
The Chairman
Bank of Ceylon
Independent Assurance Report of the Auditor General to the Board of Directors on the Directors’ Statement on Internal Control Over Financial Reporting of Bank of Ceylon
Introduction
This report is to provide assurance on the Directors’ Statement on Internal Control over Financial Reporting (“Statement”) of Bank of Ceylon included in the Annual Report for the year ended 31 December 2017. In carrying out this assurance engagement I was assisted by a firm of Chartered Accountants in public practice.
Management’s Responsibility
Management is responsible for the preparation and presentation of the Statement in accordance with the “Guidance for Directors of Banks on the Directors’ Statement on Internal Control” issued in compliance with Section
3 (8) (ii) (b) of the Banking Act Direction
No. 11 of 2007, by The Institute of Chartered Accountants of Sri Lanka.
My Responsibility and Compliance with SLSAE 3050
My responsibility is to issue a report to the Board of Directors on the Statement based on the work performed. I conducted my engagement in accordance with Sri Lanka Standard on Assurance Engagements SLSAE 3050 – Assurance Report for Banks on Directors’ Statement on Internal Control issued by The Institute of Chartered Accountants of Sri Lanka.
Summary of Work Performed
My engagement has been conducted to assess whether the Statement is supported by the documentation prepared by or for Directors; and appropriately reflected the process the Directors have adopted in reviewing the system of internal control
over financial reporting of the Bank.
To achieve this objective, appropriate evidence has been obtained by performing the following procedures:
- Enquired the Directors to obtain an understanding of the process defined by the Board of Directors for their review of the design and effectiveness of internal control and compared their understanding to the Statement made by the Directors in the Annual Report.
- Reviewed the documentation prepared by the Directors to support their Statement made.
- Related the Statement made by the Directors to my knowledge of the Bank obtained during the audit of the Financial Statements.
- Reviewed the minutes of the meetings of the Board of Directors and of relevant Board Committees.
- Attended meetings of the Audit Committee at which the Annual Report, including the Statement on Internal Control is considered and approved for submission to the Board of Directors.
- Considered whether the Directors’ Statement on Internal Control covers the year under review and that adequate processes are in place to identify any significant matters arising.
- Obtained written representations from Directors on matters material to the Statement on Internal Control where other sufficient appropriate audit evidence cannot reasonably be expected to exist.
SLSAE 3050 does not require me to consider whether the Statement covers all risks and controls or to form an opinion on the effectiveness of the Bank’s risk and control procedures. SLSAE 3050 also does not require me to consider whether the processes described to deal with material internal control aspects of any significant problems disclosed in the Annual Report will, in fact, remedy the problems.
Conclusion
Based on the procedures performed, nothing has come to my attention that causes me to believe that the Statement included in the Annual Report is inconsistent with my understanding of the process the Board of Directors has adopted in the review of the design and effectiveness
of Internal Control over financial reporting
of the Bank.

H M Gamini Wijesinghe
Auditor General
