Directors’ Statement on Internal Control over Financial Reporting

Responsibility

The Board of Directors (the Board) of Commercial Bank of Ceylon PLC (the Bank) wish to present this Report on Internal Control over Financial Reporting, in line with the Section 3 (8) (ii) (b) of the Banking Act Direction No. 11 of 2007, and Principle D.1.5 of the Code of Best Practice on Corporate Governance 2017 (Code) issued by CA Sri Lanka.

The Board is responsible for the adequacy and effectiveness of the system of internal controls in place at the Bank. However, such a system is designed to manage the Bank’s key areas of risk within an acceptable risk profile, rather than to eliminate the risk of failure to achieve business objectives of the Bank. Accordingly, the system of internal controls can only provide reasonable but not absolute assurance against material misstatements of management and financial information and records or against financial losses or fraud.

The Board has established an ongoing process for identifying, evaluating and managing the significant risks faced by the Bank and this process has been well in place for many years which includes enhancing the system of internal controls as and when there are changes to business environment or regulatory guidelines. The process is regularly reviewed by the Board and accords with the “Guidance for Directors of Banks on the Directors’ Statement on Internal Control” issued by CA Sri Lanka. The Board has assessed the internal controls taking into account all main principles for the assessment of internal control system as given in that guidance.

The Board is of the view that the system of internal controls in place over financial reporting is sound and adequate to provide reasonable assurance regarding the reliability of financial reporting, and that the preparation of Financial Statements for external purposes is done in accordance with relevant accounting principles and regulatory requirements.

The Management assists the Board in the implementation of the Board’s policies and procedures on risks and controls by identifying and assessing the risks faced, and in the design, operation and monitoring of suitable internal controls to mitigate and control these risks.

Key features of the process adopted in applying and reviewing the design and effectiveness of the Internal Control System on Financial Reporting

The key processes that have been established in reviewing the adequacy and integrity of the system of internal controls with respect to financial reporting include the following:

• Nine Board committees have been established by the Board, including those mandatory committees as required by the Banking Act Direction No. 11 of 2007 and the Listing Rules of the Colombo Stock Exchange, to assist the Board in ensuring the effectiveness of the Bank’s daily operations and that the Bank’s operations are conducted in line with the corporate objectives, strategies and the annual budget as well as the policies and business directions that have been approved.
• Policies/Charters have been developed covering all functional areas of the Bank and these have been recommended by Board appointed Committees and approved by the Board. Such policies and Charters are reviewed and approved at least annually.
• The Inspection/Internal Audit Department/Information Systems Audit Unit of the Bank check for compliance with policies and procedures and the effectiveness of the internal control systems/Information System controls on an ongoing basis using samples and rotational procedures and highlight significant findings in respect of any non-compliance. Further, Onsite, Online and Offsite audits are carried out covering all departments, branches, subsidiaries and overseas operations in accordance with the annual audit plan reviewed and approved by the Board Audit Committee (BAC). The type and frequency of audits of Business units are determined by the level of risk assessed, to provide an independent and objective report. Findings of the internal audits are submitted to the BAC for review at its periodic meetings for initiating necessary action. Initiatives taken by the Inspection/Internal Audit Department to audit certain selected areas of the business units “online” during the year 2016 on a limited scope, were gradually expanded over the years and covered all Branches in Sri Lanka and Bangladesh, Corporate Banking Unit, Digital Banking Unit, Card Center, Treasury, Finance, and Subsidiaries – CBC Finance Limited, Commercial Bank of Maldives Private Limited and CBC Myanmar Microfinance Company Limited during 2022 as well. Scope of Online, near time and real time audits was further enhanced to cover high risk transactions of the Bank. In addition, monitoring over cyber security controls, modifications to core banking systems/databases was further strengthened utilising appropriate tools/techniques and resources. Through this initiative, the controls are being tested on a near or real time basis. A significant improvement in methodology was achieved by testing the entire population of the data rather than a random sample. Also, Offsite/Online audit introduced during 2020 were continued in 2022 as well to test and verify internal controls relating to Credit area of Branches. The findings were tabled at the meetings of the BAC for review and for initiating necessary action. The “Online Auditing” initiative has further strengthened the review of the design and effectiveness of the internal control system of the Bank.
• The BAC reviews internal control issues identified by the Inspection/Internal Audit Department, co-sourced internal auditors, regulatory authorities, external auditors and the Management, and evaluates the adequacy and effectiveness of the risk management and internal control systems. The BAC also carries out an annual evaluation to review the effectiveness of internal audit function with particular emphasis on the scope, quality, independence of internal audit and the resources. The Minutes of the BAC meetings are tabled at the meetings of the Board of Directors of the Bank on a periodic basis. Details of the activities undertaken by the BAC are set out in the ‘Report of the Board Audit Committee’ which appears in the section on Board Committee Reports.
• In assessing the internal control system over financial reporting, identified officers of the Bank continued to review and update all procedures and controls that are connected with significant accounts and disclosures of the Financial Statements of the Bank. The Inspection/Internal Audit Department continued to verify the suitability of design and effectiveness of these procedures and controls on an ongoing basis. The assessment included both local and overseas subsidiaries and the Bangladesh operations of the Bank as well.

Since the adoption of the Sri Lanka Accounting Standard – SLFRS 9 on “Financial Instruments”, which became effective from January 01, 2018, the Bank introduced and implemented the processes that are required to comply with the requirements of recognition, measurement, presentation and disclosures under the above Accounting Standard. Further, these processes were continuously strengthened based on the feedback received from the External Auditor, Inspection/Internal Audit Department, regulators and the BAC. Continuous monitoring is in progress and steps are being taken to further improve the processes where required, and to enhance effectiveness and efficiency. The Bank has documented the procedures relating to these requirements and updates the procedure manuals as and when necessary and also obtained approval of the Board with the recommendation of the BAC for changes made to the documented procedures. The Bank’s Inspection/Internal Audit department commenced testing these processes since first quarter 2013 and continued to do so and the outcome of such exercise was tabled regularly for review by the BAC during the year 2022 as well. Having recognised the need to introduce an automated platform for various computations required under SLFRSs and LKASs including loan impairments, the Bank automated impairment calculations through a renowned software solution and this project was completed during the final quarter of 2021. However, the Bank decided to continue with the manual calculation of impairment as a parallel exercise despite the live deployment of the software solution. This is because impairment calculations require continuous refinements given the macro-economic challenges faced by the country, the consequent impact on the Bank’s customers in most of the industries and the evolving regulatory requirements which are in addition to the requirements of the Sri Lanka Accounting Standards. In addition, the Bank also took steps to document the entire Financial Statements Closure Process in 2021 with the support of an external consultant, and the same was validated by an independent consultant. These proactive measures helped the Bank to ensure that the Bank is in compliance with the requirements of the Banking Act Direction Nos. 13 and 14 on “Classification, Recognition and Measurement of Credit Facilities and other Financial Assets in Licensed Banks” issued by the Central Bank which became effective from January 01, 2022.

The comments made by the External Auditor in connection with the internal control system over financial reporting in previous years were reviewed during the year and necessary steps were taken to address them where appropriate. The recommendations made by the External Auditor in 2022 in connection with the internal control system over financial reporting system will be dealt with in the future.

The Assurance Report of the External Auditors in connection with internal control over financial reporting appears in the section on Independent Assurance Report.

Confirmation

Based on the above processes, the Board of Directors confirms that the financial reporting system of the Bank has been designed to provide a reasonable assurance regarding the reliability of financial reporting and the preparation of Financial Statements for external purposes has been done in accordance with the Sri Lanka Accounting Standards and regulatory requirements of the Central Bank of Sri Lanka.

Review of the Statement by External Auditors

The External Auditor, Messrs Ernst & Young, has reviewed the above Directors’ Statement on Internal Control included in this Annual Report for the year ended December 31, 2022 and reported to the Board that nothing has come to their attention that causes them to believe that the statement is inconsistent with their understanding of the process adopted by the Board in the review of the design and effectiveness of the internal control system over financial reporting of the Bank. Their independent assurance report on the “Directors” Statement on Internal Control over Financial Reporting is given in the section on Independent Assurance Report of this Annual Report.

By Order of the Board,

Prof A K W Jayawardane
Chairman

 

S Muhseen
Deputy Chairman

 

R Senanayake
Chairman – Board Audit Committee

 

S C U Manatunge
Managing Director/Chief Executive Officer
Colombo

February 24, 2023