How blockchain might affect audit and assurance

Although emerging blockchain technology may significantly change financial statement auditing, accounting professionals will continue to have an important role in the audit and may see new opportunities related to blockchain, according to a newly released audit and assurance alert.

Blockchain technology forms the foundation for an internet-based peer-to-peer network that uses computer-powered cryptography to facilitate exchanges of value. Computers on the network, known as nodes, simultaneously verify and record transactions, allowing parties that do not know one another to complete transactions without the traditional trusted intermediary, such as a bank or credit card network. This technology, originally created for bitcoin but since developed for many other cryptocurrencies and uses, including smart contracts, has the potential to disrupt numerous industries.

The emergence of blockchain has led to concerns over the future of CPAs in auditing. That’s because the combination of peer-to-peer networking technology and cryptography allows for the creation of a distributed, “triple-entry” ledger that can automatically confirm and record transactions, virtually in real time, and is extraordinarily difficult to change after the fact. To some, it may seem that there would be nothing left for a CPA to audit if all transactions are captured and preserved in an immutable blockchain.

Those concerns are addressed in a report authored by several leaders in blockchain technology from Deloitte’s U.S. audit and consulting business, as well as blockchain leaders of Deloitte Canada, CPA Canada, the AICPA, and the University of Waterloo. The report, Audit & Assurance Alert — Blockchain Technology and Its Potential Impact on the Audit and Assurance Profession, describes how blockchain technology could potentially affect the financial statement audit.

According to the report, while the acceptance of a transaction into a reliable blockchain may constitute sufficient appropriate evidence for certain financial statement assertions, it may not provide sufficient audit evidence related to the nature of the transaction. For example, although the transfer of bitcoin is recorded on the blockchain, the auditor may not be able to determine that the product was delivered based solely on an evaluation of information on the bitcoin blockchain.

According to the report, a transaction recorded in a blockchain may:

• Be unauthorized, fraudulent, or illegal.
• Be executed between related parties.
• Be linked to a side agreement that is “off-chain.”
• Be incorrectly classified in the financial statements.

Although CPAs may be able to develop procedures to obtain audit evidence directly from the blockchain, the auditor would need to consider the risk that the information is inaccurate because of error or fraud. This may present new challenges because there is a good chance the blockchain would not be controlled by the entity being audited. The CPA auditor will need to extract the data from the blockchain and also consider whether they are reliable.

But the report says migration to the blockchain might enable CPA auditors to streamline the audit process. With access to real-time data, CPA auditors can develop software to continuously audit organizations using the blockchain and eliminate labor-intensive manual data extraction and audit preparation activities.

In addition, the report says new roles for CPAs that may develop as a result of blockchain’s emergence include:

• Auditor of smart contracts. Smart contracts may be embedded in a blockchain to automate business processes. Parties to smart contracts may be eager to engage a CPA to verify that smart contracts are implemented with the correct business logic.
• Service auditor of consortium blockchains. Potential users of private blockchain products may wish to engage a CPA to provide independent assurance on the stability and robustness of the system’s architecture. Rather than each participant performing his or her own due diligence, it may be more efficient to hire a CPA to achieve these objectives. A trusted and independent third party may be needed to provide assurance as to the effectiveness of controls over the private blockchain.
• Access-granting administrator. A trusted, independent third-party CPA may be the perfect candidate to serve as the central access-granting administrator for a blockchain that requires permission to join.
• Arbitrator. CPA assurance providers may be among the qualified professionals in the future who would settle disputes among participants in a private blockchain.

While the exact implications of blockchain for CPAs are uncertain, the report urges members of the profession to learn more about the technology and consider the skills they will need to meet market demands as blockchain use increases.

Identifying the risks associated with blockchain and learning how to use the technology for a competitive advantage can help CPAs maintain and increase their relevance in the business environment.

— Ken Tysiac (Kenneth.Tysiac@aicpa-cima.com) is a JofA editorial director.