Board Risk and Internal Controls

The Financial Reporting Council's UK Corporate Governance Code addresses material internal controls through a board declaration, while its accompanying guidance addresses assurance and review. The UK's Cyber Governance Code of Practice addresses board responsibilities for cyber security, including reporting and incident-plan exercises. Across these documents, oversight encompasses the information reaching the board, the assurance available to it and the action following a review.

The UK declaration and its scope

The FRC published the 2024 UK Corporate Governance Code on 22 January 2024. Its scope covers companies listed in the commercial companies category or the closed-ended investment funds category, regardless of where they are incorporated. For those companies, elements of the UK Listing Rules require application of the Code's Principles and compliance with, or explanation against, its Provisions.

The 2024 Code applies to financial years beginning on or after 1 January 2025. Provision 29 has a later application date: financial years beginning on or after 1 January 2026. It asks boards to make a declaration in relation to the effectiveness of their material internal controls.

Choosing assurance

The FRC's Corporate Governance Code Guidance, published on 29 January 2024 and last updated on 3 June 2026, states that neither the Code nor the guidance requires or expects companies to obtain external advice or assurance on material-control effectiveness. Whether external assurance is necessary is a decision for the board, in conjunction with other committees and management.

An effective internal audit function is relevant to that judgement. The guidance says external advice or assurance may be unnecessary, particularly where internal audit is appropriately resourced to provide assurance over the framework's effectiveness. The board's decision about external assurance can therefore take account of the assurance available through internal audit and its capacity to examine the framework.

The type and nature of assurance are also for the board to decide. The FRC says boards may wish to discuss these matters with their investors.

Reviewing the framework and following through

The guidance calls for the board to review the effectiveness of the risk management and internal control framework at least annually. It also allows for more frequent review of the whole framework, or parts of it, depending on the company's circumstances.

The review should identify strengths, gaps, deficiencies and areas for improvement, and should be followed by a plan to take forward any actions. The follow-through is an action plan arising from the review, connecting the assessment of the framework to work on the areas identified for improvement.

Cyber governance within the wider structure

The UK's Cyber Governance Code of Practice was published on 8 April 2025 for boards and directors of public-sector and private organisations. It is not intended for those responsible for day-to-day cyber security management, although it can highlight board responsibilities. Its recommendations concern governance: the structure through which responsibilities are assigned and the reporting through which oversight is exercised.

The Code recommends embedding a cyber governance structure within the organisation's wider governance structure. That includes clear definitions of roles and responsibilities, with ownership of cyber at executive and non-executive director level.

Reporting, rehearsals and revision

The Cyber Governance Code recommends requiring formal reporting at least quarterly. Suitable metrics are to be set and tolerances agreed for each, aligned with the cyber strategy and based on the agreed cyber risk appetite. The reporting recommendation brings together frequency, measures and tolerances: reports are recurring, and the measures have an agreed relationship to strategy and the organisation's appetite for cyber risk.

The Code also recommends gaining assurance that the incident plan is exercised at least annually, involving relevant internal and external stakeholders. Lessons from the exercise are to be reflected in the incident plan and risk assessments.

The Code connects exercise findings to the incident plan in Action D1 and risk assessments in Action A5. Its reporting recommendation refers to the cyber strategy in Action B1 and the agreed cyber risk appetite in Action A3, linking the measures and tolerances to those wider governance decisions.