (UKLR 6.6.20R) require that the auditor reviews certain statements made by the board in the annual report before publication. ISA (UK) 720 assists the auditor in meeting these obligations. However, the Listing Rules do not require the auditor to make reference to these responsibilities or the outcome of the review in the auditor’s report.

For further guidance on Provision 29 of the Code, see the FRC Guidance, paragraphs 295–300, and the FRC Provision 29 ‘mythbuster’.

EU MAR: New rules and how they now differ from UK MAR

The EU Market Abuse Regime (MAR) Changes: Three Key Reforms

Intermediate steps in a protracted process do not need to be announced

EU MAR now provides expressly that the obligation to disclose inside information to the public as soon as possible does not apply to inside information related to intermediate steps in a protracted process. The disclosure obligation is only triggered by the final circumstances or final event that the protracted process is intended to bring about and only once that final event has actually occurred. The Commission has published a non-exhaustive list of final events or final circumstances in common transaction types. For example, in M&A transactions, this will be the signing of the acquisition agreement and on a share buyback, this will be the decision to carry out the buyback.

Under UK MAR and the associated FCA guidance, each intermediate step in a protracted process can itself constitute inside information. Issuers with a UK listing must still assess at each stage of a transaction process whether a given intermediate step is inside information which needs to be announced.

Intermediate steps: Confidentiality replaces the formal delay regime

Because intermediate steps no longer trigger the public disclosure obligation under EU MAR, issuers must ensure the confidentiality of that information which constitutes inside information until it is publicly disclosed.

Criteria for delaying disclosure

One of the previous conditions for delaying disclosure of inside information was if the delay would not be likely to mislead the public. This has been replaced, in EU MAR, with a requirement that the inside information being delayed must not be in contrast with the issuer's latest public announcement or other type of communication on the same matter to which the inside information refers. The new condition is narrower and more objective. To help determine this, the Commission has published a non-exhaustive list of situations where the inside information is in contrast with the latest public announcement or other type of communication.

Under UK MAR, the conditions for a valid delay of disclosure remain the same: (a) legitimate interests likely to be prejudiced; (b) not likely to mislead the public; and (c) confidentiality can be maintained.

Access to the register of members: the proper purpose test

The revised guidance supersedes the 2018 edition and incorporates analysis of new cases to help determine what constitutes a proper purpose and what constitutes an improper one.

Houldsworth establishes that a member wishing to challenge in good faith the way a company is being run should normally be regarded as having a proper purpose, and previous conduct in unrelated matters, including prior litigation, is irrelevant to that assessment. This case also establishes that where a person has multiple rights affording a remedy, they may generally choose which to exercise; here, the member elected to proceed in his capacity as a member rather than as a leaseholder.

Sir Henry Royce confirmed that a request must contain all information prescribed by section 116 of the Companies Act 2006 in a single communication. A subsequent email containing the incomplete information will not render the first (incomplete) request valid. The High Court held that the two emails could not be read together to create a single, valid request. The court found similarly in Exeter Golf and Country Club but the judge, in that case, decided to set out her views on whether the request was valid and found that the request by a member to inspect the register to canvass support for a general meeting with a view to challenging the board's decisions was for a proper purpose.

In Aviva plc the judge held that a request for the purpose of making a “mini-tender” offer (an offer to retail shareholders owning together less than 5% of the total issued share capital to buy their holdings at a discount before selling them on at market value) constituted a proper purpose. The High Court found that profit-seeking alone is not an improper purpose and, absent "something with a flavour of the genuinely exploitative or unscrupulous", a purpose would not be deemed improper for being part of a commercial activity. The court also confirmed that the proper purpose test does not depend on the good character of the person making the request, or on whether that person is a 'proper and reputable person'. These factors are not relevant, unless they impact the identification of the true purposes of the request or on the ability of the person to pursue the purpose set out in the request.

Lastly, in BCNO Ltd the High Court referred to earlier decisions confirming that where a request does not comply with section 116, the court has no power to make the order sought.