Cryptic Audits of Crypto Assets: Considerations for Auditing Digital Assets

When Bitcoin first launched in 2009, the founder, known as Satoshi Nakaomoto, published a paper explaining how Bitcoin and the blockchain technology worked. The starting price per coin was $0. In April 2011, Bitcoin passed the $1 threshold. Over time, as traction grew, the Bitcoin steadily gained in value and eventually surpassed $10,000 per coin in 2017. After that first initial peak, the price of Bitcoin became much more volatile with massive increases and decreases in value, capping out at a value of over $60,000 in Q4 2021 and dropping today to a value of closer to $20,000 per coin.
In addition to Bitcoin, there are now also hundreds of other cryptocurrencies. Some are mainstream and accepted as valid payment for college tuition or even delivery pizza, while other cryptocurrencies are more speculative. Regardless of the coin, the fact is cryptocurrencies are growing in popularity and prevalence and sure enough, they are now popping up on company balance sheets. In fact, there are entire companies whose sole mission is to mine cryptocurrencies.
As with any new development in the markets, it takes some time for accounting and auditing guidance to become clear. The SEC and the FASB have both released guidance helping provide clarity on how to account for and report digital assets. In 2020, while not providing explicit guidance, the PCAOB did issue a Spotlight for Audits Involving Cryptoassets: Information for Auditors and Audit Committees. Through the audit inspection process and review of comment forms issued, we’ve started to see how the PCAOB views cryptocurrencies and what procedures are necessary to sufficiently audit these assets. As with any audit, it all boils down to understanding the entity, its operations, and evaluating and appropriately responding to risks of material misstatement.
When auditing digital assets, here are some key considerations to keep in mind:
Acceptance and Continuance
True for every engagement, it all starts with acceptance and continuance. As firms consider whether to accept and/or continue with a client that has digital assets, firms need to evaluate whether they have the right skills and competence to engage in auditing digital assets. While the concepts may be easy to grasp at a high level, the actual underlying technology and transactions involving crypto assets can be quite complex. These are all unique considerations that should be weighed prior to accepting a new engagement or continuing with an engagement that involved digital assets:
- Does the engagement team have access to a digital asset specialist?
- Does the firm have IT specialists who understand the technology?
- How many other engagements involving digital assets does the partner, EQR, and/or senior manager have?
- For clients that mine digital assets, where are the operations performed?
- How many locations are there? Does the firm have the access and/or ability to visit all these locations / sites to perform audit procedures?
- What about regulatory compliance considerations such as “anti-money laundering” and “know your customer” considerations?
- What about management? How educated / competent is management in this industry? For lack of a better word, many amateur investors followed the hype and jumped into the crypto markets without fully understanding how these assets worked. Is management following the hype or are they truly experts/experienced in the industry with appropriate internal controls to enable a quality audit?
Planning and Risk Assessment
Once a firm has accepted an engagement, the next step, regardless of the industry, is to develop a deep understanding of the entity. Whereas many firms are familiar with oil and gas or basic manufacturing and production, the reality is that the cryptocurrency industry is new (even if it’s been more than 10 years) and is ever-evolving, especially given the purely technological nature of the industry.
In understanding an entity, consider these questions:
- What is the company’s business? And how do digital assets factor in? For instance, does the company hold digital assets as an “investment” or do they actually mine assets?
- What are the investors in the business looking for? This will drive operations and help identify potential risks. How does the company make money? What are the biggest costs?
- What technology is being used? Are operations centralized? Many digital mining companies have several worldwide data centers (or “mining sites”). How does the auditor know these sites exist? What controls (i.e. access controls, change management, data security, etc.) are in place in the different sites?
- What support does a mining company have for proof of work? How did they prove out the encrypted chain? How do they support the portion of the block they mined?
- For digital assets held, what proves unique ownership / existence? Especially in pooling situations where companies work collectively to mine assets, how are assets allocated? What support is there to validate these allocations? Given the anonymous nature of cryptocurrencies, just because someone has access to a wallet, does that inherently mean they have ownership rights?
- How is pricing calculated? Cryptocurrencies can trade on multiple platforms and since there are no regulated exchanges, what validates the “right” price?
Especially considering the new SAS 145 standard for AICPA, regardless the audit (public or private, integrated or financial statement only), to properly design an audit, engagement teams need to have a thorough understanding of the entity and how it all works. This enables proper identification of the risks which then allows proper design of audit procedures to address the risks. Given the digital nature of crypto assets, a thorough understanding of the entity will necessarily incorporate a thorough understanding of the information systems used to mine the assets, trade the assets (i.e. exchanges), and hold the assets (i.e. wallets). I would venture to argue that given the technological nature of the digital assets, it would be almost impossible to sufficiently perform an audit without testing internal controls over information systems and the processes in place to mine, recognize, and trade these digital assets.
Materiality is also important. If a company has immaterial holdings in digital assets, then perhaps less risk, but if the company’s operations are entirely focused on mining these assets, well then knowledge and experience matter much more in designing and executing the audit. The point is, acceptance and continuance is the first threshold; it acts as a gateway to filter out clients where the firm is not suited to perform a thorough, quality audit.
Responding to Risks
Once the risks have been properly identified and evaluated, the next step is to design and execute audit procedures to respond to the risks. As mentioned above, this will likely mean testing internal controls. Why is that so important? Because there is almost nothing tangible (i.e. no sales orders, no inventory counting, no paper certificates of ownership, etc.), the biggest challenge for any auditor will be, “how is the engagement team comfortable with the completeness and accuracy of the audit evidence used in audit procedures?”
For example, for a digital asset mining company, let’s say the engagement team decides to perform analytics to help prove out ownership of digital assets at the end of the audit period. To do this, the engagement team will use numerous reports and metrics from the company, such as operating reports that show when mining sites were operational and when they were down, or output measurements, computing factors, etc. These data points can be incredibly insightful and help validate coins mined and ownership rights, but the analytics are only as valid as the data is complete and accurate (if it’s internally derived information from management) or relevant and reliable (if it’s externally derived information). While there is nothing explicit in audit guidance that says, “an audit of crypto assets must incorporate testing the internal controls,” we’d venture to say that audits of the crypto asset industry fall under this caveat in AS 2301.17:
Also, tests of controls must be performed in the audit of financial statements for each relevant assertion for which substantive procedures alone cannot provide sufficient appropriate audit evidence and when necessary to support the auditor's reliance on the accuracy and completeness of financial information used in performing other audit procedures.
Note: When a significant amount of information supporting one or more relevant assertions is electronically initiated, recorded, processed, or reported, it might be impossible to design effective substantive tests that, by themselves, would provide sufficient appropriate evidence regarding the assertions. For such assertions, significant audit evidence may be available only in electronic form. In such cases, the sufficiency and appropriateness of the audit evidence usually depend on the effectiveness of controls over their accuracy and completeness…
The point is that audit procedures need to be commensurate with the risk. The response is based on audit procedures incorporating audit evidence and the quality of the audit evidence necessarily is dependent on relevance and reliability. We encourage teams to ask lots of questions early in the planning phase to ensure a thorough understanding and then design procedures to ensure engagement teams can obtain sufficient quality audit evidence to support conclusions.
When considering reliability, one of the factors to incorporate is whether information is regulated. For instance, we’ve seen engagement teams support valuation assertions for crypto assets by looking to exchanges and validating the price. While this certainly seems logical, let’s not forget that crypto exchanges are not regulated in the same way as the NYSE or NASDAQ and as a result, are inherently less reliable. This would mean that additional procedures would need to be performed to either corroborate the valuation of the crypto assets (especially considering valuation is typically a significant risk) and/or corroborate the reliability of the information pulled from the exchange. If you aren’t sure what procedures are sufficient, then reach out and consult. We’ve worked with numerous firms to help engagement teams understand the risks and then appropriately design procedures to address those risks.
Key Takeaways
- There is more and more guidance emerging around digital assets, but every audit is inherently different with a unique set of risks and there just hasn’t been enough history to develop “routine” audit programs for crypto asset audits.
- There are resources out there to help educate firms/individuals. There is more and more guidance being provided, so research SEC and FASB developments, continue to look out for PCAOB publications, read up on Big 4 guidance, and look to other industry reports and information. For instance, the Canadian equivalent of the PCAOB (CPAB), just released in August of 2022 a
publication on auditing crypto assets. While CPAB and PCAOB and AICPA standards all differ in various ways, the foundation of a risk-based audit is universal and similar concepts apply across the globe.
- Firms need to critically evaluate acceptance and continuance, taking stock of whether they have the appropriate knowledge, experience, and capacity to perform crypto audits.
- The most important part of any audit boils down to the planning phase. Engagement teams need to ask all the questions to develop a thorough understanding of the entity and how the operations function. This includes understanding the information systems involved.
- In designing audit procedures, the quality of audit evidence will be of utmost importance. Engagement teams need to document why information is considered relevant and reliable and for internally derived information from the company, why that information is complete and accurate. Do not underestimate the importance of controls when auditing digital assets.
Invariably, with new industries, no one has experience to start, so there will be some trial and error. Auditing crypto assets can feel a little like taming the wild west. More than ten years in, I think it’s safe to say that crypto assets are not just a temporary fad; they’re only gaining in volume and prevalence across all industries. Some just love the concept of cryptocurrency while others are more interested in the underlying technology which is giving rise to new and unique assets, beyond just digital currency. For instance, blockchain is the same technology being used in NFTs (or non-fungible tokens) which have taken off in the realm of digital art. Each variation of digital assets will pose its own risks, so take the time to understand exactly what the digital assets are, how they’re created, mined, or obtained, and how they’re being used. Then identify the relevant risks. Then execute an audit to address those risks. And if it still feels cryptic and you aren’t sure where to begin, then reach out for help.
Joe Lynch is Joe has over 25 years of experience in technology, audit, and audit quality compliance with a focus on technology. At JGA, Joe is the IT Audit Advisory Services Leader and works with internal auditors, public and private companies, and regional and national mid-market public accounting firms to implement and to integrate technology into financial processes and improve the audit integration of engagement teams performing integrated audits and service organization reports. He also provides critical input to IT-specific requirements related to new QC standards implementation.
As an Information Systems Inspection Leader for over 6 years at the PCAOB, he conducted inspections of QC and global issuer audits at large firms in the US as well as foreign affiliate firms, focusing on examining quality control and the design and implementation of audit work over IT and service organizations in integrated audits. Joe also has over 8 years of experience supporting financial service industry audit teams as a managing director at KPMG. In addition, his experience includes, over 6 years of active-duty service in the US Air Force and directly supporting companies with IT strategic initiatives such as designing the IT framework for technology departments as well as leading implementations of ERPs and systems.









