By Adolf
The appointment of Deloitte to conduct the forensic audit of National Development Bank PLC (NDB), following the Rs. 13.2 billion internal fraud, raises serious and unavoidable questions around independence, governance, and regulatory judgment. The engagement is reportedly led by Romal Shetty, CEO of Deloitte South Asia. His proximity to Sri Lanka is not incidental—he was in the country in November 2023, shortly after Deloitte’s acquisition of PwC Sri Lanka & Maldives. At the time of that transition, Sujeewa Mudalige was the Lead Partner for PwC Sri Lanka & Maldives. Today, he sits on the Board of NDB as an Independent Non-Executive Director and, critically, as Chairman of its Board Audit Committee—the very committee responsible for overseeing financial integrity.
This is not a marginal overlap. It goes to the heart of governance credibility. According to NDB sources, the two are also friends. At best, this represents a perception problem. At worst, it points to a structural conflict of interest between the leadership of the firm conducting the forensic audit and the individual heading the audit oversight mechanism of the institution under investigation. In the tightly networked professional circles of South Asia’s Big Four ecosystem, it would be naïve to assume no prior familiarity or professional intersection.
Equally troubling is the complete lack of transparency around the selection process. How was Deloitte India chosen? Who evaluated the alternatives? Were other firms considered? In a matter of this magnitude, opacity is not acceptable—it erodes confidence before the audit even begins.
A non-independent report
While the appointment is said to have been made by the NDB Board, the audit findings are to be reported directly to the Central Bank of Sri Lanka (CBSL). This duality exposes a deeper concern: a Board commissioning an audit it does not fully control, and a regulator receiving findings from a process in which it appears to have had influence.
The terms of reference remain undisclosed. Critically, it is unclear whether the scope of the forensic audit will extend to examining regulatory oversight, including the role—or failure—of the CBSL during the period in which the fraud took place. This is where the issue becomes most serious.
If the regulator has played any role in selecting the auditor, influenced the terms, and is simultaneously a potential subject of scrutiny, then the entire exercise risks being seen as compromised. Independence cannot exist where oversight, participation, and review intersect. In a crisis of this scale, credibility is everything. Without absolute clarity on independence, scope, and process, this forensic audit risks being viewed not as a search for truth—but as an exercise in containment.And in the final analysis; why is NDB reluctant to bring in KPMG or BDO to conduct the audit? The answer is clear.
