What Every NED Should Know About UK Corporate Governance Reform

UK corporate governance has been through a significant reset over the past two years — and the change lands squarely on the shoulders of non-executive directors. The Financial Reporting Council’s 2024 UK Corporate Governance Code is now in force, its headline internal-controls declaration applies to financial years beginning on or after 1 January 2026, and the wider statutory audit reform that was meant to accompany it has been abandoned. Around that core sit the UK Listing Rules, the Economic Crime and Corporate Transparency Act 2023, Companies House reform and the new UK Sustainability Reporting Standards. For a NED, the practical question is not whether governance is changing but what the current rules actually require of you, what has been dropped, and where your personal accountability now sits. This guide sets out the position as it stands in November 2026, rather than as it was once promised.

Boards that treat this as a compliance exercise will miss the point. The direction of travel — outcomes over process, evidenced assurance over narrative comfort, individual director accountability over collective reassurance — reshapes what an effective non-executive actually does in the boardroom. If you are appointing to a board, or stepping onto one, understanding that shift is now part of the job. Exec Capital places non-executive directors who understand it through our NED recruitment practice, and we work with boards that want to rebalance their skills mix as the regime tightens.

How UK governance got here

The modern UK framework traces to the Cadbury Report of 1992, which followed a run of corporate failures and first codified the principles of transparency, accountability and boardroom effectiveness that still underpin the system. The Greenbury Report (1995) addressed executive remuneration, the Hampel Report (1998) consolidated earlier work into the first Combined Code, and the Higgs Review (2003) sharpened the role and independence of non-executive directors specifically. Each was a response to a crisis of confidence, and each pushed accountability further onto the board rather than management alone.

That lineage matters because the 2024 Code is the latest iteration of the same idea, not a departure from it. The pattern is consistent: a governance failure exposes a gap between what boards say they oversee and what they can actually evidence, and the response tightens the obligation on directors — and disproportionately on the independent ones — to provide credible, testable assurance. Carillion, BHS and Patisserie Valerie are the more recent names in that sequence. They prompted Sir John Kingman’s 2018 independent review of the FRC, which recommended replacing the regulator with a stronger statutory body, and Sir Donald Brydon’s review of the quality and effectiveness of audit the following year.

What followed was a long consultation cycle. The Government’s 2021 white paper, Restoring trust in audit and corporate governance, set out a package that included a new regulator, a wider definition of public interest entities, director sanctions for reporting failures, resilience statements and audit and assurance policies. Some of that thinking found its way into the 2024 Code; the statutory elements never reached the statute book. Understanding which is which is now one of the more useful things a NED can bring to a board discussion.

The 2024 Code: what has actually changed

The 2024 UK Corporate Governance Code was published by the FRC in January 2024 and applies for financial years beginning on or after 1 January 2025. Structurally it is close to the 2018 edition — the same five sections and the same “comply or explain” basis. Its application now runs through the UK Listing Rules (UKLR), which replaced the old Listing Rules in July 2024 and collapsed the premium and standard segments into a single commercial companies category. Companies in that category must state in the annual report how they have applied the Code’s principles and explain any departure from its provisions. Notably, the FRC did not carry forward much of what it consulted on in 2023; a substantial share of the proposed changes, including several on ESG and committee remits, were dropped after consultation. The Code that emerged is deliberately shorter and more focused than the version some boards were bracing for.

The changes that did survive concentrate in a few areas. First, an outcomes emphasis: boards are expected to report on the outcomes of their governance activities in the context of strategy, rather than describing processes, and to give clear, meaningful explanations where they depart from a provision. Second, sharper expectations on time commitment, with the annual report expected to describe directors’ other significant commitments and how the board is satisfied they have enough time for the role. Third, clearer disclosure on malus and clawback arrangements in executive pay. Fourth — and this is the defining shift — a materially expanded Provision 29 on internal controls. The FRC has also brought its Audit Committees and the External Audit: Minimum Standard, first published in 2023 for FTSE 350 companies, within the Code’s reach, so audit committees across the Code population are now expected to apply it on a comply or explain basis.

Provision 29: the internal-controls declaration

Provision 29 is the single most significant change in the 2024 Code, and it is the one every NED should understand in detail. It applies for financial years beginning on or after 1 January 2026 — a year later than the rest of the Code — which means a company with a December year end is now in its first declaration period, and the first declarations will appear in annual reports published in 2027. It asks the board to monitor and review the company’s risk management and internal control framework at least annually, and then to make a formal declaration in the annual report as to whether the company’s material controls were effective as at the balance sheet date.

In practical terms the annual report must set out:

• how the board monitored and reviewed the effectiveness of the risk management and internal control framework over the reporting period;
• a declaration of whether the board considers the material controls to have been effective as at the balance sheet date; and
• where controls did not operate effectively, the material weaknesses identified and the remediation or improvement plans in place.

The scope expressly covers financial, operational, reporting and compliance controls — not financial controls alone. Crucially, the declaration is limited to material controls, and what counts as material is for each board to determine in light of its own size, business model, strategy and complexity. There is no prescribed list, and the FRC has been clear that it is not asking for a UK version of the US Sarbanes-Oxley regime or for external audit of the declaration. That discretion is a genuine judgement call, and it is one the board — advised by its audit and risk committee — owns.

The shift Provision 29 represents is easy to state and hard to deliver: boards move from “we have controls” to “we can demonstrate, on evidence, that our material controls were effective at the year end.” A documented policy is no longer enough. That raises the bar for the assurance a board needs before it can sign the declaration, and it puts the audit and risk committee — and the independent directors who sit on it — at the centre of the exercise. Boards that have not yet run a full walk-through of how the declaration will be evidenced should do so well before the year-end close, not after it.

The reform that has stalled — and why it matters

Here is where a NED needs to separate what is live from what was only ever promised. The Code changes above are real and in force. The wider statutory reform that was meant to sit alongside them is not — and is now off the table for the foreseeable future.

For years the expectation was that the Kingman review’s central recommendation — replacing the FRC with a stronger statutory regulator, originally to be called the Audit, Reporting and Governance Authority (ARGA) — would be delivered through an Audit Reform and Corporate Governance Bill. That Bill was revived in the July 2024 King’s Speech, then repeatedly delayed. A draft Bill was never published: in early January 2026 the Department for Business and Trade said in a written parliamentary answer that it did not intend to publish one in the current session. By then the proposed regulator had been rebadged the Corporate Reporting Authority. Later the same month the Government went further and confirmed it would not proceed with the Bill at all, citing its deregulatory growth agenda, the improvements already made by auditors and the FRC, and pressure on parliamentary time.

The measures that fell away with it are worth listing, because some governance commentary still treats them as imminent:

• a new statutory regulator with stronger enforcement powers in place of the FRC;
• a wider definition of public interest entities, extending audit oversight to the largest private companies;
• a statutory regime allowing the regulator to investigate and sanction directors — not just auditors — for serious corporate reporting failures; and
• proposals for resilience statements, audit and assurance policies and managed shared audit for larger listed companies.

The practical consequence for a board is straightforward. The FRC remains the regulator and continues to work through its existing powers, its standards and the Code itself. A statutory director-sanctions regime for reporting failures does not exist and has no timetable. A NED should therefore be precise: your accountability under the 2024 Code is real and immediate; the harder statutory backstop has gone. Governance content that still describes ARGA as on its way is out of date, and boards relying on it are planning for a regime that is not coming. That does not mean the ideas are dead — some boards will adopt audit and assurance policies voluntarily, and investors may ask for them — but they are choices, not obligations.

The statutory duties that have not changed

Beneath the revised Code and the abandoned Bill sits a bedrock that is stable: the statutory duties of directors under the Companies Act 2006. These apply to executive and non-executive directors alike, and they are the foundation of everything a NED does. Company law makes no distinction between the two when it comes to liability; a non-executive is a director in every legal sense.

Directors must act within their powers, exercise independent judgement, and exercise reasonable care, skill and diligence — judged both by the general knowledge and experience reasonably expected of a person carrying out the role and by the knowledge and experience the director actually has. A NED who is a chartered accountant sitting on the audit committee is held to a higher standard on financial matters than one who is not. Directors must avoid conflicts of interest, must not accept benefits from third parties, and must declare interests in proposed transactions. And under section 172, they must act in the way they consider, in good faith, would be most likely to promote the success of the company for the benefit of its members as a whole — while having regard to the longer-term consequences, the interests of employees, relationships with suppliers and customers, the impact on the community and environment, the company’s reputation, and the need to act fairly between members.

The section 172 statement in the strategic report is where that duty becomes visible, and it is where the outcomes emphasis of the 2024 Code and the stakeholder-consideration duty in statute meet. Balancing those interests well is a defining NED skill, and one we explore separately in our guide to how NEDs help balance shareholder and stakeholder interests. When a company is in or near insolvency, the focus shifts further: directors must have regard to the interests of creditors, and the wrongful trading provisions of the Insolvency Act 1986 remain the sharpest personal-liability risk most non-executives will ever face.

The wider reforms on the NED agenda

The Code is the reform most boards talk about, but it is not the only one that changes a non-executive’s exposure. Several pieces of legislation and regulation have come into force alongside it, and they apply far more widely than the listed-company population the Code covers.

Economic Crime and Corporate Transparency Act 2023

The Economic Crime and Corporate Transparency Act 2023 (ECCTA) carries two changes that matter directly in the boardroom. First, the corporate offence of failure to prevent fraud came into force on 1 September 2025. It applies to large organisations — broadly those meeting two of three tests on employees, turnover and balance sheet — and makes the organisation criminally liable where an employee, agent or other associated person commits a specified fraud intended to benefit it. The only defence is that the organisation had reasonable fraud prevention procedures in place. That makes fraud risk assessment and prevention procedures a board-level oversight matter, and it sits naturally alongside the Provision 29 work on compliance controls. Second, the Act widened the basis on which a company can be criminally liable for economic crimes committed by its senior managers, which raises the stakes on who is acting for the business and how they are supervised.

Companies House reform and identity verification

ECCTA also gave Companies House new powers to query, reject and remove information from the register. The most visible change for directors arrived on 18 November 2025, when identity verification became compulsory for new directors and people with significant control. Existing directors have been given a 12-month transition, confirming their verification when the company files its next confirmation statement, so most will need to have done it by November 2026. Failing to comply is an offence. A NED who sits on several boards should check that each appointment has been linked to their personal code — it is a small administrative step, but the kind that a board secretary can miss across a group structure. Further phases of the Companies House programme, including changes to how accounts are filed, are still being rolled out.

Sustainability reporting: UK SRS

The Government published the final UK Sustainability Reporting Standards, UK SRS S1 and UK SRS S2, in February 2026. They are the UK-endorsed versions of the ISSB standards. The FCA has since set out, in PS26/19, how listed issuers will report against them: on a comply or explain basis for accounting periods starting on or after 1 January 2027, with first reports in 2028 and transitional reliefs for Scope 3 emissions and wider sustainability disclosures. For NEDs on listed boards, that means sustainability data will need the same kind of controls and assurance discipline as financial data — another reason Provision 29’s inclusion of reporting controls matters.

Regulated firms: SMCR on top

For banks, insurers, asset managers and other FCA and PRA-regulated firms, the Code is only part of the picture. The Senior Managers and Certification Regime places individual, documented responsibilities on the chair and on the chairs of the audit, risk, remuneration and nomination committees, with regulatory approval required before they take up the role. That is a genuine personal-accountability regime, and it means independent directors on regulated boards already live with the kind of individual exposure the abandoned audit reform would have extended elsewhere. Firms appointing to these seats should look closely at financial services non-executive recruitment and, for the top seat, chair of regulated firm recruitment, where the approval process shapes the timetable as much as the search does.

What this means for the NED role in practice

Read together, the live Code changes, the new statutory offences and the stable directors’ duties point to a clear expansion of what independent directors are expected to do. The role is moving from oversight-by-assurance-received to oversight-by-assurance-tested.

Own the internal-controls conversation

Provision 29 makes internal-controls effectiveness a board declaration, not a management assertion. NEDs — particularly those on the audit and risk committee — need to understand how material controls are identified, tested and monitored across the year, and to be satisfied that the evidence supports the declaration before it is signed. That means engaging with internal audit, risk and finance functions on the substance of assurance, not just receiving their reports. If your board has not yet agreed its material controls and the evidence behind each one, that is the priority for the current cycle.

Push for evidence, not comfort

The outcomes emphasis of the 2024 Code rewards boards that can show what their governance actually achieved, and penalises boilerplate. A NED’s value here is the constructive challenge that separates a genuine control environment from a well-documented one. The question shifts from “do we have a policy?” to “can we demonstrate it operated?” — and asking it early, repeatedly and without embarrassment is precisely the independent contribution the framework is designed to elicit. The same applies to fraud prevention procedures under ECCTA: the defence depends on procedures being reasonable in practice, not on their existence on paper.

Keep independence real, not nominal

Independence remains the currency of the non-executive role. The Code’s criteria — tenure, financial interests, relationships with the company — are the starting point, but the substance is behavioural: the willingness to disagree with management in the room, to recuse where impartiality is compromised, and to hold a line on assurance when it would be easier to accept comfort. In a regime that has tightened accountability through the Code while abandoning the statutory backstop, the board’s own independent directors are the enforcement mechanism.

Get the composition right for what is coming

Provision 29 raises the premium on boards that carry genuine financial, risk and controls literacy among their non-executives, and on a well-run audit and risk committee. UK SRS reporting adds a need for directors who can oversee non-financial data with the same rigour. Succession planning should reflect that: the skills a board needed to receive assurance are not identical to the skills it needs to test and declare it. Our board construction guide sets out how to map skills against strategy, and where a wider refresh is needed our board of directors recruitment work covers executive and non-executive seats together. The Code’s new emphasis on time commitment also matters here — a NED with five other boards may not have the capacity a Provision 29 audit committee chair needs.

A practical checklist for the current cycle

If you sit on — or are joining — a UK board caught by the Code, these are the questions worth pressing now:

• Has the board identified and documented its material controls, and is the basis for materiality defensible and company-specific?
• Is there a credible assurance model — internal audit, management testing, or a combination — capable of supporting the first Provision 29 declaration?
• Has the audit committee walked through how the declaration will be evidenced before the year-end close, and agreed how any material weakness will be reported?
• Does the audit committee’s work on the external audit meet the FRC’s Minimum Standard, or does the annual report need to explain a departure?
• If the company is a large organisation under ECCTA, has the board seen a fraud risk assessment and satisfied itself that prevention procedures are reasonable?
• Has every director, executive and non-executive, completed Companies House identity verification for each role they hold?
• Does governance reporting focus on outcomes and decisions, or has it drifted into process narrative that the 2024 Code discourages?
• Is the section 172 statement genuinely reasoned, or formulaic — and does it reflect real board deliberation on stakeholder interests?
• For listed companies, is there a plan for UK SRS reporting from 2027 periods, including who owns the data and the controls over it?
• Is the board’s composition, and its audit and risk committee in particular, equipped to test assurance rather than merely receive it?

Where Exec Capital fits

The through-line of every reform in this article is the same: the independent director is being asked to carry more, on the record, without the external backstop the abandoned statutory reform would have provided. That makes the calibre and genuine independence of a board’s non-executives more consequential than at any point since the last wave of governance failures. Getting those appointments right — the right controls literacy, the right committee experience, the right temperament for constructive challenge — is a search problem, and it is ours.

Exec Capital advises boards on non-executive and chair appointments across listed, private equity-backed and regulated environments. Our specialist team runs each search, with Adrian Lawrence FCA — a chartered accountant and former listed-company finance director who has worked on the other side of these obligations — overseeing every mandate. If your board is working through the 2024 Code and Provision 29 and wants its non-executive bench to match what the regime now demands, our non-executive director search team can help you define the brief and find the right people.

Frequently asked questions

When does Provision 29 of the UK Corporate Governance Code apply?

For financial years beginning on or after 1 January 2026. The rest of the 2024 Code applies to financial years beginning on or after 1 January 2025. For a December year-end company, the first material controls declaration will appear in the annual report for the 2026 financial year, published in 2027.

Is ARGA still going to replace the FRC?

No. The Government confirmed in January 2026 that it would not proceed with the Audit Reform and Corporate Governance Bill, and no draft Bill was ever published. The FRC remains the regulator, and there is no statutory regime for sanctioning directors over reporting failures.

Does the UK Corporate Governance Code apply to private companies?

Not as a requirement. It applies on a comply or explain basis to companies with a listing in the UKLR commercial companies category. Many large private companies report against the Wates Principles instead, and some private equity-backed and private boards use the Code voluntarily as a benchmark.

Do non-executive directors have to verify their identity with Companies House?

Yes. Identity verification applies to all directors, executive and non-executive. It has been compulsory for new appointments since 18 November 2025, and existing directors confirm it with the company’s next confirmation statement during the 12-month transition.

Are NEDs personally liable under the failure to prevent fraud offence?

The offence is a corporate one: it is the organisation that is prosecuted, not individual directors. But the defence rests on reasonable prevention procedures, which the board is expected to oversee, and individuals who commit or are complicit in fraud remain liable under the ordinary criminal law.