Directors’ Statement on Internal Control

Responsibility

In line with the Section 3 (8) (ii) (b) of the Banking Act Direction No. 11 of 2007, and principle D.1.5 of Code of Best Practice on Corporate Governance 2017 (Code), issued by The Institute of Chartered Accountants of Sri Lanka (ICASL) the Board of Directors presents this Report on Internal Control.

The Board of Directors (the Board) is responsible for the adequacy and effectiveness of the system of internal controls in place at Commercial Bank of Ceylon PLC (the Bank). However, such a system is designed to manage the Bank’s key areas of risk within an acceptable risk profile, rather than to eliminate the risk of failure to achieve the policies and business objectives of the Bank. Accordingly, the system of internal controls can only provide reasonable but not absolute assurance against material misstatement of management and financial information and records or against financial losses or fraud.

The Board has established an ongoing process for identifying, evaluating, and managing the significant risks faced by the Bank and this process includes enhancing the system of internal controls as and when there are changes to business environment or regulatory guidelines. The process is regularly reviewed by the Board and accords with the “Guidance for Directors of Banks on the Directors’ Statement on Internal Control” issued by the ICASL. The Board has assessed the internal control taking into account all main principles for the assessment of internal control system as given in that guidance.

The Board is of the view that the system of internal controls in place over financial reporting is sound and adequate to provide reasonable assurance regarding the reliability of financial reporting, and that the preparation of Financial Statements for external purposes is in accordance with relevant accounting principles and regulatory requirements.

The Management assists the Board in the implementation of the Board’s policies and procedures on risk and control by identifying and assessing the risks faced, and in the design, operation, and monitoring of suitable internal controls to mitigate and control these risks.

Key features of the process adopted in applying and reviewing the design and effectiveness of the internal control system on financial reporting

The key processes that have been established in reviewing the adequacy and integrity of the system of internal controls with respect to financial reporting include the following:

  • Various appointed committees are established by the Board to assist the Board in ensuring the effectiveness of the Bank’s daily operations and that the Bank’s operations are in accordance with the corporate objectives, strategies, and the annual budget as well as the policies and business directions that have been approved.
  • Policies/Charters are developed covering all functional areas of the Bank and these are approved by the Board or Board approved subcommittees. Such policies and Charters are reviewed and approved periodically.
  • The Inspection/Internal Audit Department of the Bank checks for compliance with policies and procedures and the effectiveness of the internal control systems on an ongoing basis using samples and rotational procedures and highlight significant findings in respect of any non-compliance. Audits are carried out on all departments, branches, subsidiaries and overseas operations in accordance with the annual audit plan reviewed and approved by the Board Audit Committee (BAC). The frequency of audits of branches is determined by the level of risk assessed, to provide an independent and objective report. Findings of the internal audit are submitted to the BAC for review at their periodic meetings. Initiative taken by Inspection/Internal Audit Department to audit certain selected areas of the business “online” during the year 2016 on a limited scope, was enhanced to cover all branches in Sri Lanka and Bangladesh, Digital Banking Unit, Card Centre, Treasury and Finance during 2017. Through this initiative the controls are being tested on a near or real time basis. A significant improvement in methodology was made by testing the entire population of the data rather than on a random sample basis. The findings were tabled at the BAC meeting for review. The “Online Auditing” initiative has further strengthened the review of the design and effectiveness of the internal control system of the Bank by BAC.
  • The BAC of the Bank reviews internal control issues identified by the Internal Audit Department, Regulatory Authorities, External Auditors and Management, and evaluates the adequacy and effectiveness of the risk management and internal control systems. The BAC also carries out an annual evaluation to review the effectiveness of internal audit functions with particular emphasis on the scope, quality of internal audits, independence, and resources. The minutes of the BAC meetings are tabled at the meetings of the Board of Directors of the Bank on a periodic basis. Details of the activities undertaken by the BAC of the Bank are set out in the “Board Audit Committee Report”.
  • In assessing the internal control system over financial reporting, identified officers of the Bank, continued to review and update all procedures and controls that are connected with significant accounts and disclosures of the Financial Statements of the Bank. The Internal Audit Department of the Bank continued to verify the suitability of design and effectiveness of these procedures and controls on an ongoing basis. The assessment included subsidiaries and the Bangladesh operations of the Bank as well.

Since the adoption of new Sri Lanka Accounting Standards comprising SLFRSs and LKASs in 2012, processes that are required to comply with new requirements of recognition, measurement, presentation and disclosures were introduced and implemented in 2013. Continuous monitoring is in progress and steps are being taken to make improvements to the processes where required, to enhance effectiveness and efficiency. The Bank has documented procedures relating to these new requirements and updates the procedure manuals as and when necessary and also obtained approval of the BAC and the Board for changes made to the documented procedures. Automating the processes relating to various computations required under SLFRSs and LKASs including loan impairments are in progress. The Banks’ Internal Audit Department commenced testing these processes since first quarter 2013 and continued to do so in 2017 as well.

The Board also has taken into consideration the requirements of the Sri Lanka Accounting Standard – SLFRS 9 on “Financial Instruments” that has been issued with effective date being January 1, 2018, as it is expected to have a significant impact on the calculation of impairment of financial instruments on an “expected credit loss model” compared to the “incurred credit loss model” that is currently being applied under the Sri Lanka Accounting Standard – LKAS 39 on “Financial Instruments – Recognition and Measurement”.

With the assistance of an external consultant Messrs KPMG a Gap Analysis has been carried out to identify areas expected to have a potentially higher impact on amounts already reported in Financial Statements consequent to adoption of SLFRS 9. Subsequent to that and as per the Implementation Plan of the working committee formed, Bank has developed statistical models to compute the expected credit loss as required by SLFRS 9.

The Bank has completed the preliminary high level assessment of the potential impact on its Financial Statements for the year ended December 31, 2016 resulting from the application of SLFRS 9 with the assistance of Messrs KPMG.

The above assessment is yet to be validated and the Bank is in the process of assessing the additional loan loss provision impact on the Financial Statements for the year ended December 31, 2017, resulting from the application of SLFRS 9. The progress of the implementation of SLFRS 9 in the Bank is monitored by the BAC on an ongoing basis.

The comments made by the External auditors in connection with the internal control system during the financial year 2016 were taken into consideration and appropriate steps have been taken to incorporate them where appropriate.

The Assurance Report of the External Auditors in connection with internal control over financial reporting is appearing on

Confirmation

Based on the above processes, the Board of Directors confirms that the financial reporting system of the Bank has been designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of Financial Statements for external purposes has been done in accordance with the Sri Lanka Accounting Standards and regulatory requirements of the Central Bank of Sri Lanka.

Review of the Statement by External Auditors

The External Auditors, Messrs KPMG, have reviewed the above Directors’ Statement on Internal Control included in this Annual Report of the Bank for the year ended December 31, 2017 and reported to the Board that nothing has come to their attention that causes them to believe that the statement is inconsistent with their understanding of the process adopted by the Board in the review of the design and effectiveness of the internal control system over financial reporting of the Bank. Their Independent Assurance Report on the “Directors’ Statement on Internal Control” is given in this Annual Report.

By Order of the Board,

K G D D Dheerasinghe
Chairman

M P Jayawardena
Deputy Chairman

J Durairatnam
Managing Director/CEO

Colombo
February 23, 2018

logo
Close