Friday Oct 09, 2026
Friday Oct 09, 2026
Friday, 9 October 2026 00:21 - - {{hitsCtrl.values.hits}}
 |
| CBSL Governor Dr. Nandalal Weerasinghe |
Scrutiny of National Development Bank’s (NDB) Board and external auditors intensified as Parliament’s Committee on Public Finance (CoPF) questioned why no Board member or senior official or auditor had been held responsible for the Rs. 13.6 billion fraud at the bank. The audit regulator’s findings on the auditors are due within two weeks.
CoPF Chair Dr. Harsha de Silva said the forensic review by Deloitte Touche Tohmatsu India LLP did not include any member of senior management in its list of those involved.
“So no senior person has been found fault with. Some senior person has to finally take responsibility for the integrity of the numbers presented to the auditor,” Dr. de Silva said. He added that if the external auditor had done its job properly, the blame could not rest only with junior officers.
“Are any heads going to roll? Is anyone going to be responsible for this at the end of the day? Are there conflicts of interest here, involving the external auditors and audit committees?” he asked.
Central Bank of Sri Lanka (CBSL) Governor Dr. Nandalal Weerasinghe told the Committee that the failure ran through every layer of the bank’s oversight. Internal auditors, the Chief Financial Officer (CFO), the Board Audit Committee, and the Board itself had all failed to detect the fraud, even after seeing and signing the financial statements.
“That tells us something has gone wrong in the internal control mechanism,” he said. “With a lot of respect to the accounting profession, none of these experts, the CFOs, audit committees, and the best accountants in this country, were able to detect this when it was presented on their table and they signed off.”
CBSL Deputy Governor K.G.P. Sirikumara said the forensic review had also examined how NDB’s Board-level and management risk committees performed.
“As much as the Sri Lanka Accounting and Auditing Standards Monitoring Board (SLAASMB) looked at the external auditor’s role, the mandate of the forensic auditor is to look at the processes and governance requirements as well. In that aspect, they have looked into several risk-related committees, the Operational Risk Management Committee, the Business Operations Risk Sounding Board, the Business Assurance Office, and so on. They looked at whether these have performed their role properly and whether the proper, adequate, and required coordination has been there,” Sirikumara said.
“Based on those findings, when we look at the bank’s management from the bank supervisor’s point of view, certain people may be found responsible for governance defaults or even negligence,” he added.
Sirikumara said the forensic auditor had not attributed responsibility for the fraudulent transactions themselves to those in oversight roles. Even so, anyone found responsible for governance or internal control failures would face consequences from the CBSL as the bank’s regulator, though these need not be criminal. The individuals already identified had committed financial crimes, not mere negligence, he said. Where negligence is found, whether it amounts to criminal negligence would depend on the circumstances.
The Governor said any key management personnel found negligent or wilfully involved in the fraud would fail the CBSL’s fit and proper assessment. “Obviously, I think that should be the end of this person’s suitability to serve any financial institution,” he said.
The SLAASMB told the CoPF that it has completed a separate investigation into whether NDB’s external auditors carried out their work in line with auditing standards. The report, prepared by the SLAASMB’s technical team, was presented to its Board last Friday and will be released within two weeks. Under its mandate, it will be shared with the CBSL and the Securities and Exchange Commission (SEC).
Dr. de Silva pressed the SLAASMB to look beyond the NDB case at the conduct and structure of the audit industry. He questioned whether auditors were honestly examining company records, or whether those signing off were doing so blindly or negligently.
“What about market capture? There are three or four audit firms, at least the big ones, that share a fair chunk of the market. Are there conflicts of interest? Where are they placed? What roles do they play? How politically important are they? Would you go into all of that?” he asked.
The Committee was told the issue merited a dedicated session with the SLAASMB Board. The SLAASMB was set up under an Act passed in 1995 and carries a wide mandate, but works with limited resources. Dr. de Silva agreed to hold a separate hearing with the SLAASMB Board, saying it was in the interest of financial system stability. The CoPF also asked the SLAASMB to share whatever it could from its NDB report once it is finalised.
MP Ravi Karunanayake said NDB’s CEFT receivables had quadrupled in a year to more than Rs. 12 billion in 2025, a figure disclosed in financial statements the external auditor certified as true and fair without raising concerns. CEFT, the Common Electronic Fund Transfer switch operated by LankaPay, is the national instant interbank transfer system. He asked who in the bank signed off on responses to audit queries about the balance.
CBSL officials said NDB’s accounts are signed by the CFO, the Chief Executive Officer, and the Chairman on behalf of the Board. The Board Audit Committee vouches for the integrity of the statements and the auditor’s management letter before they reach the Board.
The Governor maintained that the fraud, confirmed by the forensic review to be confined to NDB, had no impact on financial system stability. “Even within the bank, not a single deposit has been compromised. There is no spillover effect of this transaction to the other banks,” he said.
Dr. de Silva said the CBSL’s three-page summary of Deloitte’s six key findings contained nothing new. The Governor said the CBSL was awaiting the Attorney General’s advice on sharing the full report, given a non-disclosure clause in NDB’s agreement with Deloitte India.
LankaPay officials told the CoPF that it will float a request for proposals (RFP) for a central fraud monitoring system, due by September 2027, with requirements drawn up by local banking specialists and overseas fraud experts.
The Committee asked the Governor for a comprehensive note on the fraud’s causes and the CBSL’s preventive measures once it has studied the forensic review and the SLAASMB report.
