Auditing of Cryptocurrency

Virtual Assets, Currency of the Future!

By Eric Wong, CPA, CA


Cryptocurrency is the latest craze in the investment world and everyone is looking for ways to invest.  However, as financial products sold to the public on a local stock exchange or by financial institutions, accounting firms will be required to provide assurance services for companies issuing these securities to the public, as well as companies holding these securities as part of their investment portfolio.  In rendering these services to clients, public accounting firms have faced particular issues in the auditing process.  Some of these issues include determining whether the assets actually exist, whether the company has a right to assets and how they should be valued.


Existence or Occurrence


There are basic existence issues with crypto currency balances.  In order to verify this condition, auditors are required to ensure that:


  1. The block chain is reliable
  2. invalid transactions are not recorded on the block chain
  3. validated transactions are recorded on the block chain
  4. validated transactions are not subsequently modified


As a result, in order to properly satisfy this requirement, we as auditors need to identify the relevant attributes of the blockchain (e.g., cryptography, blockchain validation algorithms and consensus mechanisms) that mitigate those risks and perform tests to determine whether they are operating as intended.  This will require the assistance of a specialist, who is knowledgeable in the auditing of information systems, in order to ensure that transactions cannot occur without the owner of the asset initiating the transactions.  The main way that access control is enforced for crypto-assets is through private and public keys.  The strength of the encryption is dependent on the type of block chain of which the digital currency is a part.  In addition to having knowledge of these characteristics, the auditor must also understand the client’s policy regarding the backing up, accessing, and protecting of both public and private keys.


Rights & Obligations

In evaluating an entity’s ownership assertion, auditors will need to design an audit approach that seeks to obtain sufficient appropriate audit evidence that the entity owns the crypto-assets which are associated with a public address.


Auditors, for instance, may request management to transfer a specified amount of a crypto-asset balance between crypto wallets controlled by the entity and inspect the blockchain record


for the occurrence of the transaction.  Alternatively, auditors may ask management to sign arbitrary messages to prove they have access to the private key that controls a crypto-asset.


The procedures above may be useful to verify an entity’s access to the private key and control over the related assets.  However, an entity’s access to a private key should not be interpreted by auditors to mean that the entity has ownership rights to the related crypto-asset.  This is because there is a risk that an entity could share the alphanumeric sequence of a private key with others such that multiple entities or individuals could assert ownership rights over the same crypto-asset.


Most of these tests require specialized skills and specialize audit software or techniques to assess the effectiveness of the computer or automated controls to ensure all the controls are functioning as described by management.


Some investment houses use third party services to process and store crypto assets on behalf of clients. In this case, the auditor will be required to either test the controls themselves or request the service provider to provide Soc 1 Type 2 report most commonly referred to service auditors report.



Cryptocurrency might trade on an exchange or a market, and therefore fair market value might be easily obtainable from a reputable third party.  In that case, it is just a simple act of taking the last trade price on closing of the market on the last day of the fiscal period and adjusting the value of the crypto currency accordingly.  However, if the asset is not traded on the open market, then a specialist must be employed as part of the audit team or as a consultant to assist with valuing the assets.  Below is a sample of techniques that are common valuing crypto currency though they might be other methods not listed:

  • Network Value to Transaction Ratio (NVT) – measures the amount of traded volume as an indicator of how actively used it is
  • Daily active users (alternatively, daily active addresses, or DAA) – how many users use the crypto asset in transactions on a monthly basis?
  • Supply-demand economics applied to crypto assets via monetary theory – VALUE & VELOCITY


Each of these issues in the auditing of cryptocurrency – those relating to Existence, Rights, and Valuation – create challenges for auditors and may not be for everyone!  However, if practitioners are able to overcome the challenges outlined above, they will have an interesting and rewarding experience conducting the engagement, and an interesting client as well.  Whoever said that auditing couldn’t be fun, doesn’t know what fun is.



For a free consultation or to receive any background on this topic please contact please contact Jerry Paskowitz directly.


Jerry Paskowitz, CPA, CA

Recent Blog Posts