Auditing Cryptoassets: ISA 500, ISA 540, FRC, ICAEW and PCAOB Requirements

Why Auditing Cryptoassets Demands Specialist Training

Cryptoasset holdings create audit challenges that do not exist for traditional financial assets: existence cannot be confirmed through third-party confirmation (there is no custodian bank holding crypto on behalf of clients in most cases); ownership relies on private key control which auditors cannot directly verify through standard procedures; valuation can be highly volatile and involves assessing fair value for assets that may trade on multiple exchanges at differing prices; and completeness is complicated where clients hold assets across multiple wallets, exchanges and protocols.

FRC, ICAEW and IAASA inspection findings consistently flag cryptoasset audits as areas requiring enhanced scrutiny. PCAOB Standard AS 2502 (auditing fair value measurements) applies to cryptoasset valuations for US-listed entities, creating additional demands on international audit teams.

The Regulatory Framework for Cryptoasset Audits

ISA 500 — Audit Evidence: For cryptoasset holdings, the nature, timing and extent of audit evidence must be reconsidered. Standard confirmation procedures are not available for decentralised assets. Auditors must develop alternative procedures: independent blockchain verification of wallet balances; confirmation of private key control (with appropriate controls over the confirmation process); assessment of exchange custody arrangements and associated counterparty risk.

ISA 540 — AI-Assisted Estimates: Where clients use AI models to value complex cryptoasset portfolios or estimate impairment losses, auditors must evaluate the model, its inputs, and the governance around its use. This applies particularly to clients with large altcoin holdings, NFT portfolios, or DeFi positions where standard exchange pricing is unavailable.

ISA 315 — Digital Asset Systems: Client systems processing cryptoasset transactions — hot wallets, custody platforms, DeFi interfaces — require assessment under ISA 315. Auditors must understand the IT general controls, access controls and transaction monitoring systems relevant to digital asset operations.

ICAEW QAD Guidance: ICAEW's Quality Assurance Department has issued specific guidance on cryptoasset audits, reflecting inspection findings where auditors failed to obtain sufficient appropriate evidence for digital asset holdings. Key requirements include: documenting the basis for treating blockchain data as reliable audit evidence; assessing exchange reliability and custody risk; and appropriately sceptical evaluation of management's valuation assumptions.

IAASA Guidance: IAASA's thematic review on digital assets (2023) identified specific weaknesses in Irish audit firms' approaches to cryptoasset existence and valuation assertions. IAASA expects auditors to apply enhanced professional scepticism and to document the procedures performed to address the unique risks of digital asset holdings.

Frequently Asked Questions

What CPD training do auditors need for cryptoasset audits?

Auditors performing cryptoasset audits need CPD training covering ISA 500 evidence procedures for digital assets, ISA 540 AI-assisted fair value estimates, ISA 315 digital asset systems risk, ICAEW QAD and IAASA guidance, and PCAOB requirements for US-listed entities. Learnsignal's cryptoasset audit CPD programme covers all of these areas with structured accreditation recognised by ICAEW, ACCA and CPA Ireland.

How do auditors verify existence of cryptoasset holdings?

Standard third-party confirmation is not available for most cryptoasset holdings. Auditors must develop alternative procedures: direct blockchain verification of wallet balances at the audit date (using blockchain explorer tools or specialist software); confirmation of private key control with appropriate procedures to ensure the private key tested actually corresponds to the reported holding; assessment of exchange custody arrangements where assets are held on centralised exchanges; and reconciliation of client records to independently verified blockchain data.

What is the PCAOB position on auditing cryptoassets?

PCAOB Staff Alert 2022-01 and subsequent guidance address the specific audit risks of cryptoasset holdings for US-listed entities. Key points: AS 2502 (auditing fair value measurements) applies to cryptoasset valuations; PCAOB inspections have identified cryptoasset audits as a focus area; and audit firms must ensure engagement teams have appropriate competency to audit digital asset holdings. For international firms auditing US-listed entities, PCAOB guidance creates specific training requirements.

How does IAASA approach cryptoasset audit quality?

IAASA's thematic review findings highlighted that some Irish audit firms lacked sufficient understanding of the unique risks of cryptoasset holdings. IAASA expects: enhanced professional scepticism in assessing existence and ownership; robust documentation of procedures performed to address the completeness of digital asset disclosures; and appropriate evaluation of the reliability of blockchain data used as audit evidence.

What tools can auditors use for cryptoasset verification?

Auditors can use blockchain analytics tools (Chainalysis, Elliptic, Breadcrumbs) for wallet balance verification and transaction analysis; blockchain explorer services (Etherscan, Blockchair) for direct ledger verification; and specialist audit software that integrates blockchain data into working paper documentation. AI features within some of these tools can assist with pattern analysis and red flag identification, requiring auditors to understand their limitations.