Page

Det Norske Veritas AS (‘DNV’) has been commissioned by the management of Commercial Bank of Ceylon PLC (‘Commercial Bank’ or ‘the Company’) to carry out an assurance engagement on the Company’s Sustainability Report 2011 (‘the Report’) as part of its Annual Report. This engagement focused on qualitative and quantitative information provided in the Report, and underlying management and reporting processes. The engagement was carried out against AA 1000 Assurance Standard 2008 (AA1000AS) and DNV Protocol for Verification of Sustainability Reporting (VeriSustain)1.

This assurance statement is aimed at the readers of the Report. Commercial Bank is responsible for the collection, analysis, aggregation and presentation of information within the Report. DNV’s responsibility in performing this work is to the management of Commercial Bank only and in accordance with terms of reference agreed with the Company. The assurance engagement is based on the assumption that the data and information provided to us is complete, sufficient and authentic. DNV disclaims any liability or responsibility to a third party for decisions, whether investment or otherwise, based on this assurance statement.

DNV’s Independence

DNV states its independence and impartiality with regards to this engagement. DNV confirms that throughout the reporting period there were no services provided which could impair our independence and objectivity. DNV also maintained complete impartiality towards people interviewed during the assignment.

Scope of Assurance

The scope of DNV’s assurance engagement, as agreed upon with Commercial Bank included the verification of the content of the Report, covering the period January 2011 to December 2011. In particular, this assurance engagement included:

• Review of the policies, initiatives, practices and performance described in the Report as well as references made in the Report to other sections of the Annual Report;
• Review of the Report against the requirements of AA1000AS (Type 2, Moderate level of assurance) and VeriSustain;
• Evaluation of the adherence to the principles set out in the Global Reporting Initiative Sustainability Reporting Guidelines 2011 (GRI G3.1), and confirmation of the Commercial Bank’s declared Application Level;
• Review and assessment of the processes and tools for collecting, aggregating and reporting qualitative data inside the Report.

Our engagement did not include assessment of the adequacy or effectiveness of Commercial Bank strategy over sustainability-related issues.

Verification Methodology

This engagement was carried out during February 2012 by a team of suitably qualified and experienced DNV sustainability professionals in accordance with AA1000AS and VeriSustain. The Report has been evaluated against the principles of Inclusivity, Materiality and Responsiveness, as well as reliability of sustainability performance information, as set out in the AA1000AS. We also evaluated the Report against the additional principles of Completeness and Neutrality, as set out in VeriSustain and the GRI G3.1.

As part of verification we visited Commercial Bank head office in Colombo, Sri Lanka.

During the assurance engagement, DNV has taken a risk-based approach, meaning that we concentrated our verification efforts more on the issues of high material relevance to Commercial Bank’s business and stakeholders. As part of the engagement we have challenged the sustainability-related statements and assertions made in the Report and assessed the robustness of the underlying data management system, information flow and controls. For example, we have:

• Examined and reviewed documents, data and other information made available to DNV by Commercial Bank;
• Conducted interview with Chairperson of the Board & Executive Director/Chief Operating Officer;
• Conducted in-person interviews with 18 Commercial Bank representatives, including data owners and decision-makers from different functions of the Company;
• Performed sample-based checks of the processes for generating, gathering and managing the quantitative and qualitative data included in the Report;
• Reviewed the data management processes for completeness and reliability. This including assessments of methods, practices, tools and competence used in collection, aggregation and reporting of data as it is transferred and managed at different levels of the organisation;
• Reviewed the process of acquiring information and economic-financial data from the Annual Report 2011.

Conclusions

In DNV’s opinion, based on the work carried out, the Report is a fair communication of the Company’s sustainability-related strategies, management systems and performance. The Report, along with the referenced information in the Annual Report and the commitments with timelines to report in full on some of the core indicators, meets the general content and quality requirements of the GRI G3.1, and DNV confirms that the GRI requirements for Application Level ‘B+’ have been met. We have evaluated the Report’s adherence to the following principles on a scale of ‘Good’, ‘Acceptable’ and ‘Needs Improvement’:

Inclusiveness: The Company demonstrates engagement with stakeholders through various channels. The engagement process can be further strengthened by standardising the process of collating the information related to the stakeholder interests, concerns and information needs regarding sustainability through different engagement channels. In our view, the level at which the Report adheres to the principle of Inclusivity is ‘Acceptable’.

Materiality: The methodology of materiality determination used for the Report uses the perspectives of senior representatives from various functions of the Company. The outcome has not missed out any significant, known material issues, but the process should be strengthened by more specific framework to bring out material issues that reflect short, medium and long term impacts. In our view, the level at which the Report adheres to the principle of Materiality is ‘Acceptable’.

Responsiveness: The Company has responded to stakeholder concerns through its policies and management systems, and this is reflected in the Report. The implementation of the policies needs to be strengthened by increased awareness and monitoring. In our view, the level at which the Report adheres to the principle of Responsivenes is ‘Acceptable’.

In accordance with the AA1000AS requirements for a Type 2, Moderate level assurance engagement, we conclude that the data and information related to GRI G3.1 Core Indicators presented in the Report is generally reliable. Although no systematic or material errors have been detected, DNV has identified some manual discrepancies in data which have subsequently been corrected. More focus to develop clearer data protocols would help improve data consistency and accuracy.

Additional Principles as per VeriSustain:

Completeness: The Report limits its boundary to Sri Lanka operations in the environment and social aspects and the reason for this limitation is specified in the Report. It is evident that Commercial Bank acknowledges the need for continuous improvement and is committed to expanding the reporting scope and boundary. In our view, the level at which the Report adheres to the principle of Completeness is ‘Acceptable’.

Neutrality: The information contained in the Report is presented in a balanced manner, in terms of content and tone. Limitations are fairly presented with commitments to future improvement. In our view, the level at which the Report adheres to the principle of Completeness is ‘Good’.

Opportunities for Improvement

The following is an excerpt from the observations and opportunities reported back to the management of Commercial Bank. These do not, however, affect our conclusions regarding the Report, and they are indeed consistent with the management objectives already in place.

• Strengthening of the governance mechanisms to monitor environment and social performance.
• Improve the monitoring and disclosure of Commercial Bank’s own environmental footprint.

For Det Norske Veritas AS,



Santhosh Jayaram
Lead Verifier
Head, Sustainability and Business Excellence
(South Asia)
Det Norske Veritas AS, India



Antonio Astone
Reviewer
Global Manager, Sustainability Services
Det Norske Veritas AS, Italy

February 24, 2012
Bangalore, India