Statutory audit preparation in Sri Lanka: confirmations, materiality

Statutory audit preparation in Sri Lanka starts from one rule: under section 154(1) of the Companies Act, No. 7 of 2007, "A company shall at each annual general meeting, appoint an auditor" to audit its financial statements, and we found no size-based exemption in the Act or in the Companies (Amendment) Act No. 12 of 2025 when we checked on 22 October 2026. The only carve-out we found is narrow: section 159(3) lets shareholders resolve unanimously that no first auditor be appointed, and that resolution ends at the start of the first annual general meeting. Section 164 then gives the auditor access to every record, with fines of up to Rs 100,000 for directors and employees who do not cooperate.

For most small companies the audit is the one time an outsider goes through the books in detail. Done well, it takes a few weeks. Done badly, it drags on for months while the auditor waits for confirmations, schedules and explanations that should have been ready on day one. This article covers who must be audited, what the auditor is entitled to, and the three areas that cause most delay: bank confirmations, materiality, and the difference between a review and an audit, with a short note on going concern.

Every company appoints an auditor at each AGM, with one narrow exception

Section 154(1) says: "A company shall at each annual general meeting, appoint an auditor to (a) hold office from the conclusion of that meeting until the conclusion of the next annual general meeting; and (b) audit the financial statements of the company and if the company is required to complete group financial statements, those group financial statement for the accounting period next after the balance sheet date for which financial statements were audited" [1].

The rest of the auditor sections fill in the detail [1]:

• Casual vacancy and default appointment. The board may fill a casual vacancy (s.154(2)). If no auditor is appointed at the AGM, or a casual vacancy is not filled within one month, "the Registrar may appoint an auditor" (s.154(3)).
• Notice to the Registrar. The company must give written notice "within five working days of the power becoming exercisable" (s.154(4)). Failing to do so is an offence: the company is liable to a fine not exceeding Rs 200,000 and every officer in default to a fine not exceeding Rs 100,000 (s.154(5)).
• Automatic re-appointment. An auditor is "deemed to be re-appointed" at an AGM unless not qualified, replaced by resolution, or the auditor has given notice of not wishing to continue (s.158(1)). To replace the auditor, see how to change auditor.
• First auditor. The board may appoint the first auditor before the first AGM (s.159(1)). Under s.159(3), neither the board nor the company is required to appoint one under that section "if a unanimous resolution is passed by the shareholders that no auditor be appointed. Such a resolution ceases to have effect at the commencement of the first annual general meeting." For how an auditor registers on eROC, see auditor registration.
• Who may act. An auditor must be a member of the Institute of Chartered Accountants of Sri Lanka or a registered auditor; for a company other than a private company or a company limited by guarantee, only an ICASL member may act (s.157(1), (2)). A director or employee of the company cannot act (s.157(3)).

We found no small-company audit exemption

Section 154(1) applies to "a company", with no size test. We searched the full text of the Act on 22 October 2026 for "exempt", "dispense" and "not required to appoint" near the auditor provisions; the only provision that lets a company go without an auditor is the first-auditor resolution in s.159(3). The Second Schedule, which lists the sections a private company can set aside by unanimous shareholder agreement under s.31, does not include any auditor section. The Companies (Amendment) Act No. 12 of 2025 does not amend ss.154 to 164 [2]. On our reading, every company under the Act must have its financial statements audited each year once its first AGM is held. Other laws may add audit requirements for particular entities; we did not review those.

The board's own duty to complete the financial statements sits in section 150, which we cover in our article on accounting during a forensic audit. Section 148(1)(c) also requires accounting records that enable the financial statements "to be readily and properly audited" [1].

The auditor has a legal right to your records and explanations

Section 164(1): "The board of a company shall ensure that an auditor of a company has access at all times to the accounting records and other documents of the company." Section 164(2): "An auditor of a company is entitled to require from a director or employee of the company, such information and explanations as he thinks necessary for the performance of his duties as auditor" [1].

These are not courtesies. Under section 164(3), where the board fails to comply with subsection (1), every director in default is guilty of an offence with a fine "not exceeding one hundred thousand rupees". Under section 164(4), a director or employee who fails to comply with subsection (2) "or provides false information" faces the same maximum. Section 164(5) gives an employee a defence if the information was not in his possession or control, or his position or duties meant he could not give the explanations [1].

Bank confirmations come from the bank straight to the auditor

Sri Lanka Auditing Standard (SLAuS) 505, External Confirmations, issued by CA Sri Lanka and effective for audits of periods beginning on or after 1 January 2014, defines an external confirmation as "Audit evidence obtained as a direct written response to the auditor from a third party (the confirming party)" (para 6(a)). It requires the auditor to "maintain control over external confirmation requests" (para 7), and sets what the auditor must do "If management refuses to allow the auditor to send a confirmation request" (para 8) [3].

In practice, the company signs a letter authorising its bank to reply, and the bank replies to the auditor, not to you. What commonly causes delay is practice, not law:

• Authority letters. Banks usually need the company's written authority signed by the authorised signatories. Sign as soon as the auditor asks.
• Every account. Include dormant accounts, foreign currency accounts, fixed deposits, overdrafts, loans and cards. A missing account becomes a finding; a bank account register keeps the list complete.
• Bank charges. Banks may charge for confirmations. Budget for it.
• Reconciliations ready. The confirmed balance should match your reconciled year-end balance. Have the reconciliations and outstanding items list ready; our year-end close guide sets out the steps.
• Security and guarantees. The reply may disclose charges or guarantees you have forgotten. Disclose them in the accounts first.

Auditors may also confirm debtors, creditors, lawyers and related companies in the same way.

Materiality covers size and nature, alone or together

Materiality decides what matters in the financial statements. SLFRS for SMEs (2015) paragraph 3.16 says: "Omissions or misstatements of items are material if they could, individually or collectively, influence the economic decisions of users made on the basis of the financial statements. Materiality depends on the size and nature of the omission or misstatement judged in the surrounding circumstances. The size or nature of the item, or a combination of both, could be the determining factor" [4].

Two points follow, on our reading. A small item can be material by nature, such as a payment to a director or a loan covenant breach. And "collectively" means small errors add up.

The auditor sets its own materiality under SLAuS 320, Materiality in Planning and Performing an Audit. It requires that "When establishing the overall audit strategy, the auditor shall determine materiality for the financial statements as a whole" (para 10), and a lower "performance materiality" (para 11) [5]. Its guidance says "A percentage is often applied to a chosen benchmark as a starting point", and gives as an example that an auditor "may consider five percent of profit before tax from continuing operations to be appropriate for a profit-oriented entity in a manufacturing industry" [5]. That is an example, not a rule. CA Sri Lanka has also issued a separate SLAuS for the audits of non-specified business enterprises, for small and medium-sized entities without public accountability that use the cost model, which "only considers simple benchmarks" for materiality [6].

What it means in practice: fix known errors before the audit, however small, because the auditor adds uncorrected items together, and do not assume a small item is safe if it involves directors, related parties or tax.

A worked example

Hypothetical. A logistics company with Rs 300 million revenue finds three errors before the audit: an unrecorded bank charge of Rs 45,000 and an accrual missed by Rs 120,000, both of which overstate profit, and a supplier invoice of Rs 180,000 posted twice, which understates it. The net effect is a Rs 15,000 understatement of profit, but the gross errors total Rs 345,000 (our arithmetic: 45,000 + 120,000 = 165,000 overstated; 180,000 understated; net 15,000; gross 345,000). Paragraph 3.16 looks at items "individually or collectively", and offsetting errors can hide a weak process. Fixing all three before fieldwork removes the question.

A review engagement is not a substitute for the statutory audit

CA Sri Lanka issues Sri Lanka Standards on Review Engagements. SLSRE 2400 (Revised), Engagements to Review Historical Financial Statements, is effective for reviews of financial statements for periods beginning on or after 1 January 2015, and says "The practitioner performs primarily inquiry and analytical procedures to obtain sufficient appropriate evidence as the basis for a conclusion on the financial statements as a whole" [7]. An audit under the SLAuS series goes further, with testing and confirmations, and ends in an audit opinion.

A review is quicker and usually costs less, but on our reading of section 154 it does not satisfy the statutory audit requirement for a company. Reviews are used for interim figures, for lenders who accept them, and for entities that are not companies under the Act. If someone offers a review in place of a company's statutory audit, ask which law allows it. For whether the audit is required at all, see does a private company need an audit.

Going concern needs a forecast before the auditor asks

SLFRS for SMEs paragraph 3.8 requires management to assess the entity's ability to continue as a going concern, taking into account information about the future "which is at least, but is not limited to, twelve months from the reporting date"; paragraph 3.9 requires material uncertainties to be disclosed [4]. In practice, prepare a cash flow forecast covering at least twelve months from the year end, with assumptions written down, and evidence of funding such as facility letters. Our cash flow forecast tool is a starting point.

Statutory audit preparation in Sri Lanka takes six steps

This section is practice.

1. Close the year properly. Reconcile every bank, control and intercompany account, using the same routine as our month-end close checklist.
2. Prepare a schedule for every balance: fixed asset register, debtors and creditors ageing, accruals, prepayments, loans, and tax, VAT and payroll liabilities.
3. Sign confirmation authorities early.
4. Collect key documents: board minutes, new contracts, loan agreements, leases and legal correspondence.
5. Answer questions in writing, with evidence attached.
6. Name one person to coordinate with the auditor.

What this means for you

Every company under the Companies Act must appoint an auditor at each annual general meeting; the only carve-out we found is the unanimous first-auditor resolution in s.159(3), which ends at the first AGM. The board must give the auditor access to all records, and directors and employees must answer the auditor's questions. Prepare reconciliations and schedules before fieldwork, sign bank confirmation authorities early, fix known errors however small, and have a going concern forecast ready. A review is not a substitute for a company's statutory audit. Our audit support services and accounting services prepare the schedules and answer auditor queries, and the annual filing checklist covers what follows the AGM, including the Form 15 annual return.

Checklist: documents needed

• Final trial balance and draft financial statements
• Bank reconciliations for every account at year end
• Signed bank confirmation authority letters
• Fixed asset register
• Debtors and creditors ageing
• Accruals, prepayments and provisions schedules
• Loan agreements and facility letters
• Board minutes and shareholder resolutions, including the auditor appointment
• Tax, VAT and payroll reconciliations
• Cash flow forecast for at least twelve months, with assumptions

FAQ

Does a small private company in Sri Lanka need an audit?

Yes, on our reading of section 154(1) of the Companies Act. A company must appoint an auditor at each annual general meeting, with no size test. The only carve-out we found is s.159(3): shareholders can resolve unanimously not to appoint a first auditor, but that resolution ends at the start of the first AGM.

What happens if we do not appoint an auditor at the AGM?

The Registrar may appoint one under section 154(3). The company must tell the Registrar in writing within five working days of that power arising, under section 154(4). Failing to give notice is an offence under section 154(5), with fines of up to Rs 200,000 for the company and up to Rs 100,000 for each officer in default.

Can we refuse an auditor's request for documents?

No. Section 164(1) gives the auditor access to the accounting records and other documents at all times, and section 164(2) lets the auditor require information and explanations from directors and employees. Failing to comply, or giving false information, is an offence under section 164(3) or (4), with a fine of up to Rs 100,000.

Who sends the bank confirmation, the company or the auditor?

The auditor controls the request, and the bank replies directly to the auditor. SLAuS 505 defines an external confirmation as a direct written response to the auditor from a third party, and requires the auditor to keep control of the requests. The company's part is to sign the authority letter so the bank will reply.

Is a review engagement cheaper than an audit?

Usually, because the work is narrower. Under SLSRE 2400 (Revised) the practitioner performs primarily inquiry and analytical procedures and gives a conclusion, not an audit opinion. On our reading of section 154, a review does not meet a company's statutory audit requirement, so it suits interim figures or lenders rather than the annual accounts.

Open points

• Other audit requirements. Laws for specified business enterprises, regulated sectors and other entity types were not reviewed.
• Later editions. We read SLAuS 320 and 505 as published by CA Sri Lanka (effective 2014) and SLFRS for SMEs (2015); we did not confirm whether later revisions apply to your period.
• Registered auditor regulations. Regulations under s.157(5) on registered auditors were not reviewed.
• First accounting period. Whether a first period longer than twelve months can be audited once was not examined.

Last verified

We read the Companies Act, No. 7 of 2007 ss.148(1), 154 to 159, 164 and the Second Schedule, checked the Companies (Amendment) Act No. 12 of 2025, and read SLAuS 505, SLAuS 320, the SLAuS for non-SBEs (scope), SLSRE 2400 (Revised) and SLFRS for SMEs (2015) paragraphs 3.8, 3.9 and 3.16 on 22 October 2026.

The short version

Every company must appoint an auditor at each AGM; we found no small-company exemption, only the first-auditor resolution in s.159(3) that ends at the first AGM. The auditor has a legal right to your records and explanations. Have bank confirmations authorised, reconciliations done and errors fixed before fieldwork. Materiality covers size and nature, alone or together. A review is not an audit.

Talk to us. If your audit is coming up and the schedules are not ready, our contact page.

WinCore Pvt Ltd

This article is general information, not advice for your specific situation.

References

1. Parliament of Sri Lanka. Companies Act, No. 7 of 2007, ss.148, 150, 154 to 159, 164, Second Schedule. https://www.parliament.lk/uploads/acts/gbills/english/3776.pdf . Primary. Accessed 22 October 2026.
2. Parliament of Sri Lanka. Companies (Amendment) Act, No. 12 of 2025. https://www.parliament.lk/uploads/acts/gbills/english/6389.pdf . Primary. Accessed 22 October 2026.
3. CA Sri Lanka. Sri Lanka Auditing Standard 505, External Confirmations, paras 4, 6(a), 7, 8. https://www.casrilanka.com/casl/images/pdf/audit_st_vol1/slaus_505.pdf . Primary. Accessed 22 October 2026.
4. Institute of Chartered Accountants of Sri Lanka. Sri Lanka Accounting Standard for Small and Medium-sized Entities (SLFRS for SMEs), 2015, paras 3.8, 3.9, 3.16. https://www.slaasc.lk/files/_SLFRS%20FOR%20SMEs%20-%202015.pdf . Primary. Accessed 22 October 2026.
5. CA Sri Lanka. Sri Lanka Auditing Standard 320, Materiality in Planning and Performing an Audit, paras 10, 11 and application guidance on benchmarks. https://www.casrilanka.com/casl/images/pdf/audit_st_vol1/slaus_320.pdf . Primary. Accessed 22 October 2026.
6. CA Sri Lanka. Sri Lanka Auditing Standard (SLAuS) for the Audits of Non-Specified Business Enterprises (Non-SBEs), December 2017, scope. https://www.casrilanka.com/casl/images/stories/2017/2017_pdfs/sri_lanka_auditing_standard_slaus_for_the_audits_of_non_specified_business_enterprises_non_sebs.pdf . Primary. Accessed 22 October 2026.
7. CA Sri Lanka. Sri Lanka Standard on Review Engagements 2400 (Revised), Engagements to Review Historical Financial Statements. https://www.casrilanka.com/casl/images/pdf/audit_st_vol2/slsre_2400_revised_.pdf . Primary. Accessed 22 October 2026.