ISA Auditing Crypto-Assets

The emergence of blockchain technology and digital assets has transformed the way businesses create, transfer and safeguard value. Crypto-assets, distributed ledger technology and decentralised transaction processing present auditors with new challenges that require both technical expertise and a thorough understanding of International Standards on Auditing (ISA).

Although blockchain technology is innovative, the objective of a statutory audit remains unchanged. The auditor's responsibility is to obtain reasonable assurance that the financial statements are free from material misstatement, whether caused by fraud or error, and to express an independent opinion on those financial statements.

Auditing a blockchain business therefore requires the application of established auditing principles to a technology-driven environment, supported by an understanding of digital assets, wallet infrastructure, custody models and blockchain transaction flows.

A statutory audit is conducted in accordance with International Standards on Auditing, which require auditors to:

• identify and assess risks of material misstatement;
• understand the entity and its internal control environment;
• obtain sufficient appropriate audit evidence;
• evaluate accounting estimates and judgements;
• assess the appropriateness of accounting policies;
• conclude whether the financial statements have been prepared in accordance with the applicable financial reporting framework; and
• issue an independent auditor's report.

These objectives apply equally to blockchain businesses and traditional organisations. What differs is the nature of the audit evidence and the specific risks that must be addressed.

Audit planning begins with developing a detailed understanding of the client's business model.

For a Crypto-Asset Service Provider (CASP) or blockchain business, this typically includes understanding:

This understanding enables the auditor to identify areas where material misstatements are more likely to arise.

Every audit is risk-based.

Blockchain businesses often involve risks that differ from those encountered in conventional industries.

Examples include:

The auditor assesses these risks before determining the nature, timing and extent of audit procedures.

One of the most significant aspects of a blockchain audit is obtaining sufficient and appropriate audit evidence relating to crypto-assets.

Unlike physical assets or traditional bank balances, crypto-assets exist on distributed ledger networks and may be controlled through private cryptographic keys.

Audit procedures are designed to obtain evidence regarding:

The precise procedures depend on the entity's business model, the custody arrangements in place and the assessed audit risks.

Establishing that the entity controls the crypto-assets recognised in its financial statements is a key audit objective.

Depending on the circumstances, auditors may evaluate:

• wallet ownership records;
• custody agreements;
• internal authorisation procedures;
• governance over private keys;
• documentation supporting wallet creation;
• evidence relating to multi-signature arrangements; and
• confirmations obtained from independent custodians where appropriate.

Ownership cannot be established solely by observing blockchain balances. Auditors must also consider whether the entity has the legal rights and practical ability to control the assets.

Public blockchain networks provide transparent records of transactions.

These records may assist auditors in tracing transactions between wallets, confirming transaction dates and understanding transaction histories.

However, blockchain data alone is rarely sufficient.

Auditors also examine:

Combining blockchain information with conventional audit evidence enables the auditor to reach appropriate conclusions.

Valuing crypto-assets can be challenging because market prices may fluctuate significantly over short periods.

Auditors evaluate whether management's valuation methodology is appropriate and consistently applied.

Considerations may include:

Material valuation judgements frequently receive particular audit attention.

Strong internal controls remain fundamental to reliable financial reporting.

Auditors assess controls relevant to the preparation of the financial statements, which may include controls over:

Where controls operate effectively, they may influence the nature and extent of substantive audit testing.

International Standards on Auditing require auditors to consider the risk of fraud in every audit.

Within blockchain businesses, fraud risks may include:

Auditors maintain professional scepticism throughout the engagement and design procedures responsive to assessed fraud risks.

Audit conclusions must be supported by appropriate documentation.

Management should therefore retain comprehensive records including:

Good documentation not only facilitates the audit but also strengthens financial reporting and corporate governance.

Blockchain technology continues to evolve rapidly.

Auditors working with digital asset businesses benefit from understanding:

• blockchain architecture;
• wallet technologies;
• consensus mechanisms;
• custody models;
• digital asset accounting;
• information technology controls;
• cybersecurity risks;
• financial reporting requirements; and
• the regulatory environment applicable to crypto businesses.

Combining technical audit expertise with an understanding of blockchain enables auditors to focus on the risks that matter most while delivering an efficient and high-quality statutory audit.

While statutory audits are conducted in accordance with the same International Standards on Auditing across all industries, experience in blockchain technology, digital assets and crypto-asset business models enables auditors to understand sector-specific risks more effectively.

Digital asset businesses require auditors who combine rigorous application of International Standards on Auditing with an appreciation of the technology, governance and operational risks that characterise the blockchain ecosystem.

Our firm provides statutory audit services to Cyprus Crypto-Asset Service Providers (CASPs) and other blockchain businesses, delivering independent assurance supported by expertise in financial reporting, blockchain technology and digital asset operations. We work closely with management and those charged with governance to deliver audits that are efficient, risk-focused and aligned with professional standards.