While the Financial Reporting Council’s (FRC) revised UK Corporate Governance Code is not as wide-ranging as originally expected, it has significantly increased boards’ responsibility for risk management oversight.
In addition, the code now requires governance reporting to focus on board decisions and outcomes in the context of an organisation’s strategy and objectives. Reporting on corporate culture and the way it has been embedded is also a requirement – as is the need to discuss diversity policies.
The code comes into force for accounting periods on or after I January 2025, except for the section on internal controls, which applies from 1 January 2026. Guidance is available.
Risk management
The section on internal controls – Provision 29 – affects risk management directly because it expands the area of focus for risk professionals and the board.
The board now needs to monitor both the risk management processes and internal control framework, reporting how it has done so in the company’s annual report.
In particular, says the Code, the board must provide a description of how the it has monitored and reviewed the effectiveness of the internal control framework in the report – and how effective material controls are. Finally, it says, they must give “a description of any material controls which have not operated effectively as at the balance sheet date, the action taken, or proposed, to improve them and any action taken to address previously reported issues.”
Major overhaul
The FRC said that it has made these changes because of pressure from investor and stakeholder groups to see better quality reporting on risk management and internal controls – and the oversight systems that govern them.
The FRC has left boards to decide issues such as the materiality of risks and what assurance is required that they are being managed. But following feedback during the consultation process, risk managers are likely to have a lot of work both redesigning their risk management and control frameworks and operationalising those by the 2026 deadline.
