Reporting Under Provision 29 UK Corporate Governance Code: A Focus On Cyber

As companies prepare for mandatory reporting in 2027 under Provision 29 of the UK Corporate Governance Code (which applies to financial years beginning on or after 1 January 2026), the Financial Reporting Council (FRC) has published a timely new Provision 29 Mythbuster. The Mythbuster aims to assist companies with reporting on cyber security under Provision 29 (including in the context of the board’s “declaration of effectiveness” of the company’s material controls) and recognises that, for many companies, controls relating to cyber security are likely to be material controls.

Future risks: The Mythbuster provides a helpful reminder that the declaration of effectiveness is at the company’s balance sheet date and that there is no expectation that the declaration looks beyond that date. While acknowledging that point-in-time assurance does not imply enduring protection and the declaration of effectiveness cannot cover unknown future cyber security risks, the FRC echoes commentary