Sri Lanka has substantially strengthened the law governing company directors and auditors, but legislation alone cannot guarantee corporate accountability unless those entrusted with the affairs of companies are required to answer meaningfully when they fail in their duties.
That is the central concern emerging from a critical examination of Sri Lanka’s corporate law framework, particularly the Companies Act No. 7 of 2007 and the more recent reforms which have expanded transparency and beneficial ownership requirements.
The modern corporation is vastly different from the owner-managed business of an earlier age. Shareholders frequently provide the capital while directors and professional managers exercise practical control over the enterprise.
That separation between ownership and control creates an obvious problem. Those taking decisions may not be risking their own money, while shareholders, creditors, depositors and employees ultimately bear the consequences when those decisions go badly wrong.
It is precisely for that reason that company directors cannot be regarded merely as individuals invited to sit around a boardroom table. They exercise substantial power and are therefore expected to exercise substantial responsibility.
The Companies Act of 2007 represented an important change in Sri Lanka. Earlier company law relied heavily on a combination of statutory provisions, company articles, common law and equitable principles.
The result was a somewhat fragmented system of accountability. The 2007 Act placed directors’ duties within a clearer statutory framework and made it considerably more difficult to argue that the obligations of a director were uncertain.
Directors are now required to act in good faith and in what they believe to be the interests of the company. They must comply with the law and with the company’s own constitution and must exercise the degree of skill and care demanded by their office.
The law also places directors at the centre of financial reporting. Boards must ensure proper accounting records are maintained and that financial statements, annual reports and statutory filings comply with legal requirements.
Importantly, however, the law does not seek to punish every commercial failure.
Companies operate in competitive markets. Investments fail, forecasts prove wrong and business judgments occasionally turn out badly.
The distinction is therefore between an honest business judgment that proves unsuccessful and conduct involving recklessness, gross negligence, failure to inquire or serious disregard of the responsibilities of office.
That distinction is essential if company law is to encourage entrepreneurship without becoming a shelter for incompetence.
One of the most important questions arising from the present framework is whether directors are able to devote sufficient time and attention to the companies whose boards they serve.
Sri Lanka presently imposes no general numerical ceiling on the number of companies in which an individual may serve as a director.
India, by contrast, limits the number of simultaneous directorships an individual may hold, including a separate ceiling applicable to public companies.
The issue is not simply how many board positions one person can collect. It is whether that person can genuinely understand the affairs, risks and financial position of each company for which he or she carries responsibility.
Modern directors are expected to read board papers, scrutinise accounts, understand risk, question management, participate in committee work and identify warning signs.
At some point, excessive numbers of directorships must inevitably undermine the time and attention that can be given to each company.
Sri Lanka should therefore consider whether limits are appropriate, particularly in listed companies, banks, financial institutions and other systemically important entities.
There is also a legitimate question regarding the competence of independent directors.
Independent directorships are often regarded as an important safeguard because such directors are expected to bring objective judgment to the boardroom.
But independence without competence achieves very little.
India has introduced a more structured system, including a database for prospective independent directors and, subject to exemptions, competency assessments.
Sri Lanka need not necessarily require every director to sit an examination, but there is a persuasive case for minimum competency standards, compulsory induction and continuing professional development.
Corporate regulation, accounting standards, securities law and risk management have become too complex for important board appointments to be treated simply as prestigious positions offered to senior personalities.
Corporate failures also demonstrate another weakness in traditional approaches to accountability.
Major companies rarely collapse because of one dramatic event appearing without warning. The problems often develop gradually through weak internal controls, inadequate risk management, poor reporting systems and repeated failures to act upon warning signs.
The Companies Act imposes important duties relating to financial reporting and accounting records, but there remains a case for stronger and more explicit board-level responsibility for internal controls and risk management.
The United Kingdom offers one possible reference point. Its corporate governance framework increasingly requires boards to assess major risks and maintain effective internal-control systems.
Sri Lanka does not need to copy another jurisdiction line by line, but the principle is important.
A director’s responsibility cannot begin only after a loss has appeared in the accounts. Directors must have reasonable systems in place to identify and understand the risks before those losses occur.
The same argument applies with even greater force to auditors.
Auditors occupy a crucial position between company management and those who rely on the company’s financial statements.
Shareholders and creditors cannot personally inspect every account, invoice, valuation, contract or bank reconciliation.
They rely heavily on auditors to examine the financial statements independently and express a professional opinion as to whether those statements present a true and fair view.
Sri Lankan law has significantly strengthened the statutory duties imposed upon auditors.
Auditors are entitled to access accounting records and demand explanations from directors and employees. The law also seeks to protect auditor independence by restricting conflicts of interest and relationships that could compromise professional judgment.
Auditors are expected to exercise professional scepticism and obtain reasonable assurance that financial statements are free of material misstatement, whether caused by fraud or error.
The traditional description of an auditor as a “watchdog but not a bloodhound” is therefore no longer enough to describe the modern auditor’s responsibilities.
Over time, courts in several jurisdictions have demanded a more questioning approach.
Lord Denning’s observation that an auditor should approach the task with an “enquiring mind” remains particularly relevant.
The auditor does not assume that everyone is dishonest. But neither should the auditor blindly accept what management says.
Where figures do not make sense, explanations must be tested. Where documents conflict, further inquiry is required. Where warning signs appear, they cannot simply be ignored.
An auditor who merely adds up figures presented by management is not performing the function expected of a modern professional auditor.
This leads to the larger question of enforcement.
Sri Lanka has the Sri Lanka Accounting and Auditing Standards Monitoring Board, which monitors compliance with accounting and auditing standards among specified business enterprises and their auditors.
The existence of such a regulator is important, but the effectiveness of regulation must ultimately be measured by outcomes.
Serious corporate and financial irregularities inevitably raise the question of whether weaknesses in auditing, governance and internal controls were identified early enough and, if not, why they were missed.
There is also a notable difference between the statutory consequences facing directors and those facing auditors.
Directors may face personal financial liability, disqualification, criminal prosecution and other remedies in certain circumstances.
Auditors, however, do not presently face an equally comprehensive statutory regime specifically dealing with negligent performance of their central auditing duties.
Where an audit is negligently conducted and produces a materially inaccurate opinion, liability may have to be pursued through common law negligence, a route which can be difficult, expensive and slow.
Other jurisdictions have introduced more direct statutory mechanisms.
India, for example, provides penalties for breaches of auditors’ statutory duties, with heavier consequences where misconduct involves deliberate deception. Its law may also require repayment of audit fees and compensation arising from incorrect or misleading audit statements.
The United Kingdom has criminal provisions dealing with auditors who knowingly or recklessly include materially false, deceptive or misleading information in audit reports.
Sri Lanka should consider whether a similar graduated system would improve accountability.
Ordinary negligence in carrying out statutory audit duties could attract one level of sanction, while knowing or reckless conduct resulting in a misleading audit report could attract more severe penalties.
Where proven misconduct causes measurable loss, the law should also allow meaningful restitution and compensation rather than limiting consequences to modest regulatory fines.
None of this means that directors or auditors should become automatic scapegoats whenever a company performs badly.
Corporate accountability must remain fair and evidence-based.
But the reverse is equally true. Corporate office must not become a shield behind which responsibility disappears.
The Companies Act already provides significant remedies, including derivative actions, remedies for oppression and mismanagement, restraining orders, personal liability in specified circumstances and disqualification from corporate management.
The legal architecture therefore largely exists.
The more difficult question is whether it is being used effectively.
When a serious corporate failure occurs, shareholders and the public are entitled to ask whether directors understood what they were approving, whether adequate internal controls existed, whether risks were identified, whether auditors challenged management and whether regulators acted upon warning signs.
Corporate governance cannot be measured by the number of pages in an annual report or the number of committees listed beneath glossy photographs of directors.
It must be measured by responsibility.
Sri Lanka has travelled a considerable distance from the fragmented company-law framework of earlier decades.
But the next stage must be one of stronger enforcement, greater competence and clearer responsibility.
Directors must understand that a board seat is not merely an honour. Auditors must understand that their signature is relied upon by investors, lenders and the wider public.
The regulator, too, must demonstrate that professional and statutory standards have consequences when they are breached.
Be that as it may, the principle should ultimately be very simple: those entrusted with other people’s money must be prepared to account for what they did with it.
