The enactment of the Securities and Exchange Commission of Sri Lanka Act, No. 19 of 2021 (SEC Act), has ushered in a new era for the professional auditors of Sri Lanka, auditing market institutions, market intermediaries, and listed public companies. They are now required to act as ‘gate keepers’ and ‘whistleblowers’ to protect shareholders and the investing public from general accounting fraud. This is particularly so in respect of listed companies, stock exchanges, clearing houses, central depositories, and in companies providing financial services to the securities market of Sri Lanka.

Sarbanes Oxley Act of the United States of America

Internationally, the inspiration for the enactment of the provisions relating to the auditors’ duty to whistle blow and the protection of whistle blowers in general was provided initially by the Sarbanes-Oxley Act (SOX) of the United States. SOX was introduced in Congress after multiple financial scandals at the time such as Enron and WorldCom.

The Dodd Frank Act

In the heels of SOX followed the Dodd-Frank Wall Street Reform and Consumer Protection Act of the United States (Dodd Frank Act). This Act was enacted to promote financial stability in the United States by improving accountability and transparency in the financial system. The Dodd Frank Act was created as a response to the financial crisis in 2007 and passed into law in 2010.

The major impact of the Dodd Frank Act on the United States Securities and Exchange Commission (US SEC) was that it amended Section 24 of their Securities Exchange Act in order to permit the US SEC to share documents with the Public Company Accounting Oversight Board (PCAOB) and other federal and state agencies. This was done without losing protection from disclosure, so that the US SEC can refuse to disclose privileged information obtained from foreign securities or law enforcement authorities.

The Impact on Auditors

The Dodd Frank Act directed the PCAOB to register public company auditors, set rules for those auditors, to audit or inspect those auditors, and when necessary, discipline the auditors. The Dodd Frank Act also gave the PCAOB authority over the auditors of brokers and dealers. 

Mr. Steven B. Harris, a Board member of the PCAOB, addressing a Conference on Investor and Consumer Protection in Washington DC in March 2012, speaking on the Legacy of Sarbanes-Oxley and its Implications for Dodd -Frank remarked as follows: 

“Ten years ago last month, the Senate Banking Committee held its first of a series of oversight hearings on ‘Accounting and investor Protection Issues raised by Enron and other public companies. Little did we know how many other public companies would victimize investors that year with careless accounting, insider dealing and questionable perks for executives. Billions in earnings and assets were restated due to accounting errors and irregularities. Theses failures translated into staggering lost savings for investors and lost jobs and pensions for many American families- making it clear to Congress that auditor self-regulation had failed…… We were barely six months past the September 11th terrorist attacks and the anthrax mailings that targeted our colleagues in Congress. The United States was at war with the Taliban in Afghanistan and the administration was preparing for war in Iraq. Yet the corporate wrongdoing created such public outrage and an outcry for justice that it rose above the noise of war.” 

“When scandal over the application of accounting principles displaces the topic of war in the national headlines, something has definitely gone awry in the world of financial reporting” … At the time, investors had lost USD 67 billion in the case of Enron and US$161 billion in the case of WorldCom.

The Sarbanes-Oxley Act strengthens auditors’ independence from their audit clients; clarifies the reporting responsibilities of public companies and their management and audit committees; enhances the quality of financial disclosures; limits analysts’ conflicts of interest; and stiffens penalties for corporate fraud and white-collar crimes.” 

“The Act also helps to remind auditors that their duty under the law is to serve, first and foremost, the interests of investors-not management. I think it is fair to say that because of the Sarbanes-Oxley Act and the work of the PCAOB, audit firms are refocusing from serving management and providing non-audit services. They are more focused on their first and foremost responsibility – to perform high quality audits for the protection of investors.”

It is a significant fact that with the passage of time many countries including Sri Lanka have adopted similar regulatory regimes. Whilst the laws may differ in structure and institutional framework from country to country, the intended outcome or the goal is the same - “to improve audit quality”.

The Law in Sri Lanka

Duties of an Auditor of a listed public company

The SEC Act has imposed statutory duties on Auditors of listed companies: 

If in the ordinary course of performing duties an auditor becomes aware of:

(a) Any contravention or non-compliance with any requirement or provision of the Act, any regulation, rule or directive made thereunder or a breach of any rule of an exchange or any offence involving fraud or dishonesty; or 

(b) Any matter which may in his opinion adversely affect or is likely to adversely affect the financial position of the listed public company to a material extent; or 

(c) Any irregularity that has or may have a material effect upon the accounts of a listed public company including any irregularity that affects or jeopardizes or may affect of jeopardize the funds or property of any investor in securities, 

The auditor shall immediately report such matter to the audit committee in writing for rectification. 

If no remedial measure is taken by the audit committee within two weeks thereof, the auditor shall report such matter to the board of directors in writing for rectification or to deter the commission of a breach where it has not yet occurred. 

If no action is taken by the board of directors to rectify matters within two weeks the auditor is mandated to 

(i) submit a written report on the matter immediately thereupon to the Securities and Exchange Commission in the case of a contravention or non-compliance with any requirement or provision of the SEC Act, any regulation, rule or directive issued thereunder or an offence involving fraud or dishonesty; or

(ii) to the relevant exchange and to the Securities and Exchange Commission in the case of a breach of or non-compliance with any rules of an exchange (in which the company is listed).

Duties of an Auditor of a Market Intermediary

The SEC Act defines “market Intermediaries” to include any person licensed as a credit rating agency, corporate finance advisor, derivatives broker, derivatives dealer, investment manager, managing company, margin provider, market maker, stockbroker, stock dealer, underwriter or any other person who undertakes similar activity and described by rules for the purpose of issuing such license by the Securities and Exchange Commission.  

In the case of an Auditor of a market intermediary, who in the course of performing his duties, if he comes across any of the matters described in paragraphs (a), (b), or (c) above, he must immediately submit a written report to the board of directors of the market intermediary on the matter with a copy to the Securities and Exchange Commission. The report must be submitted to the relevant market institution and to the Securities and Exchange Commission in the case of a contravention or non-compliance with any provision of the SEC Act, regulation, rule, or directive made thereunder or any offence involving fraud or dishonesty. Similarly, in the case of a breach or non-compliance of any rule of a market institution or in any other case which adversely affects the financial position of the market intermediary to a material extent to the relevant market institution and to the Securities and Exchange Commission.

Duties of an Auditor of a Market Institution

A market institution has been defined as an exchange, a clearing house, or a central depository licensed by the Securities and Exchange Commission under Part II of the SEC Act. 

If an auditor of a market institution in the ordinary course of performing his duties comes upon any matter as described in paragraphs (a), (b), or (c) above, he must immediately send to the board of directors a written report on the matter with a copy to the Securities and Exchange Commission.

In all three instances mentioned above no auditor will be liable to be sued in any court for any report submitted by the auditor in good faith and in the performance of any duty imposed under the SEC Act.

The Securities and Exchange Commission upon receiving a written report by any auditor of a listed public company, a market intermediary, or a market institution may impose all or any of the following duties on an auditor of such listed company, market intermediary, or a market institution: 

1. a duty to submit such additional information and reports in relation to his audit as the Securities and Exchange Commission may consider necessary;

2. a duty to enlarge , extend or alter the scope of his audit of the business and affairs of the relevant listed company, market intermediary, or the market institution as the case may be; 

3. a duty to carry out any other examination or establish any procedure in any particular case; or

4. a duty to submit a report on any matter arising out of his audit, examination or establishment of procedure, and the auditor shall carry out such duties, as an extension to his ordinary audit scope for issuing an independent opinion on the financial statements.

As one can see, the SEC Act has considerably enhanced the scope of the Auditor under the circumstances mentioned above in order to better serve the shareholders of the companies concerned and the investing public.

Sharing of Information with any Domestic or Foreign Supervisory Authority

Section 171(2)(b) of the SEC Act permits the Securities and Exchange Commission where it deems necessary to enter into regulatory arrangements to cooperate with any domestic or foreign supervisory authority to inter alia share any information or document or electronic record with such domestic or foreign authority.

This provision will pave the way for the SEC to share any information regarding any information obtained in the course of performing its obligations under the SEC Act with any other domestic or foreign regulatory or supervisory authority. These may include inter alia the Sri Lanka Accounting and Auditing Standards Monitoring Board or even the Institute of Chartered Accountants of Sri Lanka in the event an auditor fails or falls short of its duties under the above mentioned provisions of the SEC Act. This will be in addition to the SEC’s ability to directly deal with such erring Auditors. It remains to be seen as to how the Securities and Exchange Commission will deal with such matters in the future.   

As at the date of this publication, the Securities and Exchange Commission has published the ‘Approved List of Auditors” to audit the financial statements of listed companies. It is expected that the statutory duties cast upon the Auditors in the provisions of the SEC Act will positively influence the deterrence and enforcement against violations of the securities law in Sri Lanka and overall improve the quality of audits conducted on the corporate community of the country.

* The writer is currently a Partner of Varners and was formerly the Director Legal and Enforcement of the Securities and Exchange Commission of Sri Lanka.

This publication is solely for the purposes of general information of our clients and other interested persons. The aim is to provide a general overview of the topic and this should not be construed as legal advice. The views expressed herein are those of the writer and may not necessarily be the views of the Securities and Exchange Commission of Sri Lanka.