Audit Procedures for Digital Assets

gm curious accountants 👋 

Who, what, when, and how - These are the looming questions frequently asked by accountants preparing for an external year-end audit. Being audited, particularly for the first time, can be a daunting process for any company, especially for those having digital assets on their balance sheet. This naturally leaves many questions relating to the audit, its purposes, and how it will be conducted. 

This article will help you to be audit-ready, and will cover; 

• Understanding the financial audit process
• Assertions in an audit
• What are substantive procedures
• Crypto-focused substantive procedures

(P:S - This is a 2 part series , and you can refer to Part 1 on Preparing an Audit with Digital Assets)

Understanding the Financial Audit Process 📚

ISA 200 ‘Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with International Standards on Auditing’ emphasises that the primary responsibility of the auditor is to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatements, whether due to fraud or error.

Simply put, the auditor will look to perform certain tests, checks, and assessments in order to ensure that from an independent point of view, what your financial statements reflect is reasonable (otherwise known as free from material misstatement). This involves evaluating the company’s financial practices and internal controls and performing tests to substantiate their opinion. 

It's important to distinguish between a financial audit and a smart contract audit. While a financial audit scrutinises the financial records and processes of a business to ensure accuracy and compliance, a smart contract audit examines the code behind blockchain-based contracts to identify vulnerabilities and ensure correct functionality. This article focuses on financial audits, providing essential strategies for finance teams to excel in this area.

Assertions in an Audit 🔍

In financial auditing, assertions refer to the claims management makes regarding the aspects of its financial statements. These assertions are essentially what the auditor seeks to validate throughout their audit procedures. Therefore, this is what a company would need to substantiate through readily available evidence. The assertions are typically the following;

1. Completeness

Ensures all transactions and accounts that should have been recorded are included.

2. Existence

Confirms that assets, liabilities, and equity interests exist.

3. Accuracy

Verifies that amounts and other data relating to recorded transactions and events have been recorded appropriately.

4. Valuation

Confirms that assets, liabilities, and equity interests are included in the financial statements at appropriate amounts.

5. Rights and Obligations

Asserts that the entity holds or controls the rights to assets, and liabilities are the obligations of the entity.

6. Presentation and Disclosure

Ensures that all transactions are recorded in the proper accounts, and that financial statements are presented in accordance with relevant accounting standards, and that the disclosures are appropriately stated.

The importance of being able to evidence the above assertions for various facets of the financial statements is important to keep in mind, more specifically for web3 companies. Due to the innovative and novel nature of blockchain, this has meant that some auditors have not yet developed specialized tools to gain the necessary assurance. As a result, the responsibility falls heavily on the finance team to effectively communicate and substantiate their assertions.Often, this necessitates collaboration with team members outside the finance department to offer detailed explanations and demonstrations.

What Are Substantive Procedures 🤔

These are audit procedures/tests designed to detect material misstatements at the assertion level. They can include tests of details on transactions, balances, and disclosures, as well as analytical procedures that evaluate financial information through analysis and comparison of expected patterns and fluctuations.

A fundamental substantive procedure involves obtaining a bank confirmation at year-end and reconciling it with the cash balance in the financial statements. This provides the auditor with evidence that management’s assertion of accuracy, existence, and presentation are valid and reasonable. Specifically, the confirmation evidences the amount agrees (Accuracy), the bank account is owned by the company (existence) and presented fairly (positive cash balance).

Crypto-Focused Substantive Procedures ⛓️

As mentioned above, auditing crypto-related activities remains somewhat uncharted territory due to the rapid evolution of the technology and the space.

That being said, there are some standardised tests that are to be expected to be performed. The evidence produced can be through the internal systems of the company or through trusted third-party applications and on-chain data. It is essential that this evidence is reproducible, allowing auditors to independently verify and draw their own conclusions.

Examples of Crypto-Focused Substantive Procedures 

Wallet ownership 

Proving ownership of a wallet using a signature-matching tool or micro-specific transaction. During episode 53, Chris O'Reilly & Marnus Kruger shared that to verify ownership of wallets, Harris & Trotter LLP has developed a signature matching tool that cryptographically proves that an individual has control over the private keys of the wallet, without the need to spend any gas fees.

Audit Assertion (AA): Ownership

Verification of cryptocurrency holdings at a point in time 

Confirm cryptocurrency balances by verifying digital wallet addresses against blockchain records. This would most probably focus on important historical dates. 

AA: Completeness and Existence‍

Transaction testing

Sample and test individual crypto transactions for validity, authorisation, and proper recording in the company’s ledger, including the cost methodology.

AA: Accuracy

Revenue recognition testing

Verify the accuracy of revenue from crypto transactions by comparing to blockchain confirmations or protocol revenue generated.

AA: Occurrence and Accuracy

Third-party confirmations

Obtain confirmations from external entities such as crypto exchanges and wallet providers to confirm balances and transactions.

AA: Existence and Accuracy

Valuation of crypto assets

Test the methods used for valuing cryptocurrencies at the reporting date, including reference to market prices. 

AA: Valuation

Testing for impairment

Check for indications of impairment of crypto assets by analysing market trends, usability of tokens, and company intentions.

AA: Valuation

Review of smart contracts

Examine the setup and execution of smart contracts involved in the company’s operations for proper functionality and security.

AA: Accuracy and Completeness

Verification of private key management

Assess the controls over the storage and handling of private keys used to access crypto assets.

AA: Ownership and Completeness

Testing internal controls over crypto transactions

Evaluate the design and effectiveness of internal controls over the processing of crypto transactions.

AA: Control Environment (pertaining to all assertions including Accuracy, Completeness, and Existence)

It is important to keep these types of tests in mind, not only at the time of the audit, but also as a usual part of your function. By doing this, it would increase the quality of the record-keeping and proper assessment of the nature of transactions and treatment. It also makes everyone’s life a bit easier when the audit comes around.

Conclusion 💯

Congratulations! You are now ready to drive home the concepts of an audit and ensure that nerves are settled when the audit is around the corner. By understanding what a financial audit is, the assertions that the auditor will scrutinise, and the specific substantive tests they might perform, you can confidently navigate the audit process.