Most organisations preparing for Provision 29 have controls frameworks in place. The problem is that those frameworks were built for a different purpose. Spreadsheets, disconnected tools, and siloed risk and audit data were never designed to support a formal board declaration, and the fragmentation that was once just inefficient is now a genuine governance liability.

The first mandatory declarations arrive in 2027 annual reports. Boards are inside their first live reporting cycle, and the question is no longer whether Provision 29 matters. It is whether existing processes can produce a coherent, transparent narrative when declarations go on the record. 

In this session, Michael Rasmussen draws on direct, recent experience advising UK organisations on Provision 29 readiness to examine what the provision actually requires in practice. The discussion covers how organisations define and assess material controls, integrate risk management and internal controls into a single governance workflow, and build the kind of evidence that supports board statements that stand up to scrutiny. 

This session is designed for risk, compliance, audit, and governance leaders at premium-listed LSE organisations, as well as regulated and private equity-backed firms seeking stronger controls maturity and governance discipline. 

You’ll learn about: 

• What "material controls" means in practice and how boards assess them with confidence   

• Why fragmented GRC tooling creates disclosure risk and what an integrated controls workflow looks like 

• How to aggregate assurance results across functions into a single, coherent board narrative 

• What evidence is required to support a robust board declaration 

• What separates organisations that are genuinely board-ready from those still operating on borrowed time