INDEPENDENT ASSURANCE REPORT

The Chairman,
Bank of Ceylon.

Assurance Report of the Auditor 

General to the Board of Directors on 

the Directors’ Statement on Internal 

Control over Financial Reporting of 

Bank of Ceylon

Introduction

This report is to provide assurance on 
the Directors’ Statement on Internal 
Control over Financial Reporting (the 
“Statement”) of Bank of Ceylon (the 
“Bank”) included in the annual report for 
the year ended 31 December 2023.

Management’s Responsibility

Management is responsible for the 
preparation and presentation of the 
Statement in accordance with the 
“Guidance for Directors of Banks on the 
Directors’ Statement on Internal Control” 
issued in compliance with the Section 
3(8) (ii) (b) of the Banking Act Direction 
No. 11 of 2007, by the Institute of 
Chartered Accountants of Sri Lanka. 

My Responsibility and Compliance 

with SLSAE 3050(Revised)

My responsibility is to assess whether 
the Statement is both supported by 
the documentation prepared by or for 
directors and appropriately reflects the 
process the directors have adopted in 
reviewing the design and effectiveness of 
the internal control of the Bank.

I conducted my engagement in 
accordance with Sri Lanka Standard 
on Assurance Engagements (SLSAE) 
3050 (Revised), Assurance Report for 
Banks on Directors’ Statement on 
Internal Control, issued by the institute 
of Chartered Accountants of Sri Lanka. 
This Standard required that I plan and 
perform procedures to obtain limited 
assurance about whether Management 
has prepared, in all material respects, 
the Statement on Internal Control. For 
purpose of this engagement, I am not 
responsible for updating or reissuing 
any reports, nor have I, in the course of 
this engagement, performed an audit or 
review of the financial information.

Summary of Work Performed

I conducted my engagement to assess 
whether the Statement is supported by 
the documentation prepared by or for 
Directors; and appropriately reflected the 
process the Directors have adopted in 
reviewing the system of internal control 
over financial reporting of the Bank.

The procedures performed were limited 
primarily to inquiries of Bank personnel 
and the existence of documentation on a 
sample basis that supported the process 
adopted by the Board of Directors.

SLSAE 3050 (Revised) does not require 
me to consider whether the Statement 
covers all risk and controls, or to form 
an opinion on the effectiveness of the 
Bank’s risk and control procedures. 

SLSAE 3050(Revised) also does not 
require me to consider whether the 
processes described to deal with material 
internal control aspects of any significant 
problems disclosed in the annual report 
will, in fact, remedy the problems.

The procedures selected depend on 
my judgement, having regard to my 
understanding of the nature of the Bank, 
the event or transaction in respect of 
which the Statement has been prepared. 
I believe that the evidence I have 
obtained is sufficient and appropriate to 
provide a basis for my conclusion.

Conclusion

Based on the procedures performed, 
nothing has come to my attention that 
causes me to believe that the Statement 
included in the Annual Report is 
inconsistent with my understanding of 
the process the Board of Directors has 
adopted in the review of the design and 
effectiveness of internal control system 
over the financial reporting of the Bank.

W P C Wickramaratne

Auditor General