Directors' Statement On Internal Control Over Financial Reporting

Responsibility

In line with the Banking Act Direction No. 05 of 2024, section 9.2(b), the Board of Directors presents this report on Internal Control over Financial Reporting.

The Board of Directors ("Board") is responsible for the adequacy and effectiveness of the internal control mechanism in place at Bank of Ceylon, ("the Bank"). In considering such adequacy and effectiveness, the Board recognizes that the business of banking requires reward to be balanced with risk on a managed basis and as such the internal control systems are primarily designed with a view to highlighting any deviations from the limits and indicators which comprise the risk appetite of the Bank. In this light, the system of internal controls can only provide reasonable, but not absolute assurance, regarding the reliability of Financial Reporting, and the preparation of Financial Statements for external purposes has been done in accordance with relevant accounting principles & regulatory requirements.

The Board has established an ongoing process for identifying, evaluating and managing the significant risks faced by the Bank and this process includes enhancing the system of internal control over financial reporting as and when there are changes to business environment or regulatory guidelines. The process is regularly reviewed by the Board and is in accordance with the guidance for Directors of banks on the directors' statement on internal control issued by the Institute of Chartered Accountants of Sri Lanka. The Board has assessed the internal control over financial reporting taking into account principles for the assessment of internal control system as given in that guidance.

The Board is of the view that the system of internal controls over financial reporting in place is sound and adequate to provide reasonable assurance regarding the reliability of financial

reporting, and that the preparation of Financial Statements for external purposes is in accordance with relevant accounting principles and regulatory requirements.

The management assists the Board in the implementation of the Board's policies and procedures on risk and control by identifying and assessing the risks faced, and in the design, operation and monitoring of suitable internal controls to mitigate and control these risks.

Key features of the process adopted in reviewing the design and effectiveness of the internal control system over financial reporting

The vital processes that have been established in reviewing the adequacy and integrity of the system of internal controls with respect to financial reporting include the following:

• Various committees are established by the Board to assist the Board in ensuring the effectiveness of the bank's daily operations and that the Bank's operations are in accordance with the corporate objectives, strategies and the annual budget as well as the policies, procedures and business directions that have been approved.
• The Internal Audit Division of the Bank checks for compliance with policies and procedures and the effectiveness of the internal control systems on an ongoing basis using samples and rotational procedures and highlights significant findings in respect of any noncompliance. Audits are carried out on all units and branches, the frequency of which is determined by the level of risk assessed using approved risk rating methodologies to provide an independent and objective report. The annual audit plan is reviewed and approved by the Board Audit Committee. In line with the approved annual audit plan, the Internal Audit

Division carries out onsite as well as offsite internal audits using a variety of methodologies and the audit findings are submitted to the Board Audit Committee for review.

• The Board Audit Committee of the Bank reviews internal control issues identified by the Internal Audit Division, the external auditors, regulatory authorities and the management, and evaluates the adequacy and effectiveness of the risk management and internal control systems. They also review the internal audit functions with particular emphasis on the scope of audits and quality of the same. All minutes of the Board Audit Committee meetings are forwarded to the Board. Detail analysis of the activities undertaken by the Audit Committee of the Bank are set out in the Audit Committee Report on pages 131 to 132 of the Annual Report.
• In assessing the internal control system over financial reporting, identified officers of the Bank collated all procedures and controls that are connected with significant accounts and disclosures of the Financial Statements of the Bank. These in turn were observed and checked by the Internal Audit Division for suitability of design and effectiveness on an ongoing basis. The assessment did not include subsidiaries of the Bank.
• The Bank adopted the Sri Lanka Accounting Standard SLFRS 9 - "Financial Instruments" with effect from 1st January 2018. In order to comply with the requirements of SLFRS 9, the Bank developed Expected Credit Loss (ECL) models using a wide range of forecast economic scenarios to determine impairment provisions with the support of an external consultant. These models are time to time validated by the Internal Audit Division and/or an external firm of

Chartered Accountants. The Bank has taken adequate measures to comply with the Directions No.13 and 14 issued by the Central Bank of Sri Lanka with regard to classification, recognition and measurement of credit facilities under SLFRS 9 effecting from 01.01.2022 and the same has been audited by the Internal Audit Division.

• The Bank is in the process of implementing an automated financial reporting solution in order to comply with the requirements of recognition, measurement, classification and disclosure of the financial instruments more effectively and efficiently and to facilitate the "Financial Statement Closure" process. This automated solution enables the calculation of impairment provisioning under SLFRS 9 - "Financial Instruments" and facilitates the fulfilling of internal and external reporting requirements.
• The Bank continued to approve the changes in the external environment during the year 2024 when making provisions for foreign currency financial instruments and loans and advances. The stringent measures adopted by the government to ease the fiscal and economic stresses including domestic debt restructuring, international debt optimization, changes in the inflation and interest rates were taken into consideration in this regard.
• In 2024, the Bank continued its compliance with the remaining moratorium packages which were introduced by the government to provide relief to those affected by COVID-19. The residual impact of COVID-19 on the Bank's customers in risk elevated industries such as tourism, constructions and textiles-export were also considered when assessing the impairment provisioning using the ECL models under SLFRS 9 "Financial

Instruments". With regard to the Economic Factor Adjustment (EFA), a favourable treatment was adopted with regard to term and vehicle loans considering the comments of the Auditors and industry level applications while in all other aspects a more prudential approach was taken when calculating the expected credit losses in 2024.

• A steering committee composing of various disciplines of the Bank monitors and coordinates the implementation of the automated financial reporting solution with special emphasis on the directions issued by the regulator for classification, recognition and measurement of credit facilities under SLFRS 9.
• The Bank is continuously monitoring and updating procedures inter-alia relating to impairment of loans and advances of the Bank and foreign branches, financial statement disclosures, risk management, related party transactions and all other significant banking activities based on the changing regulatory and market conditions. The requirements under SLFRSs/LKASs and regulatory directions have been communicated to the relevant stakeholders including the Board and senior management through training and awareness sessions.
• The comments made by the external auditors in connection with internal control system over financial reporting in previous years were reviewed during the year and appropriate steps have been taken to rectify them. The recommendations made by the external auditors in 2024 in connection with the internal control system over financial reporting will be addressed in the future.

Confirmation

Based on the above processes, the Board confirms that the financial reporting system of the Bank has been designed to provide a reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes has been done in accordance with Sri Lanka Accounting Standards and regulatory requirements of Central Bank of Sri Lanka.

Review of the Statement by External Auditors

The Auditor General with the assistance of Messrs Ernst & Young has reviewed the Directors' Statement on Internal Control over Financial Reporting for the year ended 31st December 2024 and reported to the Board that nothing has come to their attention that causes them to believe that the statement is inconsistent with his understanding of the process adopted by the Board in the review of the design and effectiveness of the internal control system over financial reporting of the Bank. The Report of the Auditor General on the Statement of Internal Control over Financial Reporting is given on page 176 of this Annual Report.

By order of the Board,

Chairman - Audit Committee

Chairman

Director

Colombo, Sri Lanka
24 February 2025