A company can file its accounts on time, pass its audit and still face questions from four directions at once. One authority asks whether the board's reporting on risk is credible. Another asks who can see the personal data the business holds. A professional body sets the financial rules that councils and other public bodies follow. Beneath all three sits an Act of Parliament that decides what directors must do and what a company must file.

Each authority has its own owner, its own rulebook and its own timing. Treating them as one block of "UK rules" is how reporting teams end up chasing the wrong deadline or asking the wrong body for answers. The two names new starters search for most often are the FRC and the Companies Act 2006, so they come first.

What is the FRC?

The Financial Reporting Council (FRC) is the UK regulator of auditors, accountants and actuaries and the body that sets the UK Corporate Governance Code and the UK Stewardship Code.

The FRC describes its role this way on its website: "We regulate auditors, accountants and actuaries, and we set the UK's Corporate Governance and Stewardship Codes. We promote transparency and integrity in business." (Source: FRC, About the FRC.)

In plain English, the FRC sets the expectations for how companies report to investors, how auditors check that reporting and how boards describe the way they run the business. Three examples show the range. A retailer's board describes how it monitors risk and internal control in its annual report. An audit firm's work is inspected against audit standards. An accountant or actuary who falls short of professional standards can be held to account. The FRC's own purpose page describes serving the public interest by setting high standards of corporate governance, reporting and audit and by holding to account those responsible for delivering them.

Several limits define what the FRC is. It is governed by its Board, which discharges some responsibilities directly and others through its governance and regulatory committees. It sets codes and standards but does not write company law, which comes from Parliament. The UK Corporate Governance Code 2024 was published on January 22, 2024 and has applied since January 1, 2025, with Provision 29 applying from January 1, 2026. It has five sections: Board Leadership and Company Purpose; Division of Responsibilities; Composition, Succession and Evaluation; Audit, Risk and Internal Control; and Remuneration. It operates on a comply or explain basis, so a company that departs from the Code must give a meaningful explanation.

The FRC also issues the UK financial reporting standards (FRS) that many entities use to prepare accounts. How those standards sit alongside UK-adopted international accounting standards is covered in the Ideagen post on GAAP vs IFRS and how UK and US rules apply.

What is the Companies Act 2006?

The Companies Act 2006 is the Act of Parliament that reformed UK company law and restated the greater part of the enactments relating to companies.

Its long title on legislation.gov.uk reads: "An Act to reform company law and restate the greater part of the enactments relating to companies; to make other provision relating to companies and other forms of business organisation; to make provision about directors' disqualification, business names, auditors and actuaries; to amend Part 9 of the Enterprise Act 2002; and for connected purposes."

In plain English, the Act is the legal rulebook for companies. It sets out what directors personally owe the company, what a company must put in its annual accounts and reports and how auditors fit in. Two examples show how specific it is. Section 171 requires a director to act in accordance with the company's constitution and only exercise powers for the purposes for which they are conferred. Section 172 requires a director to act in the way they consider, in good faith, would be most likely to promote the success of the company for the benefit of its members as a whole, with regard to factors that include the likely consequences of any decision in the long term and the interests of the company's employees.

Three parts of the Act matter most to reporting teams. Part 10 covers a company's directors. Part 15 covers accounts and reports. Part 16 covers audit. The Act is a statute, so only Parliament can change it, and the Department for Business and Trade leads on company law. Because the Act sets the legal floor, bodies such as the FRC build their codes and standards on top of it and do not replace it.

The ICO and CIPFA: where data protection and public finance rules meet company reporting

The FRC and the Companies Act cover reporting directly. The ICO and CIPFA reach the same documents from different angles, and each answers a question the other two cannot.

The ICO oversees information rights and how personal data is handled

The Information Commissioner's Office (ICO) states its purpose in one line: "The ICO exists to empower you through information." (Source: ICO, What we do.) Its register of fee payers includes details of organisations that process personal data.

For a reporting team, the practical point is that any document or system holding personal data, such as employee, customer or director information, falls into the ICO's area and not the FRC's.

CIPFA sets professional standards for people who manage public money

The Chartered Institute of Public Finance and Accountancy (CIPFA) describes itself this way: "CIPFA, the Chartered Institute of Public Finance and Accountancy, is the professional body for people in public finance." (Source: CIPFA, About CIPFA.) It also states that it is the only professional accountancy body in the world dedicated exclusively to public finance.

Its 14,000 members work throughout public services, in national audit agencies, in major accountancy firms and in other bodies where public money needs to be effectively and efficiently managed. A private company reporting under the Companies Act rarely answers to CIPFA directly, because CIPFA is a professional body and not a regulator of companies. CIPFA becomes central when the reporting entity is a council or another public body.

Example of the four in practice: a listed manufacturer preparing its annual report

A UK listed manufacturing group shows how the authorities divide the work across one reporting cycle:

  • The finance team prepares the annual accounts and reports under Part 15 of the Companies Act 2006, and the auditor reports under Part 16.
  • The board reports against the UK Corporate Governance Code 2024, including the Audit, Risk and Internal Control section, on a comply or explain basis.
  • The group applies UK-adopted international accounting standards in its consolidated statements, because UK law requires them for companies whose securities are admitted to trading on a UK regulated market.
  • The data protection lead checks that personal data in the reporting process is handled within the ICO's remit.

CIPFA stays in the background for this group. It would sit at the center of the same exercise for a council, where public finance standards decide how the accounts are prepared.

FRC vs Companies Act 2006 vs ICO vs CIPFA: differences in purpose, owner and timing

Authority Type Owner of the rules Purpose Timing
FRC Regulator and standards-setter FRC Board Credible corporate reporting, audit and governance Each reporting cycle. The 2024 Code has applied since January 1, 2025
Companies Act 2006 Act of Parliament Parliament, with the Department for Business and Trade leading on company law Legal duties for directors and rules for accounts, reports and audit Whenever a company is run, reports or is audited
ICO Information rights regulator The ICO Lawful handling of personal data and information rights Whenever personal data is processed
CIPFA Professional body CIPFA Professional standards and guidance for public finance When public money is managed and accounted for

Limits of each authority and four checks that show which one applies

Each body stops at a clear boundary:

  • The FRC does not write company law and does not regulate personal data.
  • The Companies Act 2006 sets duties and filing rules but leaves codes and detailed standards to bodies such as the FRC.
  • The ICO does not set financial reporting standards.
  • CIPFA is a professional body for public finance and not a regulator of companies.

Four checks confirm which authorities apply to a given piece of work:

  • Identify the entity type: a listed company, another company or a public body.
  • Identify the accounting framework the entity reports under and who issues it.
  • Identify whether the document or process holds personal data.
  • Identify whether the entity reports against the UK Corporate Governance Code 2024.

Questions people ask about UK reporting authorities

Does the FRC write company law?

No. Company law comes from Parliament through statutes such as the Companies Act 2006, and the Department for Business and Trade leads on it. The FRC sets codes and standards that sit on top of that law, including the UK Corporate Governance Code and the UK Stewardship Code, and it regulates auditors, accountants and actuaries.

Are CIPFA standards the same as FRC standards?

No. The FRC covers corporate reporting, audit and governance, including the UK financial reporting standards. CIPFA is the professional body for public finance, with members across public services, national audit agencies and major accountancy firms. The two serve different reporting entities, so a company and a council usually follow different rulebooks.

Do directors have personal duties under the Companies Act 2006?

Yes. Sections 171 and 172 place duties on each director, including acting in accordance with the company's constitution and acting in the way the director considers, in good faith, would be most likely to promote the success of the company. These duties sit with individual directors, so board papers and training should reflect them.

How can I check whether an organization processes personal data?

The ICO keeps a register of fee payers that includes details of organisations that process personal data. It is the starting point for checking whether an organization appears there. Presence on the register shows that the ICO holds details of it, and it does not replace a review of how a specific system handles data.

Naming one owner for each authority turns four rulebooks into one reporting calendar

The practical step is to list every reporting obligation once, name the authority behind it and give each a single accountable owner. Company secretarial and finance teams usually hold the Companies Act 2006 duties. The board and audit committee hold Code reporting tied to the FRC. The data protection lead holds anything the ICO oversees, and public bodies add CIPFA standards to the finance director's list. Teams that want to see how checklist-based disclosure works can read about the disclosure management solution.