Focus: What keeps cryptocurrency auditors awake at night?

Today, South Africa finds itself amongst the top-ranking cryptocurrency trading nations on the continent. With local daily crypto asset trading values exceeding the $45 million mark, regulators and auditors play an increasingly crucial role in securing and validating the big data infrastructure upon which virtual asset service providers (VASPs) rely. This booming industry requires an auditing methodology that goes beyond conventional ‘ticking and bashing’1 and addresses the exponential growth and technicalities of big data.

This is the opinion of Dinesh Gurlal, associate director of IT audit at leading audit, tax and advisory firm Mazars in South Africa. ‘The cryptocurrency industry is supported by big data, which is incredibly dynamic, variable and volatile. As audit partners, it demands that we maintain an unprecedented level of agility. Due to the scale of big data, we must go beyond traditional, annual or interim audits and adapt to meet the needs of an ever-evolving sector. To do this, we interrogate lower, manageable volumes of data on a more regular basis, using advanced analytics tools to sift through the intricacies,’ Gurlal explained at a crypto and digital assets webinar hosted by Mazars in South Africa and Luno, the leading global digital currency.

He explained that there are two key risk areas that concern auditors of VASPs − revenue recognition and the segregation of corporate and customer wallet balances by backend systems. Within these risk areas, there are three areas of consideration, namely the validity, accuracy and completeness of transactions included in the accounting records that ultimately make up the line items in the income statement and balance sheet. Gurlal argues that what keeps audit partners of cryptocurrency exchanges awake at night are issues around needing to gain sufficient audit evidence to mitigate the auditor’s risk to an acceptable level.

According to Wiehann Olivier, partner and digital assets lead at Mazars, the current status quo is characterised by a scenario where cryptocurrency, a new and emerging asset class – valued at around $1 trillion – is being retrofitted into existing rules and regulations that are not tailored to govern the unique way in which it operates.

PROFESSIONAL SERVICE FIRMS
Uncharted territory demands extensive knowledge from service providers, and this, Olivier believes, is why it is critical that crypto exchanges utilise professional services firms – including auditing services – where there is a deep and evolving knowledge of this new technology.

‘If an auditor does not understand the industry – the nature of the technology, its inner workings and how to obtain the relevant assurance – they are not only putting their names and reputations at risk, but they are also putting the audit profession and cryptocurrency industry at risk,’ says Olivier. Given that cryptocurrencies and digital assets are extremely vast – and highly technical – topics, this is no easy feat.

As an example, Olivier says that cryptocurrencies such as Bitcoin and Ethereum operate off fundamentally different bases. This means that the difference in the nature of these two currencies requires different approaches to aggregate and harvest transactions from the various blockchains.

In addition to this, Olivier says that proving rights and ownership is not as easy as obtaining a third-party confirmation from the bank, because blockchain and cryptocurrencies were designed to operate without an intermediary. ‘We therefore need to design procedures to provide us with the required assurance, which differs for each of the various cryptocurrencies in existence,’ explains Olivier.

He notes the issue of classification for these digital assets. ‘Cryptocurrencies do not readily fit into any existing accounting frameworks. One would imagine that they would be classified as financial instruments under the relevant standard, but they are not – they aren’t cash, and they aren’t equity of another entity and there is no contractual agreement, so one needs to look at other possible applications that make sense from a practical point of view,’ he explains.

Lastly, Olivier says that we need to consider the tax implications of cryptocurrencies: ‘because once again we have this asset class that’s being dropped into pre-existing laws and regulations’.

DATA INTEGRITY ABOVE ALL
Bringing a practical perspective was Richard Ball, lead data scientist at Luno, who explained that the challenges faced by the industry have necessitated an approach that, above everything, ensures the integrity of data. Luno does this by employing bespoke methodology around database design and medallion architecture (or a layered approach to certain criteria), which segregates certain pieces of data according to their use cases.

As he concludes: ‘Some of the key challenges that we face as a business include the proficiency of users, the relevancy of the data, the growth of the data, the freshness of the data and the data analytics tool selection. As a cryptocurrency platform exchange, operating in an environment that is experiencing a boom, we are constantly adapting, iterating and innovating in order to work within the parameters of existing regulation and take both reactive and proactive approaches to the new challenges that arise. Luno is also ISO 27001 certified, which confirms that we have all the necessary systems and processes in place to ensure the data and customer information we hold is safe.’

NOTE
1 An approach to auditing that involves substantive testing in the form of ‘ticking boxes’ to confirm that the proper administrative processes have been followed.

Author
Wiehann Olivier, partner and digital assets lead at Mazars and
Dinesh Gurlal, associate director of IT audit at Mazars