Auditing crypto-assets: be bold but recognize the risks, say experts

“Traditional audit procedures don’t provide the same audit evidence for crypto-assets,” says Taryn Abate, director of audit and assurance with the research, guidance and support department at CPA Canada (Getty Images/Hero Images)

As fintech gains speed and the number of crypto companies continues to climb, both in Canada and abroad, the demand for auditing in this area is also growing. This represents an exciting new opportunity for CPAs to lead the way.

Since the blockchain technology on which digital assets are based is so new and complex, there are issues and risks that need to be explored to maintain the high quality of audits. That’s why CPA Canada created a working group earlier this year to explore different auditing approaches to respond to the unique risks that a crypto-asset or blockchain company presents. The group is facilitated by CPA Canada and staff of the Canadian Auditing and Assurance Standards Board, and includes representatives from the Canadian Public Accountability Board, a number of audit firms and provincial practice inspectors.

We spoke with Taryn Abate, director of audit and assurance with the research, guidance and support department at CPA Canada, and Jean-François Trépanier, who is leading one of the working group’s projects. A specialist in professional standards at Raymond Chabot Grant Thornton in Montreal, Trépanier has also been working for the past two years with Catallaxy, an RCGT subsidiary that focuses on blockchain projects. These include developing a methodology for auditing digital assets. 

CPA CANADA: Canada has more publicly listed crypto-asset companies than most other jurisdictions. Could you explain that?

JEAN-FRANÇOIS TRÉPANIER: In some ways, Canada could easily be called an outlier, at least in terms of listed entities involved with crypto-assets. Based on the latest information available, our stock markets are home to two-thirds of the listed companies using IFRS that report holdings of crypto-assets worldwide. This creates an interesting challenge in Canada because listed companies have to be audited. It might explain why you see many Canadian stakeholders raising the issue of auditability with regard to crypto-asset holdings and transactions.   

It’s also important to point out that the companies, listed or not, that report crypto-assets are not all the same: some might be investment funds with a portfolio of crypto-assets, so these assets would be core to their business. Others might be retailers that have started accepting payment in crypto assets. For them, crypto assets would be ancillary. Then there are the companies that mine the crypto-assets and get rewarded for it. All these entities are very different, and present different audit challenges.

CPA CANADA: What is CPA Canada’s working group focusing on?

TARYN ABATE: Since this is a new and evolving industry, there are no best practices in place; we need to do a lot of exploration. Traditional audit procedures don’t provide the same audit evidence for crypto-assets. There are new risks that people need to identify and respond to.

There is some angst in the marketplace that auditors won’t accept entities that hold or transact in crypto-assets, but it’s not that simple. The entity needs to have established appropriate governance, controls and processes. They need to be audit-ready. An auditor is not going to take on an insurmountable amount of risk.

CPA CANADA: What are some of the risks in this space?

JFT: A number of issues have been raised over the past few months and the communication issued in December 2018 by the Canadian Public Accountability Board outlines many of them. One has to do with ownership rights. As the communication points out, “crypto-asset transactions offer some degree of anonymity because blockchain ledgers represent the identity of entities that have transacted crypto-assets as a string of alphanumeric characters for each public address.” That means auditors need to obtain sufficient appropriate audit evidence that the entity owns the crypto-assets that are associated with that public address. But this is not easy to do, because digital assets have different characteristics. Auditors are developing tools and techniques to verify ownership, but they may not work for certain crypto-assets that use privacy-preserving cryptography.

Additional risks can arise when crypto-assets are held by a third party acting as a custodian. Many platforms that facilitate the buying and selling of crypto-assets also have custody of their clients’ crypto-assets. Last December, the CEO of Quadriga, then Canada’s largest crypto platform, allegedly died while on a trip, leaving customers unable to access more than $200-million worth of bitcoin and other digital assets. Scandals such as this, along with other malfunctions, have highlighted the lack of trust in the space.

It’s interesting, because blockchain is supposed to be a trustless system: you have an immutable ledger, a single source of truth, where everybody can view all the transactions that have been recorded. So in theory you don’t need to have a trusted third party to make sure the books and records are right. But as they say in blockchain community, “Don’t trust, verify.” This proves that the community does not fully trust its participants—or even the technology.

CPA CANADA: Could you tell us more about the trust issue? 

JFT: Everyone says the notion of trust is embedded in the blockchain itself. But people are realizing that trust is earned, not freely given. There is a need for some level of assurance to be provided on the activities of the market participants. For example, if your crypto-assets are held by a platform that’s also acting as a custodian, what controls has this custodian put in place to make sure those assets are not misappropriated? This is a concern for many stakeholders, including the Canadian Securities Administrators, who are considering a set of tailored regulatory requirements for platforms to address new features and risks like this.

CPA CANADA: In presentations, you have spoken about blockchain not just as a technology, but as an ecosystem. Can you elaborate?

JFT: You have the communities developing the projects, the crypto-miners validating transactions and the hardware companies selling the specialized equipment needed to mine a blockchain. You have the financial service firms structuring financial products based on crypto-assets. You also have auditors and regulators who have key roles to play. Then, as in any ecosystem, there are—dare I say—parasites with malicious intent or projects that are shady. I’m not saying all initial coin offerings are hoaxes, but studies continue to show that a lot of these projects are not what they pretend to be. So that just contributes to the mistrust that exists in the space.

CPA CANADA: What did you do at the working group’s first meeting?

TA: We discussed the challenges associated with auditing crypto-assets and the root cause—whether it relates to the understanding of the technology, client preparedness or the auditing standards themselves. We’re currently drafting guidance—views from the profession—on two subjects: the reliability of information obtained from a blockchain, and obtaining audit evidence regarding the ownership of crypto-assets. As a third sub-issue, we’re looking at the risks that might be relevant if your assets are held by a custodian.

CPA CANADA: Where do firms stand right now in terms of auditing crypto-assets? Are they seizing the opportunity or avoiding the risks? 

JFT: My personal view is that the future belongs to the bold. And I think all the firms are being bold with technology in general; they’re looking to use it to increase audit quality. After all, that is the end goal: to make an audit more efficient and effective. 

As CPAs, we are providers of trust. And trust is hard to obtain but very easy to lose. So you have to strike a balance between being innovative and bold and being conscious of the amount of risk you are taking on. I think that is what the firms are doing. 

WANT TO LEARN MORE ABOUT THE WORLD OF CRYPTO-ASSETS?

See CPA Canada’s resources, including, Audit considerations related to cryptocurrency assets and transactions, Auditor’s responses to assessed risks in audits of entities that hold crypto-assets, Introduction to accounting for cryptocurrencies under IFRS and Introduction to accounting for cryptocurrencies under ASPE.