The UK Corporate Governance Code 2024: What Boards Need to Know

The UK Corporate Governance Code sets the benchmark for how boards of the UK’s largest listed companies should lead, oversee and account for their businesses. In January 2024 the Financial Reporting Council (FRC) published a revised version, the UK Corporate Governance Code 2024. Compared with some earlier revisions the changes are targeted rather than sweeping, but one of them, the new internal controls declaration in Provision 29, represents a significant step-change in board accountability.

The 2024 Code applies to financial years beginning on or after 1 January 2025, with Provision 29 taking effect for financial years beginning on or after 1 January 2026. Many boards are therefore now reporting against the Code for the first time in its revised form, while preparing for their first internal controls declaration.

This guide explains what the Code is, how comply-or-explain works, what each of the five sections requires, what has changed, and why private companies, including SMEs and scale-ups that will never list, can learn a great deal from it.

What is the UK Corporate Governance Code?

The Code is a set of Principles and Provisions describing good governance practice. It is published and maintained by the FRC, and the most recent version, along with supporting guidance, is available on the FRC website. The Code is not itself legislation. Instead, the FCA’s listing rules require companies in the relevant listing category, broadly the commercial companies category that replaced the former premium segment, to report on how they have applied the Code’s Principles and whether they have complied with its Provisions.

The Code sits alongside, not instead of, directors’ statutory duties under the Companies Act 2006, including the duty under section 172 to promote the success of the company having regard to stakeholders and long-term consequences. In practice, the Code describes the board structures and behaviours that help directors discharge those duties well.

How comply-or-explain works

The Code is built on a “comply or explain” approach. It distinguishes between two types of content:

• Principles are high-level statements of good governance. Companies are expected to apply them and to report on how they have done so in a way that lets shareholders evaluate it.
• Provisions are more detailed practices. Companies should comply with them or, where they choose a different approach, provide a clear and meaningful explanation.

The FRC has long emphasised that a well-reasoned explanation is a legitimate outcome, not a failure. The 2024 Code reinforces this and places greater emphasis on outcomes-based reporting: boards should explain the activity they have undertaken and what it has achieved, rather than describing policies in boilerplate terms. A good explanation sets out the context, the alternative approach taken, how it supports the company’s success and, where relevant, any timetable for returning to compliance.

The five sections of the Code

The Code is organised into five sections. The table below summarises their focus.

Section	Focus	Typical board questions
1. Board leadership and company purpose	Purpose, values, strategy, culture and stakeholder engagement	Is our purpose clear and reflected in decisions? How do we assess culture and engage with the workforce?
2. Division of responsibilities	Roles of chair, CEO, independent non-executives and company secretary; board resources	Is there a clear division between running the board and running the business? Do directors have enough time?
3. Composition, succession and evaluation	Board skills, diversity, appointments, succession and annual evaluation	Does the board have the right mix of skills and perspectives? Is succession planned?
4. Audit, risk and internal control	Integrity of reporting, audit committee, risk management and internal controls	Are our risk management and internal control frameworks effective, and can we evidence it?
5. Remuneration	Policies and practices that support strategy and long-term success	Is pay aligned with performance, culture and the wider workforce? Can we recover awards if needed?

1. Board leadership and company purpose

The first section calls on the board to establish the company’s purpose, values and strategy and to satisfy itself that these and its culture are aligned. It expects the board to understand the views of key stakeholders, including the workforce, and to describe how their interests have been considered in board discussions and decisions.

2. Division of responsibilities

This section addresses who does what. The chair leads the board and should be independent on appointment; the roles of chair and chief executive should not be exercised by the same individual. At least half the board, excluding the chair, should be independent non-executive directors. The section also covers the time commitment expected of directors and the board’s access to the resources and information it needs. The 2024 Code strengthens expectations on disclosing directors’ significant external commitments and how the board is satisfied that each director has sufficient time.

3. Composition, succession and evaluation

Appointments should be based on merit and objective criteria and should promote diversity and inclusion. The nomination committee should lead a formal, rigorous and transparent appointment process and maintain an effective succession plan. The board should undertake an annual evaluation of its performance, with an externally facilitated evaluation for FTSE 350 companies at least every three years. The 2024 revision broadens the language on diversity, focusing on diversity, inclusion and equal opportunity more generally, and expects reporting on how diversity and inclusion policies have operated in practice.

4. Audit, risk and internal control

This section covers the integrity of financial and narrative reporting, the role of the audit committee and the board’s responsibility for risk management and internal controls. In the 2024 revision, some detailed audit committee content was removed from the Code, with companies instead expected to report on the work of the audit committee by reference to the FRC’s minimum standard for audit committees and the external audit. This section also contains the most important new requirement, Provision 29, which we discuss below.

5. Remuneration

Remuneration policies and practices should be designed to support strategy and promote long-term sustainable success. Executive pay should be aligned with company purpose, values and the wider workforce. The remuneration committee should exercise independent judgement and discretion rather than relying mechanically on formulae.

Provision 29: the internal controls declaration

Provision 29 is the headline change in the 2024 Code. It applies for financial years beginning on or after 1 January 2026. The board should monitor the company’s risk management and internal control framework and, at least annually, carry out a review of its effectiveness. The annual report should then include:

• a description of how the board has monitored and reviewed the effectiveness of the framework;
• a declaration of effectiveness of the material internal controls as at the balance sheet date; and
• a description of any material controls that have not operated effectively as at the balance sheet date, the action taken or proposed to improve them, and any action taken to address previously reported issues.

Material controls are not limited to financial reporting. Depending on the company, they may include operational, compliance and reporting controls, for example over cyber security, health and safety, data protection, fraud prevention or regulatory compliance. The FRC’s guidance leaves it to each board to decide which controls are material for its business, which means the judgement, and the evidence behind it, rests with directors.

How boards should prepare

1. Define materiality. Agree a clear, documented basis for identifying material controls, linked to the principal risks.
2. Map controls to risks. Make sure each principal risk has identified controls, owners and testing arrangements.
3. Build an assurance map. Consider the three lines model: management, risk and compliance functions, and internal and external assurance. Identify gaps and overlaps.
4. Test and evidence. Agree how effectiveness will be tested and documented in time for the board to form a view at the balance sheet date.
5. Test early in the year. Many boards treated the year before the requirement applied as a dry run. Now that it is in force, interim testing during the first in-scope year helps identify deficiencies while there is still time to remediate before the balance sheet date.

The declaration is about the effectiveness of controls, not a guarantee that nothing will go wrong. It is, however, a public statement made by the board, so directors will want confidence in the process behind it. Our guide to building a risk management framework covers the foundations.

Malus and clawback

The Code has for some time expected remuneration schemes and policies to include provisions enabling the company to recover or withhold sums or share awards in specified circumstances, commonly called malus (reducing or cancelling awards before they vest or are paid) and clawback (recovering amounts already paid). The 2024 Code strengthens the related disclosure. Companies should describe their malus and clawback provisions in the annual report, including the circumstances in which they could be used, the minimum period for which they apply and whether they have been used during the reporting period. This is intended to give shareholders a clearer picture of how accountability for executive pay works in practice.

Other notable changes in the 2024 Code

• Outcomes-based reporting. A stronger emphasis on reporting the outcomes of governance activity, not simply describing policies and processes.
• Fewer duplications. Some content that overlapped with other requirements or guidance, notably around the audit committee, was removed.
• External commitments. Greater transparency on directors’ significant external appointments and time commitment.
• Diversity and inclusion. Broader language and reporting on how policies operate and their effectiveness.

The FRC also published accompanying Code Guidance in January 2024, which offers practical ideas rather than additional requirements. Boards should read the Code and Guidance together.

What private companies can learn from the Code

The Wates Principles for large private companies

The Code does not apply to private companies. However, the Companies (Miscellaneous Reporting) Regulations 2018 require very large private companies, broadly those with more than 2,000 employees or with turnover and balance sheet totals above high thresholds, to state which corporate governance code, if any, they apply and how. To meet this need, the FRC published the Wates Corporate Governance Principles for Large Private Companies in December 2018. They set out six principles:

1. Purpose and leadership
2. Board composition
3. Director responsibilities
4. Opportunity and risk
5. Remuneration
6. Stakeholder relationships and engagement

The Wates Principles operate on an “apply and explain” basis. They are deliberately less prescriptive than the Code, recognising the wide variety of private company ownership structures, from family businesses to private equity portfolio companies.

Proportionate lessons for SMEs and scale-ups

Smaller private companies are not required to follow either the Code or the Wates Principles, but both offer a useful blueprint. A proportionate approach might include:

• Separating the roles. Where the founder is both chair and CEO, consider appointing an independent chair or at least one independent non-executive director to provide challenge.
• Clarifying purpose and culture. Agree a short statement of purpose and values and check periodically that decisions reflect them.
• Basic committee discipline. Even without formal committees, set aside agenda time each year for audit and risk, nominations and succession, and remuneration.
• Annual board evaluation. A short, honest review of skills, information and dynamics often identifies quick wins.
• A risk register and control owners. Mirroring the spirit of Provision 29, know your principal risks and who owns the controls over them.
• Remuneration with accountability. If you introduce bonuses or share schemes, consider how performance conditions and leaver provisions protect the company.

Investors and acquirers increasingly expect this kind of discipline. Companies planning to raise capital, sell or eventually list will find that adopting good governance early makes due diligence smoother and supports valuation. Our governance scorecard offers a quick way to benchmark where you stand.

Next steps for boards

For listed boards, the immediate priorities are to embed outcomes-based reporting, finalise their approach to material controls and test the evidence that will support the first Provision 29 declaration. For private companies, the task is to choose which elements of the Code or the Wates Principles are proportionate and to build them into the board’s annual cycle. In both cases, governance works best when it is treated as a tool for better decisions rather than a compliance exercise. Our governance advisory team can help with either.

Frequently asked questions

When does the UK Corporate Governance Code 2024 apply?

It applies to financial years beginning on or after 1 January 2025. Provision 29, the internal controls declaration, applies to financial years beginning on or after 1 January 2026.

Which companies must report against the Code?

Companies whose shares are listed in the relevant category of the FCA’s listing regime, broadly the commercial companies category that replaced the premium segment, must report on how they apply the Code. Other companies may adopt it voluntarily.

What does comply-or-explain mean?

Companies should apply the Code’s Principles and either comply with each Provision or explain clearly why they have taken a different approach. A well-reasoned explanation is a legitimate outcome and should help shareholders understand the company’s governance.

Does Provision 29 mean the board guarantees there are no control failures?

No. The board declares whether its material internal controls were effective as at the balance sheet date and describes any that were not, along with remediation. It is a statement about the effectiveness of controls, supported by evidence, not a guarantee.

Do private companies need to follow the Code?

No. Very large private companies must report on their governance arrangements and often use the Wates Principles. Smaller private companies have no obligation but can adopt proportionate elements of the Code to strengthen decision-making and investor confidence.

Last reviewed: 2 June 2026