Audit, risk and internal control

• The FRC has updated Provisions setting out the roles and responsibilities of the audit committee and related annual report disclosures to reflect and cross-refer to the obligations in the Audit Committees and the External Audit: Minimum Standard, and to remove duplicative language (Provisions 25 and 26). As indicated by the FRC in its consultation paper, although the Standard is intended to be mandatory for FTSE 350 companies (once the necessary legislation is in place), non-FTSE 350 companies will be able to continue to approach the Standard on a “comply or explain” basis.
• Amendments to Principle O underline the pervasive obligation on the board to maintain an effective risk management and internal control framework. Replacement Provision 29 states that the board should monitor the company’s risk management and internal control framework and, at least annually, carry out a review of its effectiveness. The monitoring and review should cover all material controls, including financial, operational, reporting and compliance controls. The board should provide in the annual report:

• A description of how the board has monitored and reviewed the effectiveness of the framework;
• A declaration of effectiveness of the material controls as at the balance sheet date; and
• A description of any material controls which have not operated effectively as at the balance sheet date, the action taken, or proposed, to improve them and any action taken to address previously reported issues.

The FRC has been keen to emphasise that the inclusion of a specific board declaration on the effectiveness of material controls, as requested by the government, does not result in a UK reporting and liability regime equivalent to that in the U.S. Sarbanes-Oxley Act. In particular, the FRC does not have the power to sanction directors, unless they are members of the professional accountancy or actuarial bodies (although this could change, if the government eventually goes ahead with some of its original proposals). The FRC’s Corporate Governance Code Guidance also confirms that, when making these statements, boards should not be held to a higher standard of care than generally applies to directors in the exercise of their duties, and the flexibility provided by the “comply or explain” regime can be used where a control system is less established or mature, or its effectiveness unproven. Additionally, the Code does not require companies to obtain specific external assurance on their frameworks or effectiveness statements (although auditors already have certain obligations under ISA (UK) 720). The FRC’s guidance suggests that external assurance may not be necessary where a company has an effective internal audit function that is appropriately resourced to provide assurance over the effectiveness of the framework. However, clearly, any such decision would need careful consideration by the board.

As noted above, the revised Provision 29 does not apply until financial years beginning on or after 1 January 2026, in order to give companies further time to prepare for the change in their reporting obligations.

Remuneration

• As requested by the government, the revised Code seeks greater transparency around malus and clawback arrangements that enable the company to recover or withhold directors’ pay and share awards where there has been wrongdoing by directors. Director contracts and other documents covering director remuneration should include malus and clawback provisions and set out the circumstances in which these would apply (Provision 37). The annual remuneration report should describe these provisions, including the circumstances for their use, the period they apply (and why this is best suited to the company) and any use of them in the last reporting period and the reason for this (Provision 38).

Although the changes to the Code are considerably less wide-ranging than the FRC’s original proposals, all companies will need to review their procedures, controls and reporting systems to ensure they are able to address the new requirements once they become effective. The FRC’s revised Corporate Governance Code Guidance, while non-mandatory and non-prescriptive, is designed to inform this process. Companies will also need to review their director contracts and other remuneration documents to ensure they contain appropriate malus and clawback provisions.

Further changes can still be expected, as the government has said that it remains committed to wider audit and corporate governance reform, including establishing the FRC’s replacement, the Audit, Reporting and Governance Authority. However, although the government’s stated intention is to deliver a “targeted, simpler and effective framework”, the substance of this remains uncertain at this stage.

Client Alert 2024-028