INSIGHTS & ANALYSIS · 7 min read
Seven Times, an Auditor Vouched for a Sri Lankan CSR Number. All Seven Were Before March 2023
Six of the largest issuers on the Colombo Stock Exchange publish a monetary figure for their community spending. Across thirty-six annual reports, that figure appeared within a named assurance scope in thirteen and at the highest level in seven, all seven in years ending on or before 31 March 2023. In the eighteen since, none. For a preparer, the useful part is not the trend but the mechanism: how a number gets covered, and how it stops being.
By the ESGNexus Editorial Team · September 2026 · Estimated reading time: 7 minutes
KEY TAKEAWAYS
|
There is a particular kind of sentence that used to appear in Sri Lankan annual reports and has largely disappeared. It is the one in which an assurance provider names a page — an actual printed page number — and says the figures on that page were properly derived from the audited financial statements. It is unglamorous, it sits near the back, and it is the only thing standing between a community investment figure and a reader’s willingness to believe it.
ESGNexus read every annual report published between 2020 and 2026 by six of the CSE’s largest issuers and traced, year by year, what the engagement covered: thirty-six company-years, every statement read in full at the printed page. What follows is less a complaint about assurance quality than a map of how a number enters and leaves a scope.
It Was Being Done, and Done Properly
Three of these companies have demonstrated what good looks like. Hemas Holdings is the clearest case in the market. For three consecutive years, its provider gave reasonable assurance and identified the exact page containing the community figure, concluding that the information was properly derived from the audited financial statements.
| properly derived from the audited financial statements — Assurance conclusion, Hemas Holdings PLC, FY2022/23 |
That is close to the strongest position a non-financial number can occupy. The figure appeared in a reconciling value-added statement; an auditor issued a positive opinion on the page, which linked it back to the audited accounts. A reader could follow the chain end to end. Sampath Bank did the same twice, in 2020 and 2021, and Commercial Bank of Ceylon did so twice as well, in 2021 and 2022 — naming the page rather than a framework.
| Company | Financial year | Page named, with reasonable assurance |
| Hemas Holdings | FY2020/21 | p.34 — the value-added statement |
| Hemas Holdings | FY2021/22 | p.53 — the value-added statement |
| Hemas Holdings | FY2022/23 | pp.46, 66 and 199 |
| Sampath Bank | 2020 | p.349 — the CSR page |
| Sampath Bank | 2021 | p.345 — the CSR page |
| Commercial Bank of Ceylon | 2021 | p.377 — the CSR page |
| Commercial Bank of Ceylon | 2022 | p.430 — the CSR page |
Source: ESGNexus review of the companies’ own annual reports filed with the Colombo Stock Exchange; page numbers correspond to the printed pages.
The Four Ways a Number Leaves the Scope
The scope table disappeared. Hemas’s FY2023/24 report carries a limited assurance opinion on “EESG indicators” — a blanket phrase covering economic, environmental, social and governance data collectively, with no page, no scope table, and no named GRI disclosure. The wording is identical in the two editions. Aitken Spence made the same move a year earlier, replacing the table of contents on page 09 and pages 201 to 209 with the same phrase.
The indicator was removed from the annex. John Keells Holdings had GRI 201-1 — the economic value disclosure carrying its community investment line — on the assured list in FY2020/21 and FY2021/22. It is absent in FY2024/25 and FY2025/26. Hatton National Bank’s 2025 annex contains neither 201-1 nor 413-1.
The indicator remained, but the engagement was scoped away from it—the subtlest of the four. John Keells’s FY2022/23 statement names the indicator, then carves out economic performance and other financial data from the scope of work. FY2023/24 goes further: the annex lists 201-1, 203-1 and 413-1, but the engagement covers information on non-financial performance. The provider takes no responsibility for financial data in the audited reports, and the boundary is eight named sites — against a Group figure spanning seven segments. The indicator is listed; the number is not reached.
What was assured was the number that cannot be compared. Commercial Bank’s 2024 report is the sharpest example: a scope table returns after a year without one, but names the pages carrying the cumulative CSR total — the running figure since 2011 — not the page carrying that year’s audited period figure. What sat inside the scope was the number no reader can use to compare one year with the next.
What Changed Alongside It
None of the six gives a reason, and it would be wrong to invent one. Three things are observable in the documents, and each is something a preparer controls. The provider change occurs when the scope is renegotiated: three of the six changed providers, and in all three the scope table changed in the same edition — twice narrowing, once widening. Engagements moved from indicator level to framework level: the earlier statements name GRI disclosures and pages, the later ones name frameworks, and a framework-level engagement cannot, by construction, say which figure is covered. New assurance is being bought while the old scope has not returned: Aitken Spence’s FY2025/26 report commissions three engagements, including its first over SLFRS S1 and S2, and none has a scope table.
This Is Not a Capability Problem
Cost, capacity and reporting burden are the obvious explanations, yet two facts make them hard to sustain. Two companies did it once and stopped. Hatton National Bank’s 2024 report contains the most explicit page-naming in the sample — a scope table listing printed page 11, headed CSR Investments, and pages 84 to 99 — after four years in which its provider published no scope table at all. The following year, both indicators are gone. Aitken Spence’s single in-scope year has the same shape.
One company left and came back. Commercial Bank’s 2025 report names page 528 for GRI 201-1(a) and page 132 for GRI 203-1, and marks the assured text in the report itself. It is limited rather than reasonable assurance, so it does not restore the 2021 position — but it is the one report among the six latest editions where the figure sits inside a named scope. It shows the position is recoverable in a single cycle.
How Sri Lanka Compares
Globally, coverage is moving in the opposite direction, while depth is moving in the same direction. The IFAC, AICPA & CIMA benchmarking study of May 2025, covering roughly 1,400 companies across 22 jurisdictions, found that 73% obtained assurance on at least some sustainability disclosures in 2023, up from 69% — and that most of it remains limited in scope. The shallowness here is not a local anomaly. What is local, and what no global benchmark measures, is whether the scope table tells a reader which figure is covered. On that test, these six moved backwards while the world moved forwards on coverage.
What It Costs in Credibility
The consequence is not that the numbers are wrong. It is that a reader cannot establish whether they are without tracing them personally, and almost nobody does. A figure outside the named scope is, to an investor, a rating provider or a procurement team, an unverified management assertion within an audited document — the most easily mistaken position a number can occupy. Nothing in the highlights pages, the chairman’s review, or the ESG summary indicates which position applies; only a scope table on pages 300 to 550 does. And because each company defines scope differently, two community figures are not comparable, even when both reports carry an assurance statement.
What to Do Before the Next Reporting Cycle
Four things follow from what these six do differently. None requires a rule change or a bigger budget.
1. Specify scope by page and disclosure in the engagement letter, not by framework. Every strong position here names a printed page, a GRI or SLFRS disclosure, or both; every weak one names a framework. That is a drafting choice made before fieldwork begins, and the highest-leverage change available.
2. Put the figure somewhere it can be assured. The figures that reached the strongest positions sat in an audited line or a reconciling value-added statement, where a provider can tie the page back to the accounts. A figure living only in a narrative ESG section gives the provider nothing to anchor to.
3. Re-specify scope when the provider changes. In all three provider changes here, the scope table changed with it. Treat the transition as the moment to restate what must stay covered, and read the incoming annexe against the outgoing one before signing.
4. State the boundary, and disclose any narrowing. Publish the entity scope of the figure, what it includes and excludes, and where it is booked. If scope narrows between editions, a one-line note costs nothing — and removes the only part of this story a company cannot answer afterwards.
Will SLFRS S1 and S2 Change It?
The regime rests on an assumption: that non-financial numbers can be made as reliable as financial ones, and that assurance is the mechanism. The community investment figure is the natural test case — denominated in rupees, often traceable to an audited line, and already assurable in accounting terms. The one hard signal so far runs the wrong way: SLFRS assurance has started to be bought, and in the first report to include it, the scope table was not included.
This article makes no claim about why any company changed its scope, and none has done anything that a rule required. Assurance here is voluntary, and the scope is for the company and its provider to agree on. The encouraging half is the counter-example. For three years, several of the country’s largest issuers have shown that a community figure can sit within a reasonable assurance opinion tied to the audited accounts — and one has since shown that the position can be rebuilt in a single cycle.
Method: every statement was read in the company’s annual report as filed with the Colombo Stock Exchange, at the printed page cited — the page printed on the page, not a PDF index. We read each report in full rather than searching it, because these scope tables sit 300 to 550 pages in and several carry no section heading. Aitken Spence’s FY2021/22 engagement named the right pages, but its assurance level is not established, so seven is a floor; its FY2020/21 report carries no assurance, postponed because pandemic restrictions prevented site visits.
Sources & Further Reading
Commercial Bank of Ceylon PLC, Annual Reports 2020 to 2025 — cse.lk
Hatton National Bank PLC, Annual Reports 2020 to 2025 — cse.lk
Sampath Bank PLC, Annual Reports 2020 to 2025 — cse.lk
John Keells Holdings PLC, Annual Reports FY2020/21 to FY2025/26 — cse.lk
Hemas Holdings PLC, Annual Reports FY2020/21 to FY2025/26 — cse.lk
Aitken Spence PLC, Annual Reports FY2020/21 to FY2025/26 — cse.lk
IFAC, AICPA & CIMA, “The State of Play: Sustainability Disclosure and Assurance”, May 2025 — ifac.org
| About ESGNexus ESGNexus is Sri Lanka’s independent platform for ESG, CSR, and sustainability intelligence. We track company-level ESG performance, regulatory developments, and sustainability data across Sri Lanka’s listed companies, large unlisted corporates, and state-owned enterprises. All editorial content is independently produced. Sponsored content is clearly labelled. |
Data disclaimer: Information in this article is sourced from publicly available documents. ESGNexus does not independently verify company disclosures. Errors and omissions excepted.