Common Audit Findings in Crypto-Asset Service Providers (CASPs) and Blockchain Businesses

Lessons Learned from Statutory Audits of Digital Asset Organisations

Blockchain technology has introduced innovative business models, new methods of safeguarding assets and sophisticated financial products. However, despite these technological developments, the fundamental principles of corporate governance, financial reporting and statutory auditing remain unchanged.

During a statutory audit, auditors evaluate whether the financial statements have been prepared, in all material respects, in accordance with the applicable financial reporting framework. They also obtain an understanding of the entity's internal controls, governance arrangements and business processes to identify and assess the risks of material misstatement.

Many blockchain businesses encounter similar financial reporting and governance challenges, particularly during their first statutory audit. Identifying these issues early enables management to strengthen internal controls, improve financial reporting and reduce audit disruption.

This article highlights common observations made during statutory audits of blockchain businesses and outlines practical measures that directors and finance teams can implement to improve audit readiness.

Incomplete Documentation of Wallets

One of the most common issues relates to inadequate documentation supporting digital wallets.

Management may operate numerous wallets across different blockchain networks without maintaining a central register.

Typical weaknesses include:

  • undocumented wallet addresses;

  • inactive wallets remaining on records;

  • uncertainty regarding wallet ownership;

  • inconsistent naming conventions;

  • incomplete approval documentation;

  • missing records of wallet creation; and

  • lack of documented business purpose.

Good practice involves maintaining a comprehensive wallet inventory that is reviewed periodically and reconciled to the accounting records.

Weak Segregation of Duties

Many growing blockchain businesses initially operate with small management teams.

As a result, the same individual may:

  • initiate transactions;

  • approve transfers;

  • administer wallets;

  • record accounting entries; and

  • reconcile balances.

Although understandable during the start-up phase, this concentration of responsibilities increases operational and fraud risks.

Management should implement appropriate segregation of duties or compensating controls proportionate to the size of the organisation.

Inadequate Reconciliations

Reliable reconciliations are fundamental to accurate financial reporting.

Common issues include:

  • wallet balances not reconciled to the general ledger;

  • exchange statements reviewed only at year-end;

  • unreconciled customer balances;

  • differences between blockchain records and accounting systems;

  • delayed investigation of reconciling items; and

  • undocumented adjustments.

Regular monthly reconciliations significantly improve financial reporting quality and reduce year-end audit adjustments.

Undocumented Accounting Policies

Blockchain businesses frequently introduce new products and services at a rapid pace.

However, accounting policies sometimes fail to evolve accordingly.

Examples include:

  • revenue recognition policies not updated for new services;

  • undocumented valuation methodologies;

  • inconsistent treatment of digital assets;

  • unclear policies regarding custody arrangements;

  • absence of documented management judgements; and

  • inconsistent application across reporting periods.

Documented accounting policies promote consistency and provide a clear framework for financial reporting.

Revenue Recognition Issues

Revenue recognition remains one of the most judgemental areas of financial reporting.

Audit observations often include:

  • inconsistent application of IFRS 15;

  • incorrect cut-off procedures;

  • unsupported manual revenue adjustments;

  • inadequate contract reviews;

  • principal-versus-agent assessment not documented;

  • variable consideration not evaluated; and

  • incomplete revenue reconciliations.

Management should document each revenue stream separately and ensure accounting policies reflect the underlying contractual arrangements.

Client Assets Not Clearly Distinguished

Many CASPs safeguard crypto-assets on behalf of clients.

Weaknesses sometimes arise where management has not clearly distinguished:

  • company-owned assets;

  • client assets;

  • omnibus wallets;

  • restricted assets;

  • pledged assets; and

  • treasury holdings.

Maintaining detailed custody records supports accurate financial reporting and assists the statutory audit.

Weak Governance over Private Keys

Control of private keys represents one of the most significant operational risks within blockchain businesses.

Common deficiencies include:

  • undocumented key management procedures;

  • excessive access rights;

  • reliance on one individual;

  • lack of backup procedures;

  • absence of multi-signature arrangements where appropriate;

  • inadequate approval procedures; and

  • poor documentation of emergency recovery processes.

Directors should periodically review governance over digital asset custody as part of the organisation's overall risk management framework.

IT General Control Weaknesses

Technology supports virtually every aspect of a CASP's operations.

Audit observations frequently include weaknesses relating to:

  • user access management;

  • privileged accounts;

  • password controls;

  • change management;

  • backup procedures;

  • system monitoring;

  • incident management;

  • software updates; and

  • documentation of IT policies.

Although a statutory audit is not an IT audit, technology controls relevant to financial reporting form an important part of the auditor's understanding of the control environment.

Limited Board Oversight

Effective governance requires active involvement by the board of directors.

Audit observations may include:

  • infrequent board meetings;

  • limited documentation of decisions;

  • inadequate monitoring of financial performance;

  • absence of formal risk reporting;

  • insufficient review of accounting policies; and

  • incomplete documentation supporting significant management decisions.

Strong governance contributes directly to reliable financial reporting and organisational resilience.

Delayed Audit Preparation

Some organisations begin preparing for the statutory audit only after the financial year has ended.

This often results in:

  • incomplete supporting documentation;

  • delayed reconciliations;

  • significant audit adjustments;

  • increased audit queries;

  • extended fieldwork; and

  • delayed issuance of the auditor's report.

Preparing continuously throughout the year generally produces better outcomes.

Insufficient Supporting Evidence

Management is responsible for maintaining evidence supporting material transactions.

Common documentation gaps include:

  • missing contracts;

  • incomplete invoices;

  • undocumented journal entries;

  • unsupported valuation calculations;

  • absent board approvals;

  • missing custody confirmations; and

  • incomplete transaction support.

Every significant accounting balance should be supported by appropriate documentation.

Related-Party Transactions

Blockchain businesses often operate within founder-led groups or interconnected technology ecosystems.

Management should identify and appropriately document:

  • transactions with shareholders;

  • loans;

  • management remuneration;

  • group service arrangements;

  • shared technology costs;

  • token transfers; and

  • common ownership structures.

Appropriate disclosure of related-party transactions is essential for transparent financial reporting.

Financial Statement Disclosures

Audit adjustments frequently relate not to the accounting entries themselves but to the accompanying disclosures.

Areas commonly requiring enhancement include:

  • accounting policies;

  • significant judgements;

  • valuation methodologies;

  • concentration of risk;

  • liquidity risk;

  • digital asset holdings;

  • related parties;

  • contingent liabilities; and

  • subsequent events.

Comprehensive disclosures improve transparency and assist users of the financial statements.

How Management Can Reduce Audit Findings

Directors and finance teams can significantly improve audit outcomes by:

  • maintaining complete accounting records throughout the year;

  • documenting accounting policies;

  • performing monthly reconciliations;

  • strengthening governance over wallets and private keys;

  • reviewing internal controls regularly;

  • preparing supporting schedules before the audit begins;

  • retaining documentation for significant transactions;

  • communicating complex matters with auditors early; and

  • providing timely responses to audit requests.

These practices support stronger governance while reducing disruption during the audit.

Frequently Asked Questions

Does an audit finding indicate fraud?

No. Most audit findings relate to opportunities to improve financial reporting, documentation or internal controls. They do not necessarily indicate fraud or misconduct.

Can findings be resolved before the audit is completed?

Yes. Many issues identified during the audit can be addressed through additional documentation, reconciliations or accounting adjustments before the financial statements are finalised.

Are first-year audits more likely to identify findings?

Generally, yes. Organisations undergoing their first statutory audit often formalise accounting policies and governance procedures as part of the audit process.

Will strong internal controls reduce audit findings?

Effective governance, documented procedures and reliable accounting records generally contribute to fewer audit observations and a more efficient audit.

How can specialist blockchain auditors help?

Auditors experienced in blockchain businesses understand the industry's operational and accounting challenges. Their sector knowledge enables them to focus on significant risk areas while providing practical observations that support improved governance and financial reporting.

Turning Audit Findings into Opportunities

A statutory audit should not be viewed solely as a compliance obligation. It provides directors and management with valuable insight into the effectiveness of financial reporting processes, internal controls and governance arrangements.

By addressing audit findings promptly and strengthening internal controls, blockchain businesses can improve operational resilience, enhance stakeholder confidence and support sustainable growth.

Our firm specialises in the statutory audit of Cyprus Crypto-Asset Service Providers and other digital asset businesses. Combining expertise in International Standards on Auditing, IFRS Accounting Standards and blockchain technology, we deliver independent assurance while helping organisations strengthen governance, improve financial reporting and prepare confidently for future growth.