NDB Fraud: ‘Internal controls failed’: CBSL

The suspicious transactions which culminated in the Nation’s Development Bank (NDB) fraud of Rs 13.6 billion had not been detected as a concern among internal and external auditors and other higher-ups responsible for overseeing the bank’s governance, due to a lapse in internal controls, Central Bank of Sri Lanka Governor Dr Nandalal Weerasinghe said, speaking to the Committee on Public Finance.

“The internal auditor, CFO, audit committee, and even the Board have not been able to detect there was fraud. Even though they have seen and signed audit statements, and certified, they have not been able to detect that. That tells us there’s something wrong in the internal controls mechanism,” Dr Weerasinghe said, during the meeting that was meant to discuss the financial irregularities identified at NDB, in a subsequent audit report regarding the matter.

“That’s why even after that we have asked all the banks to give us assurances that internal controls and governance controls are adequate enough to prevent that kind of thing happening in the future,” he said.

According to a statement released by the CoPF, the audit report identifies the financial impact arising from fraudulent transactions amounting to Rs 13,639,664,684, or Rs 13.6 billion, up from the Rs 13.2 billion initial estimate.

Explaining the extent of the lapse in internal controls, Dr Weerasinghe noted that the irregularity had gone unnoticed due to persons engaged in the fraudulent activity also being tasked with offering reassurances on the suspicious transactions.

“The external and internal auditors have picked up on the variation in monthly balances, which was reported in the financial statement. Then they have given assurance to the Bank Supervision that these were the reasons for the variation – some fraudulent reasons obviously.”

“When the external auditor raised the question, when the internal auditor raised the question, when the board raised the question – every time those who were to answer were the people that had colluded and did the transactions.”

Dr Weerasinghe said that the persons responsible for the fraud had even offered assurances to the Central Bank’s bank supervision department too. “This assurance was given by the fraudulent people and that had been given to external auditors, internal auditors, the Board, and ultimately to the Bank Supervision [department].”

“That is where the colluded fraudulent activities happened, within the lack of internal controls in three independent functions: transaction monitoring, CEFT transaction, and other functions.”

“The role had been compromised. One person had intervened in all three areas, without proper controls, sharing passwords. These same people have been responding and giving assurances; saying this is something else, we will fix it next month and this is how it has gone on for a while. Until this was detected.”

However, CoPF Chairperson Harsha de Silva said that though no senior officers have been held culpable for the crimes, he urged that an individual within seniority must be held accountable for the responsibility of oversight into the matter.

“Some senior person has to finally take responsibility for the integrity of the numbers that are presented to the auditor. They can’t just find fault with some junior officer. The process is fairly clear. Standards are clear, that some senior person has to take responsibility,” he said.