Deloitte Sri Lanka brought together board directors and business leaders for “Cyber Resilience Starts at the Top: The Board’s Strategic Role in Building a Resilient Organization,” a discussion on how boards can better prepare organisations for complex cyber disruption. The programme explored organisational resilience, cyber readiness, risk quantification and crisis response, and included an interactive cyber wargaming exercise designed to simulate a real incident and help leaders test decision-making and preparedness before a crisis occurs.

Opening the discussion, Malinda Boyagoda, Partner – Audit and Assurance, Assurance Leader and Industry Leader for Financial Services, Deloitte Sri Lanka and Maldives, placed cyber resilience within the wider context of disruption. His session considered risks arising from geopolitical uncertainty, cyber incidents, AI-enabled fraud, vulnerabilities in suppliers and partners, and growing regulatory expectations.

Malinda distinguished risk management from resilience: while risk management aims to reduce exposure, resilience is about keeping essential services running and recovering effectively when disruption occurs. He noted, “Cyber resilience is not simply about preventing disruption. It is about ensuring that critical services can continue, decisions can be made with confidence, and the organisation can recover and learn when disruption occurs.” Board members were advised to clarify responsibilities, test severe scenarios and seek evidence of preparedness rather than rely only on reassurance.

Building on this, Mayuran Palanisamy, Partner and Leader, Digital Trust and Privacy, Deloitte South Asia, focused on the difference between confidence and genuine readiness. He highlighted that confidence in an organisation’s cyber preparedness, including assurances provided by management, should be tested and questioned by the Board of Directors. By seeking evidence that response and recovery plans work in practice, boards can gain greater comfort that the organisation is genuinely prepared for a cyber incident.

Highlighting the role of leadership in strengthening cyber readiness, Mayuran said, “Cyber resilience requires boards to go beyond oversight and take a more active role in execution. This means asking management the right questions about the cyber strategy, ensuring there is flexibility in funding when risks emerge, and making cyber oversight a consistent part of the board agenda.”

The discussion then moved to the financial impact of cyber risk. Rukshan Bharatha, Partner, Controls Assurance, Deloitte Sri Lanka and Maldives, introduced Cyber Risk Quantification (CRQ) as a way of translating technical cyber threats into financial terms for board and leadership decisions. Rather than relying only on high, medium or low ratings, CRQ helps organisations understand what a cyber event could mean in monetary terms.
Rukshan explained, “If we want to understand cyber risk, we need to quantify it. Cyber Risk Quantification converts qualitative measures into financial values, giving boards a more tangible view of potential impact and a stronger basis for decisions on investment and the level of risk the organisation is prepared to carry.” He outlined how business exposure, incident scenarios and existing security controls can be used with statistical modelling to estimate potential losses and support decisions on cyber investment, regulatory requirements and insurance.

The final segment, led by Bhawna Pahuja, Associate Director, Cyber Defense & Resilience, Deloitte India, brought the earlier discussions to life through an interactive cyber crisis exercise. Participants were placed in a fictional financial institution facing an escalating cyber incident and asked to make time-sensitive decisions on containment, business continuity, communications, regulatory engagement and ransom response.

The exercise was designed to reflect the uncertainty and pressure leadership teams may face during a real cyber incident, with participants making decisions based on limited information as the situation evolved. It demonstrated how quickly a cyber issue can develop into an organisation-wide crisis, affecting customers, regulators, investors, reputation and operations. The session highlighted the importance of clear crisis roles, tested recovery plans and leadership teams that are prepared to make informed decisions under pressure.

Together, the sessions highlighted that cyber resilience is an organisation-wide responsibility, supported by informed board involvement, clear measures of risk, tested response plans and decisive leadership. Reflecting on the broader message, Vengadasalam Balagobi, Cyber and Technology Risk Head, and Information Security Leader, Deloitte Sri Lanka and Maldives, noted, “Cybersecurity is about protecting the organisation. Cyber resilience is about ensuring it can continue to operate, recover and adapt when disruption occurs. Organisations that prepare, test and learn before an incident are better positioned to respond with speed, confidence and clarity.”

ECONOMYNEXT – Sri Lanka’s Central Bank bought a net US$64.2 million in September, official data showed, amid depreciation pressure on the local currency that touched a four-year low in the May this year.

The rupee fell 0.9 percent in September, the Central Bank has said.

The Central Bank bought US$85 million from the domestic foreign exchange market in September while selling US$20.8 million that same month, official data showed.

The Bank sold over US$211 million net in May for the first time in 22 months.

The Central Bank has net bought US$1,548.8 million in the first nine months of 2026 following a net purchase of US$2 billion last year.

The rupee was under high downward pressure in May as the imports bill for fuel rose unusually high following the Middle Eastern escalation amid continued demand for dollars to buy new vehicles.

However, it reversed course and gained in the next two months before falling in September.

The Central Bank has been buying dollars aggressively from the market to boost foreign currency reserves to meet the targets the country agreed with the IMF under the US$3 billion external fund facility and to repay the island nation’s multilateral and bilateral loans.

The Central Bank’s aggressive reserve building comes ahead of the repayment of foreign debts to sovereign bond holders in April 2028. (Colombo/October 03/2026)

ECONOMYNEXT – Sri Lanka’s inflation target for the next three years through October 2029 will be maintained at 5 percent and the agreement was signed between the government and the Central Bank, the monetary authority said in a statement on Friday.

The new  Monetary Policy Framework Agreement (MPFA) in terms of the latest Central Bank of Sri Lanka Act was signed between President Anura Kumara Dissanayake in his capacity as the Minister of Finance and Central Bank Governor Nandalal
Weerasinghe on Thursday (01), it said.

As per the new MPFA, the Central Bank shall aim to maintain quarterly headline inflation rate at 5% with a margin of ±2 percentage points. This means the Central Bank has to maintain the inflation between 3% and 7%.

The move comes at a time when the Central Bank has failed to maintain the inflation target at its upper limit of 7 percent in the last three months. The Bank has blamed =higher energy price for the deviation following the Middle East conflict.

As per the new Central Bank Act, the inflation target and related parameters are reviewed once in every three years, or at shorter intervals if exceptional circumstances so warrant.

“As part of the review, the Central Bank undertook a comprehensive technical assessment that considered  Sri Lanka’s economic structure, historical and empirical evidence, monetary policy considerations, the credibility of the framework, stakeholder views, and international experience and practices,” the Central Bank said in a statement.

“Based on the findings of the review, the Central Bank communicated its proposal to the Ministry of Finance. The Ministry, after careful consideration, accepted the recommendation.”

Critics have argued that a 5% inflation target is too high and it should be reduced to 2%. However, the Central Bank has said such reduction would have an adverse impact on the country’s economic growth. (Colombo/October 02/2026)

ECONOMYNEXT – Sri Lanka’s rupee closed at 330.55/65 to the US dollar in the spot market on Friday, from 330.60/70 the previous day, while bond yields closed broadly steady, dealers said.

A bond maturing on 01.08.2030 closed at 11.15/20 percent, up from 11.10/18 percent.

A bond maturing on 15.10.2030 closed flat at 11.20/25 percent.

A bond maturing on 01.02.2031 closed at 11.25/30 percent, up from 11.22/27 percent.

A bond maturing on 15.12.2032 closed at 11.67/75 percent, up from 11.65/75 percent.

A bond maturing on 15.10.2034 closed at 11.99/12.05 percent, up from 11.95/12.00 percent.

At the end of September, the rupee had depreciated by 6.3 percent against the US dollar on a year-to-date basis, the central bank said. (Colombo/Oct2/2026)

ECONOMYNEXT – Visitor numbers into Sri Lanka fell 0.26 percent in September 2026, compared to a year ago, official data showed.

Total arrivals in September were 158,557 compared to 158,971 in the same month last year.

India continued to be the top source with 51,931 visitors, making up a 32 percent of total arrivals.

There were 11,722 visitors from China and from 10,951 from Australia.

There have been 1,693,679 visitors to the island so far this year.

Tourist arrivals fell 3.3 percent in the month compared to last August.

Total arrivals during January-August 2026 fell 2 percent, compared to the corresponding period of 2025.

Tourism earnings were estimated at 264 million dollars in August, a 2.1 percent increase from a year earlier.

But total tourism earnings during January-August 2026 fell 10 percent to 2.1 billion dollars, compared to 2025.(Colombo/Oct2/2026)