Blockchain is evolving rapidly from enigma to imperative in financial reporting circles, and one audit firm has even introduced an early audit approach.
PwC recently unveiled a “blockchain validation solution” that combines a patent-pending risk framework with proprietary continuous auditing software. “It is currently the only standard that exists for risks and controls in the blockchain space for private business blockchain processes,” the firm says.
The blockchain validation software that PwC says it is now deploying in a limited number of use cases provides real-time testing for anomalies covering a full population of transactions. It is meant to be built into client systems so that it becomes part of the client’s data processing system. The firm says it will find longer-term patterns of indicators that are not evident to humans, is immediate and predictive, and provides objective results.
A. Michael Smith, internal technology audit services leader at PwC, says the solution is operating now in a large, financial services setting, and a number of other projects are in the pipeline. “It’s all real, tangible,” he says. “It is, in fact, in production.”
Blockchain entered the capital market scene with bitcoin, the first cryptocurrency that gained traction as a huge potential disrupter of traditional currencies and payment processes. Blockchain is the technology that powers bitcoin trading.
A digital ledger, essentially, blockchain is a peer-to-peer, internet-based, network that brings buyers and sellers into a seemingly secure digital marketplace with no intermediaries, like banks or payment processing centers, and no standards. It records transactions in a ledger that’s freely accessible to all parties, and its entries cannot be deleted or altered.
“At its very core, blockchain is another type of database technology,” says Will Bible, a partner at Deloitte & Touche. “Many different companies share access to a common database, so it keeps multiple redundant copies of the database in sync at all times.”
“At its very core, blockchain is another type of database technology. Many different companies share access to a common database, so it keeps multiple redundant copies of the database in sync at all times.”
Will Bible, Partner, Deloitte & Touche
Today, companies each keep their own databases recording their own transactions, and accountants spend a good deal of their time reconciling databases, says Bible. “A blockchain pivots that,” he says. “It records all the information to the same place in the same way, so the reconciliation effort on the back end goes away.”
That makes the financial reporting and audit implications intriguing, says Ami Beers, director at the Association of International Certified Public Accountants. “It’s transparent technology,” she says. “It can reduce cost; it can transact faster and cheaper. And it gives you an immutable record of all transactions that cannot be changed, so that’s automating the audit trail. No one party controls it. We look at it as an opportunity to make audits more efficient in the future.”
Pilot testing is occurring in many settings, says Beers, especially in the financial services sector, where blockchain could provide a powerful new way to track asset trades and settlements. That’s already happening with digital currencies, so banks are exploring how it could be deployed for transactions involving traditional currencies.
Supply chain management is another strong potential use case for blockchain, says Brian Wolohan, national partner at Grant Thornton. Food producers, for example, may want or need to establish proof of origin for certain ingredients, he says, and blockchain technology can help enable that.
Whether for food product or other materials in other sectors, blockchain as a way to manage supply chain activities would address a host of documentation and logistics issues, says Wolohan. “Think about the investment that occurs in terms of managing the process of moving goods and checking them at different points, confirming, invoicing, payments. All of that is cost, and time is money.”
Smart contracts are another compelling use for blockchain, says Maurice Liddell, managing director in technology at BDO USA. Smart contracts are essentially digital agreements in a blockchain that can bring together any number of parties in any number of jurisdictions with terms and conditions established and documented in the same trackable, irreversible digital fashion.
What Is Blockchain technology?
A blockchain is a digital ledger created to capture transactions conducted among various parties in a network. It is a peer-to-peer, Internet-based distributed ledger which includes all transactions since its creation. All participants (i.e., individuals or businesses) using the shared database are “nodes” connected to the blockchain, each maintaining an identical copy of the ledger. Every entry into a blockchain is a transaction that represents an exchange of value between participants (i.e., a digital asset that represents rights, obligations, or ownership). In practice, many different types of blockchains are being developed and tested. However, most blockchains follow this general framework and approach.
When one participant wants to send value to another, all the other nodes in the network communicate with each other using a pre-determined mechanism to check that the new transaction is valid. This mechanism is referred to as a consensus algorithm. Once a transaction has been accepted by the network, all copies of the ledger are updated with the new information. Multiple transactions are usually combined into a “block” that is added to the ledger. Each block contains information that refers back to previous blocks and thus all blocks in the chain link together in the distributed identical copies. Participating nodes can add new, time-stamped transactions, but participants cannot delete or alter the entries once they have been validated and accepted by the network. If a node modified a previous block, it would not sync with the rest of the network and would be excluded from the blockchain. A properly functioning blockchain is thus immutable despite lacking a central administrator.
Despite the upside potential, there are still plenty of risks associated with blockchain to be sorted out, says Liddell. “How do you go about getting assurance that the information is accurate?” he asks. “Can a third party get in and play with it?”
To pass muster with auditors, blockchains that produce data feeding into financial reporting will need strong processes and controls over who can access the blockchain and what they can do, says Jeff Ward, a partner at BDO USA. “Just because everything is in a blockchain, that doesn’t make it legitimate. We still have to look for unauthorized, fraudulent, illegal activity. There’s more to it than just determining that a transaction exists.”
Blockchain is not seen at this point as a way of automating the preparation of financial statements or the financial reporting process, but as a new source of data that would roll into accounting processes and financial statements. “You might create a blockchain for a supply chain purpose that generates immutable, time-stamped information that can be utilized by the financial reporting process and potentially relied on by the auditor,” says Wolohan.
But auditors are just scratching the surface in terms of identifying the uncertainties about how to audit the information that comes from a blockchain, says Beers. “The open question is whether the information and transactions that are being conducted in the block chain can be constituted as audit evidence in itself or if an auditor needs to perform procedures,” she says. “We think skills are going to have to evolve in terms of being able to understand blockchain.”
Erich Braun, a partner at KPMG and the firm’s audit blockchain lead, says auditors will have to comply with auditing standards regardless of changes in technology. “There are still basic requirements, and we have to figure out a means of getting there,” he says.
Auditors will need to see plenty of access controls and will need a means of checking triggering events via use of smart contracts in the blockchain, says Braun. They’ll also need to assess codes to be sure the technology is operating as intended. “A lot of auditing today is auditing around the technology, getting hard-copy records,” he says. “Blockchain will require auditing through the technology, not auditing around the technology.”
PwC claims to have worked through some of those issues, at least for its first pass at an audit solution that is not being relied upon yet for any financial reporting purpose.
The challenges in auditing blockchain for financial reporting purposes are numerous, says Smith. “The way the underlying database is architected and processes data, there’s no practical or efficient way to do traditional audit activity against that,” he says.
Further complicating matters, blockchain is not a single product or application. “It’s a form of computer science with little to no standardization,” Smith says. “If we go to 20 different clients that are using blockchain, we might see 16 different types of software and a half dozen architectures. When you think about audit and compliance and regulatory activities, it’s all about standardization.”