NDB, Audit failures, and the silence of oversight institutions

The recent concerns raised by the Committee on Public Finance (CoPF) regarding the alleged Rs. 13.2 billion fraud at National Development Bank have shifted the discussion beyond the conduct of individuals. The real question now is far larger and more troubling: how could alleged irregularities of this scale continue within a regulated banking institution without earlier detection or intervention?

The issue is no longer merely one of fraud. It is now a broader examination of governance, audit effectiveness, regulatory supervision, and institutional accountability.

It is important at the outset to recognise a fundamental principle often misunderstood by the public: an external audit is not a guarantee that fraud will never occur or will be detected. Auditors provide what auditing standards describe as “reasonable assurance,” not absolute assurance. Sophisticated frauds involving collusion, management override, or falsified documentation can evade detection even within properly conducted audits.

However, that principle cannot become a blanket defence against scrutiny.

When alleged irregularities continue over prolonged periods within a licensed commercial bank, questions inevitably arise regarding the effectiveness of internal controls, internal audit, Board Audit Committees, external audit procedures, banking supervision, and the wider audit oversight framework itself.

This naturally raises the question: where are the country’s professional and oversight institutions in this discussion?

The Institute of Chartered Accountants of Sri Lanka (CA Sri Lanka) is not merely an educational institution conducting examinations and issuing memberships. It is also the primary professional body responsible for maintaining confidence in the accounting and auditing profession. At moments such as these, silence itself can become problematic.

This does not mean that auditors should be condemned before investigations are completed. Due process must prevail. Yet there remains a difference between prejudgment and institutional leadership.

Equally important is the role of the Sri Lanka Accounting and Auditing Standards Monitoring Board (SLAASMB), established precisely to oversee compliance with accounting and auditing standards in major entities, including banks.

“In theory, the SLASMB represents an important safeguard within Sri Lanka’s financial reporting architecture. In practice, however, the public rarely sees visible enforcement activity proportionate to the risks confronting the financial system. One therefore wonders whether taxpayers can continue to justify sustaining oversight institutions that appear largely absent during moments of major financial controversy.”

This raises an uncomfortable but necessary question: is the present oversight framework truly equipped to deal with complex banking audit failures?

Investigating major banking audits requires specialised expertise in banking systems, IFRS reporting, forensic accounting, internal controls, audit working papers, and fraud-risk assessment. The challenge is therefore not merely legal authority, but institutional capacity.

Derivative proceedings 

The emergence of derivative proceedings filed by shareholder M. Thiyagarajah is also significant. Whatever the eventual outcome of the litigation, the fact that even a single shareholder has sought judicial intervention against directors and external auditors reflects the seriousness of the governance concerns now surrounding the matter.

The derivative action also highlights an important principle often overlooked in Sri Lanka’s corporate environment: shareholders are not merely passive investors, but stakeholders entitled to demand accountability where they believe the interests of the company itself have been compromised.

In many respects, the emergence of shareholder-led litigation may itself indicate a perceived vacuum in institutional enforcement and oversight.

Ultimately, the larger issue is not merely whether fraud occurred at one bank. The larger issue is whether Sri Lanka’s governance and audit oversight architecture remains sufficiently robust to sustain public confidence in audited financial statements of systemically important institutions.

That is the real question now emerging from the NDB episode.

And it is a question that cannot be answered by silence on the part of the responsible authorities.

A concerned investor - Moratuwa