Accounting during a forensic audit: what to outsource and keep

Accounting during a forensic audit in Sri Lanka has to carry on under two rules that do not move. Under section 150(1) of the Companies Act, No. 7 of 2007, the board must ensure the financial statements are completed within six months of the balance sheet date, or any longer period the Registrar allows. Under section 120(6) of the Inland Revenue Act, No. 24 of 2017, records are kept for five years from the transaction, or longer until the assessment time limit has expired and any related proceedings have been completed. Outsourcing the work changes who does it. It does not change who is responsible.

This article maps the work of a small company's finance function into six groups, shows which parts can be handed to an outside accountant and which should stay with the directors, and sets out how to bring in outside help while an investigation is running without weakening it. The map and the steps are practice. Where the law sets a duty, we quote it.

A finance function fits into six groups of work

A small company rarely has a finance department. It has a bookkeeper, a director who signs payments, an auditor once a year and a payroll someone runs. The work is still there whether or not anyone owns it, and when something goes wrong, the gaps show up at once.

The grouping below is our own, built for owner-managed companies. It is not a statutory or professional list, and other frameworks group the same work differently.

• Record to report: chart of accounts, posting, bank and cash reconciliation, month-end close, management pack, year-end accounts. If this is weak, everything after it is weak.
• Purchase to pay: supplier set-up, purchase approvals, invoice matching, payment runs, petty cash. This is where money leaves the business; see our petty cash system guide.
• Order to cash: customer credit, invoicing, receipts, debtors ageing, revenue cut-off.
• People: payroll, APIT, EPF and ETF, gratuity provision.
• Tax and compliance: VAT and SSCL, income tax and instalments, withholding tax, company secretarial filings, record retention.
• Control and planning: budget, cash forecast, treasury and banking, fixed asset register, insurance.

Put two names against every function

This is practice. For each function, write down who does it (a name, not a role), who reviews it (a different name), how often, and where the evidence is kept. A function with no name, or the same name in both columns, is a gap. In a five-person company you will not separate everything, and that is normal. Put review where the risk is highest: payments, payroll and bank reconciliations.

The board keeps the duty even when the work is outsourced

Functions tend to fall into three groups:

• Keep with the directors: approvals, payment release, banking authority and credentials, and decisions on budget and pricing.
• Share: month-end close, management pack, cash forecasting. Staff do the routine work and an outside accountant reviews it.
• Outsource readily: payroll calculation, statutory returns, year-end accounts, secretarial filings and specialist tax work.

Whatever you outsource, the duty stays with the company. Section 150(1) of the Companies Act says: "The board of every company shall ensure that within six months or within such extended period as may be determined by the Registrar after the balance sheet date of the company, financial statements that comply with the requirements of section 151 are (a) completed in relation to the company and that balance sheet date; (b) certified by the person responsible for the preparation of the financial statements that it is in compliance with the requirements of this Act; and (c) dated and signed on behalf of the board by two directors of the company or if the company has only one director, by that director" [1].

Section 150(2) makes every director in default guilty of an offence, with a fine not exceeding one hundred thousand rupees [1]. On our reading, an outside accountant can prepare the statements and give the certificate in (b), but the board must ensure they are done and two directors (or the sole director) sign them. Section 148(1) separately requires the company to keep accounting records that "correctly record and explain the company's transactions" and that enable the financial statements "to be readily and properly audited" [1]. Our guide to bookkeeping basics covers what those records contain, and our outsourced accounting guide for SMEs covers how to choose a provider.

A forensic audit answers specific questions, not the whole accounts

"Forensic audit" is not a term defined in the Companies Act or the Inland Revenue Act; we searched both texts on 22 October 2026 and found no definition. In practice it means a targeted investigation of financial records to establish facts, usually about suspected fraud, misappropriation, a shareholder dispute or a disputed transaction, to a standard that could support legal action. A board, a shareholder group, a lender, an insurer or a regulator may commission one.

It is different from the annual statutory audit. The statutory auditor gives an opinion on the financial statements as a whole. The forensic team looks at specific questions in depth, and may interview staff, copy computers and trace individual payments. It is also different from rebuilding books that were never kept: that is reconstruction, and calling it "forensic" suggests an investigation nobody has commissioned.

Outsourced accounting during a forensic audit needs four boundaries

An investigation does not pause the calendar. Payroll, returns and supplier payments still fall due, and the people who normally handle them may be busy answering the investigators' questions. This section is practice, with the legal points noted.

Keep the bookkeepers and the investigators separate

The accountant running the books and the forensic team investigating them should be different people, and preferably different firms. A firm that rebuilds the books and also judges what went wrong is checking its own work. The accountant's job is to keep the current records accurate and to make documents available when the investigators ask for them. Deciding what happened in the periods under review is the investigators' job alone. If one firm must do both, set out the separation in writing and tell whoever commissioned the investigation.

Preserve the records before anyone posts

Before the new accountant posts anything, preserve what exists: a full export or backup of the accounting system, copies of bank statements, the mailboxes and files of finance staff, and the paper files. The forensic team will usually say how. This also matters for tax. Section 120(6) of the Inland Revenue Act says a person required to prepare or retain records "shall retain such records (a) for a period of five years from the date on which the transaction took place; or (b) for a period exceeding five years, until expiration of the time limit for assessment of tax for any tax period to which the records are relevant and until any related proceedings have been completed" [2].

On our reading, if the investigation leads to tax proceedings, limb (b) keeps the records in play until those proceedings end, which can be well past five years. Section 120(5) also requires the source documents behind the records to be kept [2].

Lock the past and correct forward

Close and lock every period under investigation in the accounting software. The outside accountant posts corrections in the current period with clear references, and does not edit historical entries. Every correction should trace from the original entry to the adjustment and its reason. Whether any earlier return needs amending is a separate tax question for its own adviser.

Control access and payment authority

Remove system and bank access for anyone placed on leave or under investigation, through the formal process. Change shared passwords. Give the outside accountant the access needed for current work and the forensic team read-only access to the history. As a general control, whoever records a payment should not also approve it, and no single outsider should hold the only set of banking credentials. Approval and release stay with the directors, and that matters more during an investigation.

Payroll and filings must stay on time while the investigation runs

The outside team's first priorities are usually payroll, statutory payments and returns, supplier payments and bank reconciliations. Late filings during an investigation add penalties to an already difficult position; our penalty calculator shows how they build up, and our article on RAMIS penalties explains the late filing and late payment rules. If prior years need rebuilding, treat that as a separate piece of work with its own scope; our article on rebuilding accounts from bank statements covers the method.

Write the engagement letter around the boundaries

The engagement letter should set out the scope (current-period accounting and payroll, not investigation), the periods covered, who the accountant reports to, how anything that looks relevant to the investigation is passed on, confidentiality, and access to records. Where proceedings are possible, take legal advice on who commissions which work.

A worked example

Hypothetical. A building materials wholesaler with three branches is in a dispute between its two shareholder families over disputed payments to a contractor. The board appoints an investigating firm to examine four years of contractor payments, and a separate accountant to run current bookkeeping and payroll. Before handover the system is exported and every period up to the handover date is locked. The accountant runs that month's payroll, files the returns falling due and reconciles the bank from the handover date forward. The investigators work from the preserved copy. Neither team edits the other's records, and the directors keep payment release throughout.

What this means for you

Map your finance work into the six groups, put a name and a reviewer against each function, and put review where money leaves the business. Outsource what makes sense, knowing that under section 150 the board stays responsible for the financial statements. If a forensic audit starts, separate the people running the books from the people investigating them, preserve the records first, lock the past, keep payment approval with the directors and keep the statutory work on time. Our accounting services, bookkeeping services and payroll services cover the current-period work; investigation itself belongs with a forensic firm.

Checklist: documents needed

• Function map with "does" and "reviews" names
• Bank mandates, signatory list and system access list
• Full export or backup of the accounting system
• Bank statements for the periods under review
• Mailbox and file archives of finance staff
• Engagement letters for the outside accountant and the forensic team
• Record of periods locked and the date locked
• Schedule of statutory filings and payments due

FAQ

Can a company outsource its whole finance function in Sri Lanka?

Most of the work can be outsourced, but not the responsibility. Approvals, payment release and banking authority should stay with the directors, and section 150(1) of the Companies Act keeps the duty to complete the financial statements on the board. An outside accountant can prepare and certify them; two directors, or the sole director, sign them.

Can our outsourced accountant also do the forensic audit?

It is better not to. A firm that rebuilds or runs the books and then investigates them is checking its own work, which weakens the findings. If one firm must do both, separate the teams in writing, keep the investigation conclusions with the investigating team, and tell whoever commissioned the forensic audit about the arrangement.

How long must records be kept if there is an investigation?

At least five years from the transaction, and longer where limb (b) of section 120(6) of the Inland Revenue Act applies. Records relevant to a tax period are kept until the time limit for assessing that period expires and any related proceedings are completed, so a dispute can extend the period well beyond five years.

Should errors found during the investigation be corrected straight away?

Correct them in the current period with references, but only after the records are preserved and the history is locked. Agree the timing with the forensic team so corrections do not disturb the evidence. If earlier tax returns turn out to be wrong, treat amended returns as separate tax work with its own scope and adviser.

Open points

• Forensic standards. Professional standards for forensic engagements were not reviewed.
• Legal privilege. Whether an investigation should be commissioned through lawyers to protect privilege is a legal question we did not cover.
• Employment process. Leave, suspension and disciplinary steps under employment law were not reviewed.
• Other retention rules. Retention periods under other laws (for example VAT or company law) were not compared here.

Last verified

We read the Companies Act, No. 7 of 2007 ss.148(1), 150(1) and (2), and the Inland Revenue Act, No. 24 of 2017 s.120(5) and (6) (IRD consolidation up to 2025) on 22 October 2026, and checked that the Companies (Amendment) Act No. 12 of 2025 does not amend ss.148 or 150.

The short version

A small company's finance work fits into six groups. Name who does and who reviews each function. Outsource routine work, but the board stays responsible for the financial statements under section 150. During a forensic audit, keep bookkeepers and investigators apart, preserve and lock the records before any change, keep payment approval with the directors, keep records until proceedings end, and keep payroll and filings on time.

---

Talk to us. If you need the books, payroll and filings kept running while an investigation proceeds, our contact page.

WinCore Pvt Ltd

This article is general information, not advice for your specific situation.

---

References

1. Parliament of Sri Lanka. Companies Act, No. 7 of 2007, ss.148, 150. https://www.parliament.lk/uploads/acts/gbills/english/3776.pdf . Primary. Accessed 22 October 2026. Amendment check: Companies (Amendment) Act, No. 12 of 2025, https://www.parliament.lk/uploads/acts/gbills/english/6389.pdf . Primary. Accessed 22 October 2026.
2. Inland Revenue Department. Inland Revenue Act, No. 24 of 2017 (consolidated up to 2025), s.120(5), (6). https://www.ird.gov.lk/en/publications/Acts_Income%20Tax_2017/IRA_Cons_Act_-_2025_Changes.pdf . Primary (consolidation). Accessed 22 October 2026.