This Code applies only to listed companies — it sits outside the Companies Act 2017 itself, made under Section 156 read with Section 512 of the Act. It is the Listed Companies (Code of Corporate Governance) Regulations, 2019 (S.R.O. 1163(I)/2019, 25 September 2019), amended by S.R.O. 906(I)/2023 (7 July 2023), S.R.O. 920(I)/2024 (12 June 2024), and S.R.O. 454(I)/2025 (20 March 2025); it repealed and replaced the 2017 predecessor Regulations. Most requirements follow a comply-or-explain approach — a company may either comply or explain the impediment in its compliance report — except the provisions explicitly marked mandatory below, non-compliance with which leads to penal proceedings under Regulation 37.

Board composition and diversity

  • Mandatory: no one may hold office as director (including alternate director) of more than seven listed companies simultaneously (Reg 3), effective when the board is next reconstituted.
  • The board should have an appropriate mix of core competencies, diversity, skills, and experience for the company’s operations (Reg 4) — not mandatory, but the board is expected to facilitate minority shareholders contesting board elections by proxy solicitation (Reg 5), including annexing a minority candidate’s profile and an extra proxy form to the Section 159(4) notice on request.
  • Mandatory: at least two independent directors, or one-third of the board, whichever is higher (Reg 6); the independent director must submit a written consent and independence declaration to the chairman at the first board meeting after election, and again whenever their independence changes.
  • Mandatory: at least one female director, subject to Section 154 of the Act (Reg 7), when the board is reconstituted after its current term expires.
  • Mandatory: executive directors, including the CEO, must not exceed one-third of the board (Reg 8).
  • The Chairman and CEO must not be the same person (Reg 9); the Chairman is elected per Section 192 of the Act.

Board responsibilities and meetings

The board is responsible for adopting and monitoring corporate governance practices, risk governance (an annual business-risk review is encouraged), and for a defined set of significant policies — covering everything from succession planning and related-party transactions to environmental/social/governance (ESG) matters, whistleblowing, and an anti-harassment policy aligned with the Protection Against Harassment of Women at the Workplace Act, 2010 (Reg 10). Board notices and agendas circulate at least 7 days ahead of a meeting; minutes follow Sections 178 and 179 of the Act, and a director who feels their dissent wasn’t properly minuted can escalate to the Commission within 30 days (Reg 11-12). Mandatory: the CEO and directors representing one-third of the board or four (whichever is greater) must attend the company’s general meetings unless there’s a compelling, pre-notified reason not to; the Chairman is also encouraged to arrange audio-visual recording of general meetings for the Commission and PSX (Reg 10(6)-(7), amended 2025). The CFO and Company Secretary must attend all board meetings, except when their own performance or terms of service are on the agenda (Reg 13).

Sustainability, ESG and diversity, equity & inclusion (Regulation 10A, added 2024)

The board is responsible for governance and oversight of sustainability risks and opportunities (environmental, social, and governance considerations), and for setting DE&I policies that encourage gender mainstreaming and women’s participation on the board, in management, and across the workforce. The board may set up a dedicated sustainability committee (with at least one female director) or assign the responsibility to an existing committee, and the directors’ report must disclose the company’s assessment of sustainability risks and its DE&I measures.

Significant issues reserved for the board

The CEO must place a defined list of matters before the board or its committees, including: foreseeable default on loans, TFCs, Sukuk, or other debt; the annual business plan and budgets with variance analysis; audit committee findings; quarterly results; internal audit reports (including fraud/bribery/corruption cases); law suits and regulatory notices of material nature; failures to recover material loans or trade debts; significant accidents or environmental incidents; labour disputes; ESG and health & safety implementation; and sale of material assets or investments outside the ordinary course of business (Reg 14). Related party transactions go to the audit committee first, then the board — and to the general meeting for approval if a majority of directors are interested (Reg 15).

Directors’ remuneration and training

No director may determine their own remuneration; the board needs a formal, transparent remuneration policy consistent with the Act and the articles (Reg 16-17). Companies must orient new directors on the Regulations and their duties (Reg 18); a director training certification is encouraged for new directors within one year of appointment, though a director with at least 14 years’ education and 15 years’ board experience is exempt (Reg 19).

CFO, Company Secretary and Head of Internal Audit

The board appoints, sets remuneration for, and removes the CFO, Company Secretary, and Head of Internal Audit — though removing the Head of Internal Audit needs the audit committee’s recommendation first (Reg 20-21). The CFO and Head of Internal Audit each need a tiered combination of professional membership/qualification and years of managerial or audit experience (three routes each, roughly 3-7 years depending on qualification), though anyone already 15 years in the same role at a listed company is exempt from the criteria (Reg 22-23). The same person cannot hold both the CFO and Company Secretary roles simultaneously (Reg 24).

Financial reporting responsibility

The CEO and CFO must endorse quarterly, half-yearly, and annual financial statements before they go to the board, and have the annual and interim statements initialled by the external auditor before they reach the audit committee and board (Reg 25-26).

Board committees

Audit Committee (mandatory): at least 3 members, a majority non-executive with at least one independent director; the chair must be an independent director who is not also the board chairman; at least one member must be “financially literate” (a defined test); the committee meets at least quarterly, with a detailed 16-point terms of reference covering financial statement review, external/internal audit coordination, related-party transactions, whistleblowing findings, and recommending auditor appointment to the board (Reg 27).

HR & Remuneration Committee: at least 3 members, majority non-executive with at least one independent director as chair; meets at least once a year; recommends the remuneration policy framework and senior-management compensation, and runs the annual board performance evaluation (Reg 28).

Nomination Committee (optional) reviews board committee structure and composition (Reg 29); Risk Management Committee (optional) reviews risk management effectiveness (Reg 30) — neither is mandatory, but if constituted their terms of reference must avoid duplicating each other or the Audit/HR&R committees.

Internal audit

Every company must have an internal audit function. The Head of Internal Audit reports functionally to the audit committee and administratively to the CEO; no board director may sit in the internal audit function. The function can be outsourced (to a firm or the holding company’s internal audit staff), but never to the company’s own external auditors or an associate (Reg 31).

External audit (all mandatory)

  • The audit firm must have a satisfactory Quality Control Review rating from ICAP and be registered with the Audit Oversight Board of Pakistan under Section 36I of the SECP Act, 1997.
  • The firm (and its partners) must comply with IFAC’s Code of Ethics as adopted by ICAP.
  • The board recommends the auditor’s appointment and fee (on the audit committee’s suggestion) in the Directors’ Report, with reasons given if it departs from the retiring auditor.
  • No non-audit services beyond what these Regulations permit; the auditor must not perform management functions.
  • No close relative (spouse, parent, dependent/non-dependent children) of the CEO, CFO, Head of Internal Audit, Company Secretary, or a director may be appointed as, or involved in, the audit.
  • A management letter is due to the board within 45 days of the audit report.
  • Rotation: financial-sector listed companies (banks, NBFCs, modarabas, insurers/takaful) must change their audit firm every 5 years; other listed companies must, at minimum, rotate the engagement partner every 5 years — or change the firm entirely if it’s a sole proprietorship (Reg 32-33).

Reporting and disclosure

The Directors’ Report must state the total number of directors split by gender, the board’s composition (independent/non-executive/executive/female), the members of each board committee, and the non-executive/independent directors’ remuneration policy; the Annual Report separately discloses aggregate executive vs. non-executive director remuneration (Reg 34). Companies may also publish significant policies, committee terms of reference, and the remuneration policy on their website (Reg 35). Mandatory: the company must publish and circulate, with its annual report, a Statement of Compliance in the Annexure A format — reviewed and certified by the statutory auditors, who must also flag any non-compliance in their own review report (Reg 36).

Penalties and relaxation

Failing to comply with Regulations 3, 6, 7, 8, 27, 32, 33, or 36 is punishable under Section 512(2) of the Act (Reg 37). The Commission may, on a written application with reasons recorded, extend the time for compliance with any of those same mandatory regulations if strict compliance isn’t practicable (Reg 38).

For the practical annual compliance sequence, see the Task Guide: Complying with the Code of Corporate Governance (CCG) Regulations.

Recent amendments (2023–2024) built into related pages on this site

Scroll to Top