Provision 29 / Cyber Governance / Internal Controls | 7 min read | Raayzel Business Consulting

Cyber controls under Provision 29: what the FRC’s new guidance means for boards and CFOs

On 23 September 2026, the Financial Reporting Council published a new Provision 29 Mythbuster specifically focused on cyber security. It is the most practically useful guidance the FRC has issued since Provision 29 came into force on 1 January 2026 and it addresses questions that boards have been sitting with since the Code’s requirements first became clear.

Most commentary on the mythbuster has focused on what it permits companies not to disclose. That is understandable: the guidance confirms that the board declaration does not need to include commercially sensitive technical details, that reporting on cyber controls does not guarantee a company will never experience a cyber incident, and that granular disclosure of specific technical controls is not required. Those are reassuring clarifications for many boards that have been anxious about cyber disclosure creating a roadmap for attackers.

But the focus on what companies do not have to disclose risks obscuring the more important question that the mythbuster is really raising: what boards do have to build, maintain, and demonstrate in order to make a credible effectiveness declaration on their cyber material controls. That is the governance design question, and the answer to it is more demanding than the disclosure relief the mythbuster provides might suggest.

This article examines what the FRC’s new guidance actually requires from a governance perspective, what it means for the boards that are currently in the middle of their Provision 29 evidence-building window, and what CFOs need to understand about the relationship between cyber controls and the declaration they will be making in 2027.

What the FRC has confirmed about cyber and Provision 29

The mythbuster makes several specific points that are directly useful for governance planning.

First, it confirms that for many companies, controls relating to cyber security are likely to be material controls within the meaning of Provision 29. This is not a surprise. Cyber risk has been identified as one of the most significant risks facing UK listed companies across multiple regulatory communications. What the mythbuster does is explicitly connect cyber risk to the Provision 29 material controls framework, confirming that boards cannot treat cyber governance as a separate technology matter that sits outside the internal controls declaration.

Second, it confirms that the FRC expects the board to keep cyber risks, controls, and resilience arrangements under regular review, adapting them as the threat landscape and the company’s own exposure change. This is the continuous monitoring requirement applied specifically to cyber. It is not sufficient to assess cyber controls annually and declare them effective at the balance sheet date without a governance process that has maintained visibility of the controls throughout the year as the threat environment evolved.

Third, it addresses the commercially sensitive disclosure concern directly. The declaration should be focused on the organisation’s assurance process and its outcome, rather than disclosing the specific technical controls used to prevent or mitigate harm from an incident. This means the board describes how it has monitored and reviewed cyber controls and what conclusion it reached, not what technical defences the company has deployed. The outcome of the assurance process is disclosable. The technical details of the controls are not required.

Fourth, and crucially for the CFO context, the mythbuster confirms that a Provision 29 declaration on cyber controls is not a promise that the company will never suffer a cyber incident. The declaration is about the effectiveness of controls as at the balance sheet date, based on the evidence available from the board’s monitoring and review activity throughout the year. A company can make a genuine effectiveness declaration and subsequently suffer a material cyber incident without the declaration being false, provided the controls were genuinely operating effectively at the time of the declaration and the incident arose from circumstances not covered by the control framework as it was designed.

What the guidance is not telling boards

The mythbuster is a clarification document. It answers specific questions about the Provision 29 disclosure requirements in the cyber context. What it does not do, and what most boards still need to work through independently, is specify what a board-grade cyber controls governance process looks like in practice.

The governance gap that the mythbuster leaves open is significant. The FRC confirms that boards need to monitor cyber controls continuously and review their effectiveness at least annually. It confirms that material cyber controls need to be identified, evidenced, and declared. What it does not specify is how boards who have not previously governed cyber controls at this level of rigour should design and implement the governance process that makes a credible Provision 29 declaration possible.

That governance design question is the one that most boards are currently navigating without sufficient guidance. The FRC’s mythbuster series has clarified the disclosure output. The governance input, the process that generates the evidence base for the declaration, is the harder problem and the one that most boards have not yet fully resolved.

The material controls scoping challenge for cyber

One of the most practically significant disclosures in the FRC’s mythbuster series is the confirmation that most companies are identifying somewhere between 30 and 50 material controls overall, with financial sector companies typically having more. That figure provides a useful benchmark but it raises an immediate question for boards working on their Provision 29 scoping: how many of those material controls relate to cyber security, and are they the right ones?

The challenge with cyber controls scoping is that cyber risk is not a single process with a single control owner. It is a risk that manifests across the entire technology and operational landscape of the organisation. The controls that are material to cyber risk include access management and identity controls, network security controls, data protection and encryption controls, incident detection and response controls, third-party and supply chain cyber controls, and business continuity and recovery controls relating to cyber incidents.

Each of these categories contains multiple specific controls, each with its own owner, evidence requirement, and monitoring cadence. The scoping exercise that determines which of these controls are material, meaning which ones would most affect the organisation’s ability to operate or report accurately if they failed, is the most important governance decision in the Provision 29 cyber process. It is also the decision that most boards are currently making without a clear methodology.

The FRC has confirmed that it will not suggest a target number of material controls. That means boards need to make this judgment themselves, document their reasoning, and be prepared to explain it to investors and the FRC. A board that has identified three cyber controls as material and a comparable company has identified twenty-five will need to explain why its cyber risk profile warrants a narrower control scope. A board that has identified fifty cyber controls without a clear materiality rationale for each one has a documentation problem rather than a governance one.

The evidence trail for cyber controls: what continuity looks like

The FRC’s requirement for continuous monitoring of cyber controls is the governance challenge that most boards have been least prepared for. Traditional internal controls frameworks operate on a periodic assurance model: controls are tested at defined intervals, evidence is gathered, and an opinion is formed on effectiveness. Cyber risk does not accommodate this model well.

The threat landscape changes continuously. A control that was effective against the threat environment at the start of the year may be significantly less effective against the threat environment that has evolved by year-end. Ransomware tactics, social engineering approaches, and vulnerability exploitation techniques all evolve on timescales that annual or even quarterly reviews cannot capture. A board that has monitored its cyber controls annually and declares them effective at the year-end balance sheet date has produced a declaration based on a process that may not reflect how the controls have actually performed throughout the year.

What continuous monitoring of cyber controls requires in practice is a defined governance process that produces board-level visibility of cyber control performance on a more frequent basis than the annual review cycle. This does not mean the board needs to review technical cyber metrics monthly. It means the board needs to receive, at appropriate intervals, summarised information about whether the cyber controls framework has been operating as designed, whether significant incidents or near-misses have occurred, whether control exceptions have been identified and remediated, and whether changes to the threat landscape or the company’s technology environment have created new exposures that the current control framework does not address.

The evidence that this monitoring has been conducted, and the conclusions the board has drawn from it, is what makes the effectiveness declaration credible. A board that can point to documented governance activity throughout the year, showing that it received cyber control performance information, considered it, and where necessary directed management to address gaps, is in a materially different position to one that receives an annual cyber risk briefing and resolves to declare the controls effective.

The cyber incident response question

One of the most practically important clarifications in the mythbuster is the confirmation that a Provision 29 effectiveness declaration does not guarantee that the company will not suffer a cyber incident. This matters because the question of what happens to the board declaration if a material cyber incident occurs after it has been made is one that most boards have been uncertain about.

The FRC’s position is that the declaration covers the effectiveness of controls as at the balance sheet date, based on the evidence available at the time of the declaration. A subsequent cyber incident does not automatically make the declaration false. It may, however, trigger questions from the FRC, from investors, and from regulators about whether the controls were genuinely effective at the time of the declaration, whether the incident revealed a control weakness that should have been identified through the monitoring process, and whether the disclosure of the incident in the next reporting period is adequate.

This means that the governance process surrounding a material cyber incident needs to include a specific assessment of its implications for the Provision 29 framework. When a significant incident occurs, the board needs to understand whether it represents a failure of a control that was declared effective, whether that failure was detectable through the monitoring process that was in place, and whether the remediation programme addresses the control weakness or the incident’s specific manifestation. The distinction between addressing the incident and addressing the control failure is the same distinction that Raayzel has identified in its earlier article on control remediation: fixing the finding is not the same as fixing the problem.

The CFO’s role in cyber Provision 29 governance

The CFO’s involvement in cyber Provision 29 governance is more direct than many finance functions have yet recognised. The material controls framework that Provision 29 requires boards to monitor and declare on explicitly includes reporting controls alongside financial, operational, and compliance controls. The financial reporting system, the processes that produce the numbers the CFO signs off on, depends on IT and cyber controls in ways that are not always visible from a finance perspective.
The integrity of financial data depends on access controls that prevent unauthorised modification. The completeness of financial reporting depends on the security and availability of the systems that aggregate and process financial information. The accuracy of disclosures depends on the protection of the data sources that inform them. If any of these cyber controls fail, the financial reporting that the CFO certifies may be compromised, and the material controls that Provision 29 requires the board to declare effective include the cyber controls that protect the financial reporting infrastructure.

This means the CFO needs to be actively involved in the Provision 29 cyber controls scoping exercise, not only in the financial controls elements. The CFO is best placed to identify which cyber controls are material to the integrity of financial reporting, to assess whether those controls are genuinely operating effectively, and to ensure that the board receives the governance information it needs to make a credible effectiveness declaration. A CFO who treats cyber governance as a technology matter and signs off on the Provision 29 declaration without understanding the cyber controls that underpin financial reporting is making a personal attestation on incomplete information.

The FRC Annual Review and what it signals for reporting quality

The FRC’s Annual Review of Corporate Reporting 2025/2026, also published this week, provides useful context for boards preparing their first Provision 29 declarations. The review found that the quality of corporate reporting by FTSE 350 companies has been maintained, with a continued fall in the proportion of reviews leading to substantive FRC enquiry letters. Cash flow statements, financial instruments, impairment of assets, fair value measurement, and revenue are the areas where substantive questions were most frequently raised.

The review’s three priority areas for the 2025/2026 reporting season are directly relevant to the Provision 29 context. Pre-issuance checks, meaning robust internal review processes to identify technical issues before the annual report is published, are exactly the governance discipline that Provision 29 requires for internal controls declarations. The expectation of specific, consistent disclosures that explain the rationale behind significant judgments maps directly onto the Provision 29 requirement for a board declaration that describes how the monitoring and review was conducted and what conclusion was reached. And the narrative reporting priority, requiring strategic reports to provide a balanced and comprehensive review, connects to the requirement for Provision 29 declarations to be outcomes-based rather than process-based.

The FRC’s continued focus on reporting quality in advance of the first Provision 29 declarations in 2027 signals that it will apply the same rigour to internal controls declarations that it applies to financial reporting disclosures. Boards that produce Provision 29 declarations in the same boilerplate style that the FRC has consistently criticised in other areas of corporate reporting will face the same regulatory challenge they would face for inadequate financial reporting disclosure.

What boards need to build in the next three months

With the first Provision 29 declarations due in early 2027 for companies with calendar year-ends, the remainder of 2026 is the evidence-building window. The FRC’s cyber mythbuster, combined with the Annual Review of Corporate Reporting, defines more clearly than ever what the governance process that produces a credible declaration needs to look like.

• Cyber material controls scoping with documented rationale: boards that have not yet finalised their material controls list need to complete the cyber scoping exercise with documented reasoning for why each identified control is material and why controls outside the scope have been excluded. The FRC will not prescribe the right number. Boards need to be able to defend their own judgment.

• Continuous monitoring mechanism for cyber controls: boards need a defined process for receiving cyber control performance information at appropriate intervals throughout the remainder of the year. This does not require technical cyber metrics at board level, but it does require summarised governance information that allows the board to assess whether cyber controls are operating as designed and to direct action where they are not.

• Evidence documentation and retention: every governance activity relating to cyber control monitoring conducted between now and year-end needs to be documented contemporaneously and retained as evidence of the board’s oversight process. The evidence trail is what makes the declaration credible. Retrospective assembly of evidence near the reporting deadline will not satisfy the FRC’s expectation of genuine continuous monitoring.

• Incident and exception tracking: any cyber incident, control exception, or near-miss that has occurred during the year needs to be assessed for its implications for the Provision 29 declaration. The board needs to understand whether it represents a material control failure, whether it was detectable through the monitoring process, and whether the remediation addresses the control weakness or only the specific incident.

• CFO integration into the cyber governance process: the CFO and finance function need to be actively involved in identifying the cyber controls that are material to financial reporting integrity, assessing their effectiveness, and ensuring that the board receives governance information about their performance. Cyber Provision 29 is not only a technology governance matter. It is a financial reporting governance matter.

The governance question cyber Provision 29 is really asking

The FRC’s cyber mythbuster does something genuinely useful: it removes the anxiety that detailed technical disclosure would create a roadmap for attackers. But in doing so, it brings into clearer focus the governance question that the disclosure relief was obscuring.

The question Provision 29 is asking about cyber is not whether the board can describe its cyber controls without giving away sensitive information. It is whether the board has actually governed its cyber controls throughout the year in a way that makes a meaningful effectiveness declaration possible. A board that has received no governance information about cyber control performance, identified no cyber controls as material, and conducted no monitoring activity can produce a declaration that avoids commercially sensitive disclosure while providing investors with no useful governance assurance whatsoever.

That is the outcome the FRC is designing against. The mythbuster clarifies what does not need to be in the declaration. The governance question is what needs to have happened before the declaration is made. The remainder of 2026 is the window in which the answer to that question is being determined by the governance decisions boards make now.

Raayzel works with boards, CFOs, and audit committees to design Provision 29 cyber controls governance frameworks, complete material controls scoping exercises, establish continuous monitoring processes, and build the evidence architecture that supports credible effectiveness declarations. The work is advisory and execution-oriented, calibrated to the specific technology environment, cyber risk profile, and governance architecture of each organisation.

Stay ahead of the Provision 29 and internal controls governance agenda.

Sign up for free insights and resources from Raayzel Business Consulting: https://lp.constantcontactpages.com/sl/sBV4psC/insights

Book a free 30-minute consultation with us at Raayzel: https://calendly.com/raayzelconsulting/30min