We were engaged by the Board of Directors of Commercial Bank of Ceylon PLC (“the Bank”) to provide assurance on the Directors’ Statement on Internal Control over Financial Reporting (“Statement”) included in the Annual Report for the year ended December 31, 2018.
Management is responsible for the preparation and presentation of the Statement in accordance with the “Guidance for Directors of Banks on the Directors’ Statement on Internal Control” issued in compliance with Section 3(8)(ii)(b) of the Banking Act Direction No. 11 of 2007, by The Institute of Chartered Accountants of Sri Lanka.
We have complied with the independence and other ethical requirement of the Code of Ethics for Professional Accountants issued by The Institute of Chartered Accountants of Sri Lanka, which is founded on fundamental principles of integrity, objectivity, professional competence and due care, confidentiality and professional behaviour.
The firm applies Sri Lanka Standard on Quality Control 1 and accordingly maintains a comprehensive system of quality control including documented policies and procedures regarding compliance with ethical requirements, professional standards and applicable legal and regulatory requirements.
Our responsibility is to assess whether the Statement is both supported by the documentation prepared by or for directors and appropriately reflects the process the directors have adopted in reviewing the design and effectiveness of the internal control of the Bank.
We conducted our engagement in accordance with Sri Lanka Standard on Assurance Engagements (SLSAE) 3050 (Revised), Assurance Report for Banks on Directors’ Statement on Internal Control, issued by The Institute of Chartered Accountants of Sri Lanka.
This Standard required that we plan and perform procedures to obtain limited assurance about whether Management has prepared, in all material respects, the Statement on Internal Control.
For purpose of this engagement, we are not responsible for updating or reissuing any reports, nor have we, in the course of this engagement, performed an audit or review of the financial information.
We conducted our engagement to assess whether the Statement is supported by the documentation prepared by or for Directors; and appropriately reflected the process the Directors have adopted in reviewing the system of internal control over financial reporting of the Bank.
The procedures performed were limited primarily to inquiries of Bank personnel and the existence of documentation on a sample basis that supported the process adopted by the Board of Directors.
SLSAE 3050 (Revised) does not require us to consider whether the Statement covers all risks and controls or to form an opinion on the effectiveness of the Bank’s risk and control procedures. SLSAE 3050 (Revised) also does not require us to consider whether the processes described to deal with material internal control aspects of any significant problems disclosed in the Annual Report will, in fact, remedy the problems.
The procedures selected depend on our judgement, having regard to our understanding of the nature of the Bank, the event or transaction in respect of which the Statement has been prepared.
We believe that the evidence we have obtained is sufficient and appropriate to provide a basis for our conclusion.
Based on the procedures performed, nothing has come to our attention that causes us to believe that the Statement included in the Annual Report is inconsistent with our understanding of the process the Board of Directors has adopted in the review of the design and effectiveness of internal control over financial reporting of the Bank.
February 22, 2019