Common Audit Findings in CASPs and Blockchain Businesses

Blockchain technology has introduced innovative business models, new methods of safeguarding assets and sophisticated financial products. However, despite these technological developments, the fundamental principles of corporate governance, financial reporting and statutory auditing remain unchanged.

During a statutory audit, auditors evaluate whether the financial statements have been prepared, in all material respects, in accordance with the applicable financial reporting framework. They also obtain an understanding of the entity's internal controls, governance arrangements and business processes to identify and assess the risks of material misstatement.

Many blockchain businesses encounter similar financial reporting and governance challenges, particularly during their first statutory audit. Identifying these issues early enables management to strengthen internal controls, improve financial reporting and reduce audit disruption.

This article highlights common observations made during statutory audits of blockchain businesses and outlines practical measures that directors and finance teams can implement to improve audit readiness.

One of the most common issues relates to inadequate documentation supporting digital wallets.

Management may operate numerous wallets across different blockchain networks without maintaining a central register.

Typical weaknesses include:

Good practice involves maintaining a comprehensive wallet inventory that is reviewed periodically and reconciled to the accounting records.

Many growing blockchain businesses initially operate with small management teams.

As a result, the same individual may:

Although understandable during the start-up phase, this concentration of responsibilities increases operational and fraud risks.

Management should implement appropriate segregation of duties or compensating controls proportionate to the size of the organisation.

Reliable reconciliations are fundamental to accurate financial reporting.

Common issues include:

• wallet balances not reconciled to the general ledger;
• exchange statements reviewed only at year-end;
• unreconciled customer balances;
• differences between blockchain records and accounting systems;
• delayed investigation of reconciling items; and
• undocumented adjustments.

Regular monthly reconciliations significantly improve financial reporting quality and reduce year-end audit adjustments.

Blockchain businesses frequently introduce new products and services at a rapid pace.

However, accounting policies sometimes fail to evolve accordingly.

Examples include:

• revenue recognition policies not updated for new services;
• undocumented valuation methodologies;
• inconsistent treatment of digital assets;
• unclear policies regarding custody arrangements;
• absence of documented management judgements; and
• inconsistent application across reporting periods.

Documented accounting policies promote consistency and provide a clear framework for financial reporting.

Revenue recognition remains one of the most judgemental areas of financial reporting.

Audit observations often include:

Management should document each revenue stream separately and ensure accounting policies reflect the underlying contractual arrangements.

Many CASPs safeguard crypto-assets on behalf of clients.

Weaknesses sometimes arise where management has not clearly distinguished:

Maintaining detailed custody records supports accurate financial reporting and assists the statutory audit.

Control of private keys represents one of the most significant operational risks within blockchain businesses.

Common deficiencies include:

• undocumented key management procedures;
• excessive access rights;
• reliance on one individual;
• lack of backup procedures;
• absence of multi-signature arrangements where appropriate;
• inadequate approval procedures; and
• poor documentation of emergency recovery processes.

Directors should periodically review governance over digital asset custody as part of the organisation's overall risk management framework.

Technology supports virtually every aspect of a CASP's operations.

Audit observations frequently include weaknesses relating to:

Although a statutory audit is not an IT audit, technology controls relevant to financial reporting form an important part of the auditor's understanding of the control environment.

Effective governance requires active involvement by the board of directors.

Audit observations may include:

• infrequent board meetings;
• limited documentation of decisions;
• inadequate monitoring of financial performance;
• absence of formal risk reporting;
• insufficient review of accounting policies; and
• incomplete documentation supporting significant management decisions.

Strong governance contributes directly to reliable financial reporting and organisational resilience.

Management is responsible for maintaining evidence supporting material transactions.

Common documentation gaps include:

Every significant accounting balance should be supported by appropriate documentation.

Blockchain businesses often operate within founder-led groups or interconnected technology ecosystems.

Management should identify and appropriately document:

Appropriate disclosure of related-party transactions is essential for transparent financial reporting.

Audit adjustments frequently relate not to the accounting entries themselves but to the accompanying disclosures.

Areas commonly requiring enhancement include:

Comprehensive disclosures improve transparency and assist users of the financial statements.

Auditors experienced in blockchain businesses understand the industry's operational and accounting challenges. Their sector knowledge enables them to focus on significant risk areas while providing practical observations that support improved governance and financial reporting.

A statutory audit should not be viewed solely as a compliance obligation. It provides directors and management with valuable insight into the effectiveness of financial reporting processes, internal controls and governance arrangements.

By addressing audit findings promptly and strengthening internal controls, blockchain businesses can improve operational resilience, enhance stakeholder confidence and support sustainable growth.

Our firm specialises in the statutory audit of Cyprus Crypto-Asset Service Providers and other digital asset businesses. Combining expertise in International Standards on Auditing, IFRS Accounting Standards and blockchain technology, we deliver independent assurance while helping organisations strengthen governance, improve financial reporting and prepare confidently for future growth.