UK Corporate Governance updates: Managing third parties

In January the Financial Reporting Council (FRC) unveiled the latest 2024 UK Corporate Governance Code (the Code), which places requirements on the board to consider the effective management of risks, including those related to or managed by third parties. Here we explain exactly what these changes are, what they mean for you and what you should do next.

Contents

The transition to enhanced governance standards

What relevant changes have been made to the Code?

What do the latest Code changes mean for you?

How should you respond to the Code reforms?

What relevant changes have been made to the Code?

The key change is the inclusion of the newest provision, Provision 29. The focus of its inclusion is primarily on evaluating material controls, emphasising the need for organisations to prioritise key aspects of their governance processes. The board must include:

• An explanation of how it monitored and reviewed the framework's effectiveness, including the extent of controls managed by third parties and their impact.
• A declaration regarding the effectiveness of material controls as of the balance sheet date.
• Details of any material controls that didn't operate effectively as of the balance sheet date, along with proposed or implemented actions to improve them and any actions taken to address previously reported issues.

What do the latest Code changes mean for you?

It's crucial to understand the implications of these changes for how you manage third party risk. Key aspects to consider include:

Heightened transparency in the internal control process

Our latest Corporate Governance Review revealed that while 94% of FTSE 350 companies identify operational risks, including third party and supplier risks, as a principal risk, only 10% assure aspects of their third-party controls, for example, in relation to their supply chains. This indicates a need for increased scrutiny and action by boards and management. 

Visibility of your third party risks and controls

Boards and management often lack sufficient visibility into the risks managed by third parties and existing levels of assurances provided by them.

The benefits of allowing third parties to deliver services that support your organisation do not come risk free. There are many examples of ongoing cyber exposure in the media, including a report from the UK government, which found that 32% of businesses recalled experiencing breaches or attacks in the last 12 months. Whether you are in direct control or have outsourced services, you need to demonstrate that you have understood and documented the controls and that you maintain an understanding of their potential impact on you if they fail.

Outsourcing processes and controls doesn’t outsource the risks being managed so it’s important to understand the quality (design and operation) of those being managed by others on behalf of your organisation. Often, third party questionnaires are relied upon to provide detail on controls, but these do not provide sufficient assurance to support a declaration under the enhanced code requirements.

An inventory of all third parties must be maintained

Many businesses lack a comprehensive inventory of their current third party suppliers, which is essential for understanding who key third parties are and whether they carry material risks to internal controls and regulatory compliance. Before engaging any key third party service provider, due diligence should be conducted to ensure that they have adequate controls in place to support recent code reforms.

Recent Code reforms underscore the importance of overseeing controls maintained by key suppliers. Like practices observed in the US SOX world, it is critical to ensure that key service providers understand their role in maintaining internal controls and supporting them on an ongoing basis. This needs to be reflected in communications between the company and key third parties