DIRECTORS’ STATEMENT ON
INTERNAL CONTROL OVER FINANCIAL REPORTING
Responsibility
In line with the Banking Act Direction
No. 11 of 2007, section 3(8) (ii)(b), the
Board of Directors presents this report on
Internal Control over Financial Reporting.
The Board of Directors (“Board”) is
responsible for the adequacy and
effectiveness of the internal control
mechanism in place at Bank of Ceylon,
(“the Bank”). In considering such
adequacy and effectiveness, the Board
recognises that the business of banking
requires reward to be balanced with risk
on a managed basis and as such the
internal control systems are primarily
designed with a view to highlighting any
deviations from the limits and indicators
which comprise the risk appetite of the
Bank. In this light, the system of internal
controls can only provide reasonable, but
not absolute assurance, against material
misstatement of financial information
and records or against financial losses or
fraud.
The Board has established an ongoing
process for identifying, evaluating and
managing the significant risks faced
by the Bank and this process includes
enhancing the system of internal
control over financial reporting as and
when there are changes to business
environment or regulatory guidelines.
The process is regularly reviewed by
the Board and is in accordance with the
guidance for Directors of banks on the
directors’ statement on internal control
issued by the Institute of Chartered
Accountants of Sri Lanka. The Board
has assessed the internal control over
financial reporting taking into account
principles for the assessment of internal
control system as given in that guidance.
The Board is of the view that the system
of internal controls over financial
reporting in place is sound and adequate
to provide reasonable assurance
regarding the reliability of financial
reporting, and that the preparation
of Financial Statements for external
purposes is in accordance with relevant
accounting principles and regulatory
requirements.
The management assists the Board in the
implementation of the Board’s policies
and procedures on risk and control
by identifying and assessing the risks
faced, and in the design, operation and
monitoring of suitable internal controls to
mitigate and control these risks.
Key features of the process adopted
in reviewing the design and
effectiveness of the internal control
system over financial reporting
The vital processes that have been
established in reviewing the adequacy
and integrity of the system of internal
controls with respect to financial
reporting include the following:
• Various committees are established
by the Board to assist the Board in
ensuring the effectiveness of bank’s
daily operations and that the Bank’s
operations are in accordance with
the corporate objectives, strategies
and the annual budget as well as the
policies and business directions that
have been approved.
• The Internal Audit Division of the
Bank checks for compliance with
policies and procedures and the
effectiveness of the internal control
systems on an ongoing basis using
samples and rotational procedures
and highlights significant findings
in respect of any noncompliance.
Audits are carried out on all units
and branches, the frequency of
which is determined by the level of
risk assessed using approved risk
rating methodologies to provide an
independent and objective report.
The annual audit plan is reviewed
and approved by the Board Audit
Committee. In line with the approved
annual audit plan, the Internal Audit
Division carries out onsite as well as
offsite internal audits using a variety
of methodologies and the audit
findings are submitted to the Board
Audit Committee for review.
• The Board Audit Committee of
the Bank reviews internal control
issues identified by the Internal
Audit Division, the external auditors,
regulatory authorities and the
management, and evaluates the
adequacy and effectiveness of
the risk management and internal
control systems. They also review the
internal audit functions with particular
emphasis on the scope of audits and
quality of the same. All minutes of
the Board Audit Committee meetings
are forwarded to the Board. Detail
analysis of the activities undertaken
by the Audit Committee of the Bank
are set out in the Audit Committee
Report on pages 122 to 123.
• In assessing the internal control
system over financial reporting,
identified officers of the Bank collated
all procedures and controls that are
connected with significant accounts
and disclosures of the Financial
Statements of the Bank. These in turn
were observed and checked by the
Internal Audit Division for suitability
of design and effectiveness on an
ongoing basis. The assessment did
not include subsidiaries of the Bank.
• The Bank adopted the Sri Lanka
Accounting Standard – SLFRS
9 - “Financial Instruments” with
effect from 1 January 2018. In order
to comply with the requirements
of SLFRS 9, the Bank developed
Expected Credit Loss (ECL) models
using a wide range of forecast
economic scenarios to determine
impairment provisions with the
support of an external consultant.
These models have been validated
by the Internal Audit Division with
