The Chairman
Bank of Ceylon
Assurance Report of the Auditor General to the Board of Directors on the Directors’ Statement on Internal Control of Bank of Ceylon
Introduction
This report is to provide assurance on the Directors’ Statement on Internal Control over Financial Reporting (“Statement”) of Bank of Ceylon included in the Annual Report for the year ended 31 December 2022.
Management’s Responsibility
Management is responsible for the preparation and presentation of the Statement in accordance with the “Guidance for Directors of Banks on the Directors’ Statement on Internal Control” issued in compliance with the Section 3 (8) (ii) (b) of the Banking Act Direction No. 11 of 2007, by The Institute of Chartered Accountants of Sri Lanka.
My Responsibility and Compliance with SLSAE 3050 (Revised)
My responsibility is to assess whether the Statement is both supported by the documentation prepared by or for Directors and appropriately reflects the process the Directors have adopted in reviewing the design and effectiveness of the internal control of the Bank of Ceylon.
I conducted my engagement in accordance with Sri Lanka Standard on Assurance Engagements (SLSAE) 3050 (Revised), Assurance Report for Banks on Directors’ Statement on Internal Control, issued by The institute of Chartered Accountants of Sri Lanka. This Standard required that I plan and perform procedures to obtain limited assurance about whether Management has prepared, in all material respects, the Statement on Internal Control. For purpose of this engagement, I am not responsible for updating or reissuing any reports, nor have I, in the course of this engagement, performed an audit or review of the financial information.
Summary of Work Performed
I conducted my engagement to assess whether the Statement is supported by the documentation prepared by or for Directors; and appropriately reflected the process the Directors have adopted in reviewing the system of internal control over financial reporting of the Bank.
The procedures performed were limited primarily to inquiries of Bank personnel and the existence of documentation on a sample basis that supported the process adopted by the Board of Directors.
SLSAE 3050 (Revised) does not require me to consider whether the Statement covers all risk and controls, or to form an opinion on the effectiveness of the Bank’s risk and control procedures. SLSAE 3050 (Revised) also does not require me to consider whether the processes described to deal with material internal control aspects of any significant problems disclosed in the annual report will, in fact, remedy the problems.
The procedures selected depend on my judgement, having regard to my understanding of the nature of the Bank, the event or transaction in respect of which the Statement has been prepared.
I believe that the evidence I have obtained is sufficient and appropriate to provide a basis for my conclusion.
Conclusion
Based on the procedures performed, nothing has come to my attention that causes me to believe that the Statement included in the Annual Report is inconsistent with my understanding of the process the Board of Directors has adopted in the review of the design and effectiveness of internal control system over the financial reporting of the Bank.
W P C Wickramaratne
Auditor General
