The recent revelations surrounding the large-scale fraud at NDB Bank—now estimated in excess of Rs. 13 billion—have sent shockwaves across Sri Lanka’s financial system and raised serious concerns regarding governance, internal controls, and institutional oversight. This incident has demonstrated, in no uncertain terms, that even well-established control frameworks—comprising Board Audit Committees, Risk Management Committees, internal audit functions, and external audits—can fail when confronted with collusion, manipulation, and systemic complacency.
Preliminary findings suggest that a small group of individuals were able to exploit weaknesses in General Ledger entries, Suspense Accounts, and CEFTS-related transactions over a prolonged period. This raises a fundamental question: how could such activities remain undetected despite multiple layers of oversight? Obviously, One critical gap stands out—the absence of an effective and trusted whistleblowing mechanism.
It is my considered view that this fraud could have been detected at a much earlier stage, or even prevented altogether, had there been a secure, confidential, and well-publicised channel through which employees could report suspicious activities without fear of retaliation by blowing the whistle to the management
What is whistleblowing?
When employees discover unethical, immoral, illegal transactions or potentially damaging information for the well-being of an institution in which they are employed, they are expected to disclose this sensitive information to an authority in the organisational hierarchy through a formal or informal mechanism which in common parlance is called “Whistleblowing”. (WB). Modern management considers that the non-adoption of WB is a failure of the organisation culture. This has become absolutely true in the light of the massive NDB escapade to the tune of Rs. 15 billion collectively engineered by a couple of employees in collusion within a matter of two years.
There are many lessons in the history that actions of WB have been potentially beneficial to the institutions in which the workers are employed in particular and to the entire economy and society in large. On the other hand it has to equally understand that the consequences of WB are extreme and include possible firing, civil action or even imprisonment.
The lady Accountant at the infamous Enron Company in the USA had to resign after inaction by CEO Kenneth Lay as a consequence of exposure of large scale accounting irregularities similar to that of the NDB scandal. She was demoted 33 floors from her mahogany suite to a “shabby office” with a rickety metal desk and a file make-work projects. Enron subsequently collapsed amid claims of regulatory indifference and complicity by auditors. Enron Kenneth died of a heart attack in the fourth month of trial and its CEO Jeffrey Skilling was sentenced to 24 years in prison in one of the corporate scandals in US history. The disgraced CEO forfeited 45 million worth of assets including his house as a result of a mountain of shady deals.
Pre-requisites of WB
My familiarity with the subject of WB in the private sector during the last four decades proved the fact that the mere installation of the WB mechanism has not been effective and has not yielded tangible results. It is a myth that concerns of the internal customers will be automatically flowing in once the WB procedures are set in motion. There are certain prerequisites to be adhered to in order to reap the full effectiveness of the WB procedure. It is incumbent upon all the commercial and development banks to adopt this WB mechanism in their respective banks and train their employees with regard to the key prerequisites, if the WB policy is to achieve the intended results.
1.
Magnitude of consequences: An employee should ask himself/herself how much harm will be caused or has been done or might be done as a result of the WB. If the entire banking sector or the economy or the bank he is employed in will be harmed, it is very likely that the unethical behavior warrants blowing the whistle.
2.
Probability of the effect: The employee must have an absolute proof that there will be dire consequences on the bank or the institution, its internal (employees) and external customers and its reputation as a result of the unethical transaction. The probability that the undesirable deal will actually take place resulting in a deleterious impact on the stakeholders must be considered. It is the responsibility of the employer to train its employees in the identification of the magnitude of damages.
3.
Temporal immediacy: An Employee blowing the whistle must consider the duration involved between the present and possibly harmful event. The more immediate the consequences of the potentially unethical practice, the stronger the case for WB. Had there been a WB at the initial stage of the NDB scandal, the NDB would not have incurred a massive loss of Rs 13 billion besides the wrath of the stakeholders.
4. Proximity: This question arises about matters of emotional proximity or situations in which the unethical deal relates to a victim with some emotional attachment to the whistleblower. Surely, the NDB scandal has not only made an irreparable dent on the reputation of the bank.
5.Concentration of effort: Employees must always consider the degree of intensity of the unethical practice or behavior, before blowing the whistle. The question is how much intensity does the infringement carry and whether a minor infringement warrants a whistleblowing. In any organisation, there can be certain operational loopholes which do not require the intervention of the management, as its impact is inevitably negligible. In such a situation, the effects of the WB are meaningful and productive. When it comes to the NDB scandal, the question is why the NDB has failed to train its employees in the identification of operational loopholes or negative situations that allow the undesirables to engage in corrupt deals.
Why whistleblowing mechanisms are imperative
A properly designed whistleblowing framework is not merely a compliance formality; it is a strategic risk management tool that offers several tangible benefits:
- Early detection of fraud and irregularities: Employees are often the first to observe unusual patterns. Providing them with safe reporting channels enables early intervention before losses escalate.
- Strengthening internal controls: Whistleblowing acts as an additional “line of defence,” complementing existing audit and risk management systems.
- Enhancing corporate governance: It promotes transparency, accountability, and ethical conduct at all levels of the organisation.
- Protecting institutional reputation: In the banking sector, trust is paramount. Prompt detection and action help preserve depositor confidence and market credibility.
- Regulatory alignment and global best practices: Leading financial systems worldwide mandate whistleblower protection as a core governance requirement. Sri Lanka’s banking sector must align with these evolving standards.
- Reducing financial and legal exposure: Early reporting minimises potential losses, litigation risks, and regulatory penalties.
In light of the above, it is respectfully urged that all banks to:
1.Establish independent, confidential, and anonymous whistleblowing channels.
2. Ensure direct access to the Board Audit Committee or an independent oversight body.
3. Provide legal and institutional protection to whistleblowers against retaliation.
4 Promote a culture of openness and ethical responsibility across all levels.
5. Periodically review and strengthen the effectiveness of such mechanisms.
The NDB incident should not be viewed as an isolated failure but as a critical warning signal to the entire banking industry. The cost of inaction is far greater than the effort required to implement preventive safeguards
Moral justification
WB should not be undertaken in a capricious manner. Whistleblowers should bear in mind that his action to blow the whistle will have dire consequences on the Company and its employees and therefore a strong moral justification must exist for blowing the whistle. Hence, it is important for the banks to train their employees in the matter of whistleblowing. The employees should be specifically advised that they should blow the whistle only on the fulfillment of the following conditions only as a last resort.
The whistleblower should satisfy himself that a grave injustice or wrongdoing is occurring and it has not been resolved despite using all appropriate channels allowed by the bank. The whistleblower is thoroughly convinced of the genuineness of the facts contained in the whistleblowing after investigation. The WB should morally justify that his course of action by appeals to ethical theories, principles and other relevant facts have not yielded desired results.
Role of the Chairman of the Audit Committee
THE Chairman of the Audit Committee has a pivotal role to play in listening to the complaints made by the WBs. He should immediately galvanise into action by investigating the veracity of the WB’s message in good faith. The Chairman of the Audit Committee should be an external director who is not involved in the day to day affairs of the bank. He or she should essentially possess an immaculate integrity and trustworthiness similar to that of Caesar’s wife who was said to be above suspicion so that nobody should challenge or sully his status, reputation and prestige. He should equally realise that a mere lapse on his part will result in blotting the copybook of the rest of the directors serving in the main board.
A call for immediate action
The NDB incident should not be viewed as an isolated failure but as a critical warning signal to the entire banking industry. The cost of inaction is far greater than the effort required to implement preventive safeguards. Sri Lanka’s banking system stands at a pivotal moment. By embracing robust whistleblowing mechanisms, banks can not only prevent future crises but also reinforce public confidence in the integrity and resilience of the financial sector.
(The author is a Productivity Specialist and Management Consultant. He could be reached via email at [email protected])
