Provision 29: what the FTSE's biggest names quietly told us in their 2025 annual reports
- 1 day ago
- 3 min read
The first Provision 29 declarations land in 2026 annual reports. Boards of UK-listed companies will, for the first time, have to declare in public, in print whether their material controls actually worked at the balance sheet date.
That's a very different question from "do we have controls?" And the FY2025 annual reports, published over recent months, are the last set of disclosures before the declaration becomes mandatory. They're effectively a dress rehearsal in plain sight.
So we read them.
What we did
We analysed the FY2025 annual reports of 16 major FTSE-listed companies: banks, miners, energy, pharma, insurance, consumer goods - and extracted every disclosed action relating to Provision 29 readiness.
Each action was categorised against nine readiness dimensions (governance, material controls, testing & assurance, internal controls, risk management, remediation, reporting & disclosure, technology & data, culture & training) and scored 1–5 based on the maturity the disclosure evidences. Those scores roll up into a company-level readiness scorecard, with every score traceable back to a direct quote from the report.
Three findings stood out.
1. Everyone has started. No one has finished.
Every single company we analysed disclosed audit committee engagement with Provision 29 and work on defining material controls. Board-level ownership is now table stakes - if your audit committee hasn't formally taken this on yet, you are behind the pack, not with it.
But not one company scored a 5 overall. Eleven of the sixteen sit at "Developing" (3), and five reached "Established" (4). The gap between "we've discussed it at committee" and "we can evidence effectiveness" is exactly where most programmes are right now.
2. Dry runs are the dividing line
Here's the pattern that separates the leaders: every company that scored 4 completed a dry run in 2025. NatWest ran its full assessment and reporting process end-to-end. Standard Chartered dry-ran its entire material controls lifecycle. Rio Tinto treated all of 2025 as a dry-run year, testing both design and operating effectiveness. Legal & General went further still, rehearsing control failure scenarios and the disclosures that would follow.
Half the companies in our sample disclosed some form of dry run. The other half will be running their first real assessment cycle live, in the year that counts.
3. Two dimensions are missing from every single report
Across all 16 companies, not one disclosed evidence in two categories: technology & data, and culture & training.
Read that again. The two dimensions that determine whether a controls programme survives beyond year one: the systems that capture evidence continuously, and the people who own controls day to day are invisible in every disclosure we reviewed.
Maybe the work is happening and just isn't being reported. But spreadsheet-and-email evidence gathering has a way of showing up in year two, when the dry run becomes a declaration and the board asks, "where's the audit trail?"
The scorecards
Below is a selection of the company scorecards from our research, each with the disclosed actions, readiness scores, and the exact evidence from the annual report.
Get the full benchmark
This post covers 4 of the 16 companies we analysed. Get the full report when you sign up to our Provision 29 Newsletter, the full report includes:
All 16 company scorecards with evidence-linked scoring
Sector-by-sector comparison (are banks really ahead?)
The gap analysis: what nobody is disclosing, and why it matters for your 2026 declaration
Preparing your own declaration? Optial's GRC platform gives you the material controls register, ownership, and board-ready audit trail the leaders are building.
Methodology note: Scores reflect readiness evidenced in public FY2025 annual report disclosures, not an assessment of any company's actual internal control environment. Categories, scoring rubric and full source references are set out in the downloadable report. All quotations are drawn from annual reports filed with the FCA's National Storage Mechanism.