IT Audit and Control in Sri Lanka: Laws, Risks, and the Role of Auditors

Why IT Audit Matters Today?

In today’s digital world, information technology plays a crucial role in how organizations operate, communicate, and deliver services. Activities such as online banking, e-commerce, cloud computing, and social media depend heavily on IT systems that process large volumes of data every day. While these technologies improve efficiency and support economic growth, they also introduce serious risks such as cyberattacks, data breaches, online fraud, and misuse of personal information.

To manage these risks, organizations must implement effective IT audit and control mechanisms. IT audit and control focus on ensuring that information systems are secure, reliable, compliant with laws, and aligned with business objectives.

In Sri Lanka, the importance of IT audit has grown significantly in recent years due to the introduction of new digital laws and regulations. These laws aim to protect personal data, improve cybersecurity, and regulate online activities within the country.

Growth of IT Laws in Sri Lanka

Over the past two decades, Sri Lanka has introduced several important laws to govern the use of information technology. These include:

• Electronic Transactions Act (2006)

• Computer Crimes Act (2007)

• Personal Data Protection Act (2022)

• Online Safety Act (2024)

In addition, the proposed Cyber Security Act further strengthens national oversight of critical information systems. (Legal resources - ICTA website)

These laws place clear responsibilities on organizations to implement proper IT controls and prove compliance through audits. Unlike international frameworks such as ISO 27001, NIST, or COBIT, which are voluntary, Sri Lankan laws are mandatory and legally enforceable.

As a result, IT audits in Sri Lanka must balance global best practices with local legal requirements.

💻 Electronic Transactions Act (ETA) No. 19 of 2006

The Electronic Transactions Act provides the legal foundation for electronic commerce, digital business, and e-government services in Sri Lanka. It recognizes electronic contracts, records, and data messages as legally valid. (ELECTRONIC TRANSACTIONS ACT, No. 19 OF 2006)

Section 3 of the Act ensures that electronic documents have the same legal effect as paper-based documents. The Act is technology-neutral, allowing it to remain relevant despite rapid changes in digital technologies.

In 2017, amendments aligned the Act with UNCITRAL Model Laws, making Sri Lanka the first country in South Asia to adopt these international standards. This strengthens legal certainty and cross-border electronic trade.

For IT audits, key control areas include:

• Integrity and authenticity of electronic records

• Secure digital signature management

• Retention and availability of electronic evidence

🔑Digital Signatures and Authentication

(Electronic Transactions Act No. 19 of 2006 and by the Electronic Transactions (Amendment) Act No. 25 of 2017)

As digital transactions increase, so does the risk of identity theft and fraud. The Electronic Transactions Act legally recognizes electronic signatures and digital certificates to address these risks. (Legal resources - ICTA website)

Sri Lanka’s National Certification Authority (NCA), operated by Sri Lanka CERT, regulates Certification Service Providers and ensures trust and integrity in digital authentication.

IT auditors must assess:

• Certificate lifecycle management

• Authentication controls

• Cryptographic integrity

• Compliance with NCA standards

Strong authentication directly supports trust in e-commerce and e-government platforms. 

🖥️ Computer Crimes Act No. 24 of 2007

The Computer Crimes Act is Sri Lanka’s primary law addressing cybercrime and computer-related offenses(COMPUTER CRIME ACT, No. 24 OF 2007). Traditional laws such as the Penal Code were inadequate for handling crimes in digital environments, as they focused on physical property and physical entry.

This created legal gaps where cyber offenders could avoid responsibility. The Computer Crimes Act addressed this issue by clearly defining offenses such as unauthorized access, data modification, interception, and denial-of-service attacks. The Act was inspired by the UK Computer Misuse Act of 1990 and treats cyber threats to national security and the economy as serious crimes.

Sri Lanka’s ratification of the Budapest Convention on Cybercrime further strengthened this framework by enabling international cooperation and better handling of electronic evidence.

From an IT audit and control perspective, auditors must evaluate whether organizations have implemented:

• Strong access control mechanisms

• System monitoring and logging

• Audit trails that preserve electronic evidence

• Incident response and reporting procedures

Failure to maintain these controls increases cyber risk and legal exposure, highlighting the critical role of IT audits.

🔐 Personal Data Protection Act (PDPA) No. 09 of 2022

The Personal Data Protection Act (PDPA) represents a major shift in Sri Lanka’s approach to privacy and data governance. Its main objective is to protect individuals’ personal data while allowing organizations to process data lawfully for business and public interest purposes. (PERSONAL DATA PROTECTION ACT, No. 9 OF 2022)

From an IT audit perspective, accountability is a key principle introduced by the PDPA. Organizations must implement a Data Protection Management Programme (DPMP) that includes policies, procedures, risk assessments, and internal controls. IT auditors are required to assess whether these controls are properly designed and effectively implemented.

Key IT control areas under the PDPA include:

• Access controls to restrict personal data access

• Data minimization to collect only necessary data

• Audit logs and monitoring to detect unauthorized access

• Data Protection Impact Assessments (DPIAs) for high-risk processing

The PDPA is heavily influenced by the EU’s GDPR, making compliance especially important for Sri Lankan IT and BPO companies handling foreign data. Strong PDPA compliance increases international trust and supports cross-border data processing.

🌍 Online Safety Act No. 09 of 2024

The Online Safety Act focuses on addressing online harm, impersonation, harassment, and public order risks. It introduces concepts such as prohibited statements and declared online locations, overseen by the Online Safety Commission.(ONLINE SAFETY ACT, No. 9 OF 2024)

From an IT audit perspective, organizations must implement:

• Content moderation controls

• Identity verification mechanisms

• Incident reporting and escalation processes

• Governance and oversight of platform decisions

Although concerns exist regarding freedom of expression, the Act includes judicial oversight and appeal mechanisms. Transparent IT governance is essential to balance safety and rights.

Global frameworks such as ISO 27001, NIST, and COBIT provide structured guidance for designing and managing IT controls. However, they are voluntary.

Sri Lankan laws are mandatory and enforceable, with penalties for non-compliance. Therefore, IT auditors must ensure that organizations comply with both.

 "Frameworks guide how to control, while laws define what must be controlled."

Despite strong legislation, gaps remain. Enforcement of the PDPA is still developing, the Online Safety Act raises concerns about overreach, and emerging technologies such as AI and IoT are not yet fully regulated. Delays in investigations further reduce effectiveness.

By strengthening enforcement, integrating global frameworks with local laws, and improving audit practices, Sri Lanka can protect citizens, attract foreign investment, and position itself as a trusted global IT hub.