Cybersecurity and IT Controls for CASPs

Technology is the foundation upon which Crypto-Asset Service Providers (CASPs) and blockchain businesses operate. Trading platforms, custody systems, digital wallets, blockchain nodes, cloud infrastructure and financial reporting systems all depend upon secure and reliable technology.

As digital asset businesses continue to grow, cybersecurity and information technology governance have become board-level priorities. Cyber incidents, unauthorised access, ransomware attacks and operational failures may not only disrupt business operations but also affect the integrity of financial reporting and the safeguarding of digital assets.

Although a statutory audit is not a cybersecurity audit or a penetration test, International Standards on Auditing (ISA) require auditors to obtain an understanding of the information systems and internal controls that are relevant to the preparation of the financial statements.

For Crypto-Asset Service Providers, effective IT General Controls (ITGCs) contribute to reliable financial reporting, operational resilience and regulatory compliance.

Our firm combines expertise in statutory auditing, digital assets and financial reporting to assess technology controls relevant to the audit while recognising the unique operational characteristics of blockchain businesses.

IT General Controls (ITGCs) are the policies, procedures and technical safeguards that support the reliable operation of information systems.

They provide the foundation upon which automated financial reporting controls operate.

Typical IT General Controls include:

Strong IT General Controls reduce the likelihood of unauthorised transactions, data loss and financial reporting errors.

Unlike many traditional businesses, CASPs rely heavily on technology for virtually every operational process.

Examples include:

Weak technology controls may therefore increase both operational risk and financial reporting risk.

Controlling access to systems is one of the most important elements of an effective control environment.

Management should establish procedures governing:

Access should be granted according to business responsibilities and reviewed regularly.

Where appropriate, organisations should implement Multi-Factor Authentication (MFA) to strengthen security.

MFA reduces the risk of unauthorised access by requiring users to verify their identity through multiple independent authentication methods.

Critical systems benefiting from MFA may include:

The effectiveness of authentication controls contributes to the overall strength of the control environment.

Technology environments evolve continuously.

Software updates, infrastructure changes and application enhancements should be managed through formal change management procedures.

Good practice includes:

• documented change requests;
• technical testing;
• management approval;
• segregation between development and production environments;
• implementation planning;
• rollback procedures; and
• post-implementation review.

Poorly controlled system changes may introduce errors affecting financial reporting.

Organisations should maintain appropriate system logs to support monitoring and incident investigation.

Examples include:

Monitoring should be proportionate to the organisation's size and operational complexity.

Reliable backup procedures support operational resilience and business continuity.

Management should establish policies covering:

Regular testing provides confidence that systems can be restored following an operational disruption.

Every CASP should establish a Business Continuity Plan (BCP) appropriate to its operations.

The plan should address:

Business continuity planning demonstrates organisational resilience and supports sound governance.

Many blockchain businesses rely upon cloud infrastructure.

Management should implement governance procedures covering:

Although services may be outsourced, responsibility for governance remains with management.

Digital wallets require governance extending beyond traditional IT controls.

Management should establish documented procedures for:

Strong wallet governance contributes directly to safeguarding digital assets.

Cybersecurity should be integrated into the organisation's overall governance framework.

Good governance generally includes:

Cybersecurity is not solely an IT function—it is an enterprise-wide governance responsibility.

International Standards on Auditing require auditors to understand the information systems relevant to financial reporting.

Depending on the circumstances, auditors may evaluate controls relating to:

The extent of testing depends upon the assessed audit risks and the nature of the entity's systems.

Importantly, a statutory audit does not provide an opinion on the overall effectiveness of an organisation's cybersecurity programme.

Technology underpins every aspect of a modern Crypto-Asset Service Provider. Effective governance over information systems, digital wallets and cybersecurity contributes not only to operational resilience but also to reliable financial reporting and stakeholder confidence.

Our firm provides statutory audit services to Cyprus Crypto-Asset Service Providers and blockchain businesses, combining expertise in International Standards on Auditing, IFRS Accounting Standards and blockchain technology. Through a risk-based audit approach, we assess the technology controls relevant to the financial statements while delivering independent assurance that supports transparent reporting and sound corporate governance.