Set risk appetite people can actually use
Connect the organisation’s objectives to clear decision limits, escalation routes and evidence of what the board will accept.
Read guideGovernance topic hub
Corporate governance guidance for UK organisations
Governance sets who may decide, what they must consider and how decisions are challenged and recorded. Start with your legal entity and applicable duties, then connect board responsibilities, risk appetite, control evidence and follow-up actions.
Start with the right scope
Companies in the relevant listed-company categories apply the UK Corporate Governance Code’s Principles and comply with, or explain departures from, its Provisions. Its 2024 edition applies to financial years beginning on or after 1 January 2025; Provision 29 applies to financial years beginning on or after 1 January 2026. Private companies and smaller organisations need a separately scoped assessment.
FRC: Code scope, financial years and Provision 29. Source reference baseline: 1 November 2026. AI-assisted preparation; no independent human legal review is claimed.
01
Scope the decision
Identify the entity, decision-maker, delegated authority and any conflicts.
02
Bring the evidence
Explain material risks, controls, exceptions and unresolved uncertainty.
03
Record the outcome
Keep the alternatives, challenge, reasons, owner and follow-up date together.
Governance guides
Follow the question through its scope, evidence and next step.
Record a board decision that can be explained
Build a useful record of authority, evidence, challenge, conflicts and follow-through without reducing directors’ duties to a tick-box exercise.
Read guideFrom a control list to board assurance
Explain what each important control does, how it was tested and what the evidence allows the board to conclude.
Read guideGive every policy an owner and a review path
Turn a folder of policies into a manageable register of decisions, responsibilities, training and evidence.
Read guideFraud prevention: scope before templates
Understand the failure-to-prevent-fraud starting point and connect prevention to incentives, associated persons, practical controls and oversight.
Read guideAn illustrative working example
A fictional board is asked to renew a critical supplier contract. The paper identifies a recovery test that did not meet the business target. The board records the options, approves a time-limited renewal with conditions, assigns a director to obtain retest evidence and specifies what would trigger an earlier review. The minutes record the remaining uncertainty; the template does not decide whether renewal is reasonable.
Fictional example created to explain the method. It is not client work, original empirical research or an assurance conclusion.
Keep a useful working record
Board GRC review and decision template gives you a practical place to record your own scope and evidence. Use the connected review workspace when you need to link risks, controls, obligations and actions.
Does every UK business have to follow the UK Corporate Governance Code?
No. Check the listing categories and other reporting requirements that apply to the entity. Voluntary use of a framework should be labelled as voluntary; it does not replace directors’ applicable duties.
What belongs in a board assurance pack?
State the reporting scope, material risks, control evidence, exceptions, action owners and decisions requested. Explain the limits of the work and distinguish management assertions from independent assurance.
Related implementation briefings
- Provision 29: prepare the evidence before the reporting date
- Fraud prevention: review the process in operation
- FRC revises auditing standards for legal and regulatory non-compliance
Connect the disciplines
Read the GRC framework overview and worked example, then use the other topic hubs to connect the responsibility, exposure and requirement.