Due to the magnitude of corporate failures and effectiveness of fraudsters, fraud receives heightened attention from regulators and researchers. With each scandal and technological advancement, the expectation of the external auditor’s responsibility to detect fraud morphs, and performance of audits involving these assets will require a stronger skillset for auditors to uphold the expectation of the public to report fraud risks. Digital assets (aka “crypto,” or “cryptoassets”) are increasingly becoming more mainstream and present a challenge to all aspects of an audit engagement.
While the responsibility for the detection and prevention of fraud remains firmly with those charged with governance, auditors are expected to be well-versed on fraud risks linked to each technological advancement. A recurring theme in audit inspection findings are concerns that auditors are properly responding to the risks related to the audit. The root cause for failures we often see in audits with inspection comments is due care and professional skepticism. Here, we explore how the increasing assimilation of crypto in business transactions challenges auditors to equip themselves by knowing applicable fraud risk factors, remaining abreast of advancing technologies, and reassessing engagement acceptance, while continuing to maintain professional skepticism.
Identify Fraud Risk Factors
Prior to engaging a digital asset model or incorporation of cryptoassets, companies should have identified controls that commit the appropriate resources to implement and monitor the assets. For example, consider the risk of material misstatement due to fraud through management override of controls over a digital wallet or private keys, which may result in misappropriation. PCAOB AS 2110, Identifying and Assessing Risks of Material Misstatement, guides the auditor to perform procedures to obtain an understanding of the company’s financial relationships, transactions with executive officers, and aid in identifying risks of material misstatement (see paragraph .10A). Additionally, the involvement of related party transactions may be difficult to ascertain due to the inherently convoluted nature of cryptoassets. How will your expertise of separation of duties, access controls, and physical controls over access be reflected in your clients’ audit risk assessment when evaluating digital wallet(s). Specifically, AS 2301, The Auditor’s Responses to the Risks of Material Misstatement, directs the auditor to determine the warranted changes to the nature, timing, or extent of audit procedures to adequately address the assessed risks of material misstatement (see paragraph .06).
In a centralized exchange, users exchange fiat currency for crypto and digital assets as well as exchange one digital asset for another. To do this, an audit client may trust the custody of crypto to an exchange like Binance or Coinbase. Exchanges are “on-ramps” as they allow currency to be added to the account using a credit card or bank transfer and then converted into digital assets. Exchanges may perform other services for crypto users like processing trades, deposits and withdrawals, custody of assets, and Know Your Customer and Anti Money Laundering controls. This introduces custody risk as the exchange stores private keys. If anyone else has access to the private keys, the asset holder is not in full control of the value in the account.
Arguably, blockchain technology may cut the need for a financial statement audit altogether as it captures an immutable blockchain, rendering the financial statement audit invalid. As blockchain technology evolves, we understand that risks of unauthorized, fraudulent, undisclosed related party, or incorrect classification in the financial statements is possible.
One way to mitigate the risk is to exercise a healthy dose of professional skepticism in the engagement and evaluate management’s tone. Be thorough in your understanding of why and when a client is engaging in crypto and when they are not. Crypto and non-crypto transactions can be layered for adding confusion to transactions and working around controls. In instances of layered transactions, you will make determinations based on your understanding of management’s intention, ensuring transactions are fully supported, and proving crypto as an exchange medium. Be rigorous with evaluating and documenting crypto risk factors in audit evidence, internal controls, independence, and cybersecurity, all of which are addressed in greater detail by my colleagues.
Continuing Education
Many sectors experience growth and recession with varied speed, challenging auditors to remain sharp in their financial accounting abilities. The digital asset environment sector has exploded signaling a warning for auditors to learn this novel division. Auditor competencies in the face of regulatory, technological, industry, and financial reporting developments weave into every aspect of an audit involving crypto. Crypto itself is not a fad or a fraud, it is transformative technology that can only find fullest potential if cradled by accountability and ingenuity.
The performance of audits involving crypto requires contemporary skills and knowledge through its continuous advancements. Auditors have the professional duty to only undertake those engagements to remain competent. I would argue that ensuring the entire engagement team is skilled and knowledgeable in crypto behavior to be able to recognize an unreported related party transaction takes more than a one-hour lunch-and-learn course. As blockchain evolves, and data on blockchain like NFTs advance, I look forward to innovative training of auditors through this pioneering age. To properly audit title transactions, cold wallets, and evaluate risks of material misstatement of an entity, auditors will continue to be well-informed and a step ahead.
Engagement Acceptance or Continuance
System of quality management (ISQM 1) and the comparable standard proposed by the AICPA (SQMS 1) requires a firm to establish quality objectives addressing the audit acceptance and continuance criteria. Specifically, the standards highlight a firm’s ability to perform the engagement in accordance with professional standards and applicable legal and regulatory requirements. With the design of privacy coins, the art of cryptography, and the brilliance of blockchain technology, how does this novel technology fit into audit acceptance? Technological advancement should not be a reason to pause for many firms, however, depending on the complexity of activities, engagement team preparation, and entity, you may need to consider how crypto fits. A firm’s system of quality management is a stamp of professionalism.
Recently, an article about “The Rise of Crypto Mayors” captured attention. The article boasts of a mayor elected on a platform to improve the infrastructure of a small town in Tennessee. It did not take long for this small-town mayor to engage in crypto with the town’s funds and begin advocating for Bitcoin paycheck options. Viewing it as an opportunity to bridge a wealth gap for the town, the mayor has also chosen a wing of city hall for digital mining efforts, once approved by the state. Firms have a great responsibility to uphold public trust and audit within the framework of competence. The incorporation of crypto activity itself is not a stand-alone purpose to deem it a fraud risk. However, knowing the relevant controls and necessary oversight are of the utmost importance and may require the engagement of a specialist. Regardless of how the entity is a steward of funding and their framework, reporting crypto activities requires an auditor to understand the fraud risks associated with the entity and properly disclose them.
We have seen public accounting firms getting in on the trend making their own investments in digital assets. Firms are taking very prudent approaches to be calculated and experienced. The key take away is, when you engage, engage knowledgably and sensibly, which is the lesson for crypto and all audit engagements alike. If partaking in the activities provides for better learning, then this may enlighten firms to additional crypto fraud risks when engaging firsthand.
Maintain Professional Skepticism
ISQM 1 and SQMS 1 charge firms to achieve the objectives of professional standards and comply with the requirements of applicable laws or regulation by exercising professional judgment and applying professional skepticism. Firms will be developing intellectual resources, including creating alerts for engagement teams on circumstances that are giving rise to the need for professional skepticism and supplying guidance for engagement teams in these circumstances. This type of alert, for example, will include placing an undue reliance on an IT application in the engagement.
The AICPA officially accepts the definition of professional skepticism as an attitude that includes a questioning mind, being alert to conditions that may indicate possible misstatement due to fraud or error, and a critical assessment of audit evidence (AU-C 200).
PCAOB: AS 1015.07 and .08 states: Due professional care requires the auditor to exercise professional skepticism. Professional skepticism is an attitude that includes a questioning mind and a critical assessment of audit evidence. The auditor uses the knowledge, skill, and ability called for by the profession of public accounting to diligently perform, in good faith and with integrity, the gathering and objective evaluation of evidence. Gathering and objectively evaluating audit evidence requires the auditor to consider the competency and sufficiency of the evidence. Since evidence is gathered and evaluated throughout the audit, professional skepticism should be exercised throughout the audit process.
When performing an audit involving any variant of crypto transactions, be aware that features, functions, characteristics, operation, use and other properties of digital assets may be complex, technical, or difficult to understand and evaluate. Crypto may be vulnerable to attacks on the security, integrity or operation, including attacks using computing power sufficient to overwhelm the normal operation of the digital asset’s blockchain or other underlying technology. Some digital asset transactions will be recorded on a public ledger at a particular time, however, this may not be the same as the initial transaction date and time. Transactions in digital asset investments may be irreversible, and, accordingly, losses due to fraudulent or accidental transactions may not be recoverable. In 2021, 38% of organizations increased their budget for anti-fraud technology (Association of Certified Fraud Examiners). Exercising professional skepticism in the coming decade of transformative digital assets will be a true differentiator in audit effectiveness.
Concluding Token
The pace of crypto and blockchain innovation is unrelenting. In the coming quarters, how will client acceptance and continuance documentation, engagement team meetings, and risk assessments reflect an evaluation of crypto? Should any advancements or enhanced risks cause an engagement team to reconsider their engagement acceptance or continuance? How has the engagement team prepared for the extraordinary advancements on the horizon in the decade of 2020?
Crypto is novel to your clients as well. Will you expect a strong policy on how, when, and why they use digital currency versus another currency? How will you determine if the misstatement to the financial statements due to crypto was intentional or not? As companies may rely on financing or abide by debt covenants, is there a temptation to smooth ratios or cash flows by controlling transactions through multiple avenues? Companies understand the pressure to perform and the markets expect the engagement team to effectively design and perform procedures to identify and test risk factors as crypto advances. Providing confidence to the public is your strength and exercising professional skepticism is the tried-and-true principle to lean on. While your clients increasingly engage in crypto, maintain your vigilance in knowing and reporting fraud risks.
Adina Kerfoot, a Certified Fraud Examiner with over 20 years of audit and controllerships experience from multi-unit operations, brings a fresh perspective to each client and engagement. She has deep experience with internal controls and implementation of standards at corporate and nonprofit organizations. As a public accountant, she experienced firsthand the PCAOB inspection process. A proud resident of Jackson, Tennessee, Adina is pursuing a Doctorate in Business Administration (DBA) in Accounting. She also has a Bachelor of Science in Accountancy from Southern Illinois University in Edwardsville, IL and a Master of Science in Accountancy from Liberty University in Lynchburg, VA.
Johnson Global Advisory
1717 K Street NW, Suite 902
Washington, D.C. 20006
USA
+1 (702) 848-7084