Crypto Asset Audit Procedures for Valuation and Evidence

For U.S. businesses, crypto asset audit procedures link identified risks to financial-statement assertions and supporting evidence. Prepare by organizing transaction records, wallet details, exchange statements, and control documentation, then reconcile blockchain activity with company records. Ownership, completeness, accuracy, and valuation each require evidence suited to the balance being tested.

It’s understandable to start by asking whether a wallet balance matches the ledger. But in a U.S. audit, a matching balance alone may not establish who controls the assets, whether every wallet has been disclosed, or whether the valuation is supportable. This article explains how auditors assess those assertions, evaluate pricing sources, verify wallet and exchange records, and consider custodian evidence in the U.S. context.

What can accountants do to prepare for crypto audits?

For U.S. businesses, auditors prepare by linking digital-asset risks to financial-statement assertions, controls, and evidence. To test transactions, transfers, and staking rewards, they sample activity, trace it between internal records and blockchain data, and assess validity, authorization, ledger recording, and cost methodology.

Private Key Access and Protection

Private-key access controls determine who can authorize transactions and how keys are stored and protected. They matter because management or another authorized person could override controls and misuse or misappropriate cryptoasset holdings. In a U.S. audit, auditors assess the design and operation of controls over key generation, storage, handling, authentication, and access permissions.

For example, auditors can compare approved access lists with system permissions and review how changes are authorized. They can inspect security protocols that protect transaction integrity and assess whether the controls address identified risks. A documented risk-to-test map connects each key-management risk to the work performed, making documented audit procedures easier to follow and reproduce.

Ownership and Control Verification

Ownership and control testing evaluates whether a U.S. entity has rights to reported assets and can direct their use. A wallet address alone doesn’t establish those rights. Auditors can match addresses to blockchain records, including records for relevant historical dates, and examine documentation linking each address to the entity.

A signed-message test can demonstrate control of an address without moving funds or paying gas fees. The auditor compares the signature with the address and records the method and result. They should also consider whether a third party holds the assets, since the evidence of control differs for company wallets and custodial accounts.

Transaction and Staking Reward Testing

Transaction testing checks whether selected activity was valid, authorized, accurately recorded, and accounted for using the stated cost methodology. Auditors can select transfers from the ledger and trace them to blockchain confirmations, then trace selected on-chain activity back to internal records. Testing in both directions can reveal omitted activity and unsupported entries.

For staking rewards, auditors compare recorded rewards with available protocol or validator records and relevant blockchain activity. They assess whether the U.S. entity’s records consistently reflect rewards received and related transactions. If an on-chain record shows a reward that is missing from the ledger, the difference needs investigation.

Preparation also involves assessing financial-statement error risks and how internal controls affect the audit. Auditors document the link between each identified digital-asset risk and the procedure designed to address it. They consider management override of private-key controls as a fraud risk, rather than relying only on routine access reviews.

Businesses can support an audit by organizing wallet details, transaction records, smart contracts, and control documentation. Reconcile on-chain activity with off-chain records, including customer transactions recorded outside the blockchain. Staff training in crypto accounting and internal procedures helps keep evidence consistent and makes it easier for auditors to reproduce their tests.

Cryptoasset valuation and pricing sources

For U.S. entities, a defensible valuation starts with the measurement date, the asset held, and a pricing source that reflects relevant market activity. Accounting Standards Update 2023-08, Subtopic 350-60, is effective for fiscal years beginning after December 15, 2024. Auditors assess how management selected its price, applied its method, and connected the result to reported balances under the applicable U.S. accounting framework.

Price evidence needs context. An auditor can compare the reporting-date price with market data from the venue used by the business, then assess whether activity on that venue supports the quoted value. They can document the asset identifier, price source, timestamp, and calculation used to extend the price across recorded units. A blockchain balance confirms the units at an address, but not their reporting-date value.

Volatility makes timing and source selection important to a U.S. valuation assessment. A price observed after the reporting date may not reflect conditions on that date. Auditors consider whether data is current, trading is active, and unusual movements affect the reliability of the observed price. If venue quotes differ, the audit work should explain which market data better reflects the asset and why.

Thin trading calls for closer scrutiny. Auditors assess whether a quoted price is supported by observable market activity or relies more heavily on assumptions. They examine management’s inputs, assumptions, and method, then consider whether the evidence supports the reported amount. Workpapers should show how each material input contributes to the valuation and how management addressed uncertainty.

Impairment analysis considers whether market trends, token usability, or the company’s intentions indicate a potential decline in value. U.S. auditors assess these factors alongside pricing evidence, rather than treating a quoted price as a complete explanation. For example, restricted token utility or sustained market weakness may affect the analysis. They assess whether management’s conclusion and related disclosures align with the evidence and applicable U.S. accounting requirements.

A clear workpaper links source data to the final balance. It should preserve price extracts, timestamps, calculations, and explanations for selected inputs, so another reviewer can reproduce the result. If crypto valuation also affects tax reporting, a crypto tax accountant can help connect accounting records with U.S. reporting treatment.

Completeness and accuracy across wallets and exchanges

Completeness testing asks whether the records include every relevant holding and transaction. Accuracy testing checks whether recorded balances and activity agree with supporting evidence.

Wallet and Exchange Completeness

Auditors build an inventory of known wallets, exchange accounts, and related records, then assess whether the ledger includes them. They compare wallet addresses with blockchain activity and use more than one independent block explorer or run a node to verify balances. Reviewing historical blockchain records helps test balances at the reporting date, rather than only current holdings.

Completeness testing also looks beyond addresses already listed by management. Auditors compare transaction records, exchange statements, access records, and internal wallet schedules for unexplained transfers or gaps. Written representations alone provide weak evidence that all digital-asset wallets have been disclosed. Each discrepancy should prompt further assessment, such as tracing a transfer to its destination or source.

Exchange holdings require a different approach. In an omnibus arrangement, an exchange combines customer assets in shared wallets, so on-chain records cannot verify an individual customer’s balance. Auditors instead reconcile the entity’s account statements and transaction history with its ledger, investigate differences, and evaluate the evidence supporting its claim to the recorded balance.

Accounting Rules and Audit Risks

For U.S. entities, FASB Accounting Standards Update 2023-08, Subtopic 350-60, applies to qualifying crypto assets for fiscal years beginning after December 15, 2024. U.S. audits also assess risks of material misstatement using applicable PCAOB requirements. AS 2110 addresses risk identification and assessment; AS 2301 addresses responses to assessed risks.

Common risks include omitted wallets, unsupported balances, incomplete exchange activity, and management override of private-key controls. Auditors evaluate whether management could bypass access restrictions or conceal transfers. They also consider customer transactions recorded outside the blockchain, since those records do not receive the same blockchain controls. A mismatch between an exchange statement and the ledger is a reason to investigate, not an automatic conclusion of fraud.

Fraud indicators include unexplained address changes, unusual transfers, missing records, or inconsistent transaction approvals. Auditors trace selected activity to source records, test authorization, and document how each risk connects to a procedure. For an entity operating across borders, compliance assessment must consider the rules relevant to each jurisdiction separately, since requirements differ by location.

Together, these tests help establish whether reported holdings are complete and accurately recorded. A reproducible evidence trail should link wallet and exchange records, ledger entries, and the auditor’s conclusions.

Custodian confirmations and service organisation reports

Third-party custody changes what evidence can establish about crypto holdings. Auditors use custodian confirmations and service organisation reports to assess recorded balances, asset existence, and relevant controls. Each source answers a different question: a confirmation addresses information held by the custodian, while a service auditor’s report describes controls within its stated scope.

Under ISA 505, auditors obtain external confirmations from custodians. A confirmation can support the balance and transactions recorded for an account, but the auditor still compares the response with the entity’s ledger and other evidence. For example, a statement showing an account balance should be reconciled to recorded holdings, and differences should be investigated rather than simply carried forward.

Confirmations are most useful when they address the reporting date and identify the relevant account or assets. Auditors assess whether the response came from the custodian and covers the information needed for the audit. They also consider unanswered requests, inconsistent balances, and transactions near the reporting date. Each exception can affect the evidence available for existence, rights, or accuracy.

ISA 402 guides auditors in assessing third-party service organisations. They review whether a service auditor’s report covers controls relevant to the entity’s holdings and audit risks. Scope matters. A report may describe certain custody or transaction controls but leave other controls outside its coverage. Auditors identify those gaps and determine whether they need to test the controls directly or perform other procedures.

For a custodial wallet, the assessment should connect the provider’s control environment with the entity’s financial reporting. Auditors consider how the provider records balances, processes withdrawals, and safeguards access. They compare the controls covered by the report with the services the entity actually uses. If an important control falls outside the report’s scope, the report alone cannot establish that the control operated effectively.

Audit readiness depends on organized records. Businesses can maintain custodian account details, periodic statements, transaction histories, reconciliation schedules, and copies of relevant service organisation reports. A clear schedule should link each account to ledger balances and explain reconciling items. This helps the auditor trace a holding from the financial statements to third-party evidence and identify missing or inconsistent records.

Audit reporting should accurately summarize the procedures performed, key findings, and recommendations for improvement. Documentation should preserve confirmation requests and replies, report-scope assessments, reconciliation results, and explanations for unresolved differences. This record helps reviewers understand how evidence supports conclusions about crypto holdings and security controls, rather than relying on a balance figure without its supporting trail.

A disciplined confirmation process makes third-party evidence more useful and its limits visible, strengthening financial reporting. Custodian statements, service auditor reports, and the entity’s own records each provide distinct evidence. Auditors evaluate them together, document gaps, and align further work with the risks those gaps create.

Audit assertions for digital assets

Audit assertions turn broad crypto risks into specific questions about reported amounts and disclosures. Accountants should link each significant account and relevant assertion to evidence and procedures. This matters because a wallet balance can be real even when ownership, completeness, or valuation remains unsupported.

For each digital asset, define the nature of the balance before selecting a test. A directly held token, an exchange claim, and a staking reward raise different questions. The assertions below help organize those questions and determine what evidence can address them:

• Existence: Does the reported asset exist at the reporting date? Compare recorded units with blockchain data or custodian evidence.
• Rights and ownership: Does the entity control the asset or hold enforceable rights to it? Examine wallet control evidence or third-party account records.
• Completeness: Have all relevant wallets, exchange accounts, and transactions been recorded? Trace activity from source records into the ledger.
• Accuracy and valuation: Are units and amounts recorded correctly using the applicable measurement method? Recheck calculations and supporting price inputs.
• Presentation and disclosure: Are balances classified and explained clearly in the statements? Compare disclosures with the asset’s nature and related risks.

Each assertion needs a procedure designed for its risk. A blockchain record can support the existence of assets at an address, but it doesn’t establish ownership on its own. A custodian statement may support an account balance, while reconciliation tests whether the ledger reflects that balance accurately. Crypto asset audit procedures are more persuasive when each workpaper states the assertion, risk, evidence, and conclusion.

Consider a reported staking reward. The auditor can inspect protocol records for evidence of receipt, trace the reward into the entity’s accounting records, and assess whether its nature is reflected appropriately. If the reward appears on-chain but not in the ledger, completeness is at issue. If the recorded units differ, accuracy requires further testing. One transaction can therefore raise several distinct assertion questions.

ISA 200 describes the auditor’s objective as obtaining reasonable assurance that financial statements as a whole are free from material misstatement, whether caused by fraud or error. Substantive procedures address misstatement risks at the assertion level through tests of details and analytical procedures. The auditor’s response should match the specific risk, rather than applying one generic test to every digital asset.

A strong conclusion follows a clear chain: identified risk, relevant assertion, procedure performed, evidence obtained, and documented result. If your team needs support aligning crypto records with audit evidence, discuss your audit requirements.

Block3 Finance: Tax Filing and Reporting

Block3 Finance supports businesses that need crypto-focused Tax Filing and Reporting alongside clear, audit-ready financial records. If wallet activity, valuation evidence, or custodian records are difficult to reconcile, its Audits and Compliance and Monthly Accounting services can help bring reporting processes into sharper order.

Turn to a Crypto Tax Accountant when digital-asset activity affects tax reporting as well as financial statements. Organized records help teams explain balances, transactions, and supporting evidence consistently, while accounting support can strengthen the foundation for an audit. The next step depends on where your reporting process needs attention.

Contact Block3 Finance to discuss your crypto accounting and audit needs.

Build Audit Readiness Into Your Operating Rhythm

A sound crypto reporting process shouldn’t begin when an audit request arrives. Make evidence design part of how your organization records decisions, assigns accountability, and prepares for change. This gives finance leaders a stronger basis for planning, evaluating new asset activity, and communicating with stakeholders without rebuilding records under pressure.

Use audit findings as operational insight, not merely a year-end checkpoint. Patterns in exceptions can reveal where responsibilities, documentation, or accounting workflows need refinement. Bringing finance and operations into the conversation early helps turn technical complexity into decisions leadership can act on. It also supports more focused internal planning as the business evolves.

For teams ready to strengthen their reporting foundation, crypto asset audit procedures can support ongoing financial discipline rather than remain a one-time exercise. Block3 Finance can help connect audit and accounting needs to the records behind them. Contact Block3 Finance to discuss the next step for your organization.

With a deliberate process, your team can approach future reporting cycles with greater clarity and control.

Frequently Asked Questions

What are the standard audit procedures for crypto assets?

Standard procedures begin by defining the audit scope and assessing where material errors or fraud could arise. Auditors then link relevant risks to assertions such as existence, completeness, ownership, and valuation. They may inspect records, test selected transactions, compare ledger balances with supporting evidence, and assess controls. For example, a transfer sample can be traced from the accounting entry to transaction records and then checked for authorization.

How do auditors verify the existence and ownership of crypto assets?

Auditors combine evidence that an asset exists with evidence that the entity controls it or holds rights to it. They can compare an address’s balance with blockchain records and use a signed-message test to demonstrate control without moving funds. Ownership also requires context: records should link the address to the entity, while exchange-held assets call for evidence tied to the entity’s account and custodian.

How do auditors test crypto asset balances on blockchains?

Auditors identify the relevant network and wallet address, then compare the recorded units with blockchain data for the reporting date. Historical records matter because the current balance may differ from the amount held at period-end. To strengthen the test, they can compare results from independent block explorers or run a node, then preserve the address, date, data source, and calculation so the result can be reproduced.

How are crypto assets valued and fair value measured for audits?

Auditors assess the method and market evidence used to measure an asset at the reporting date. They consider whether the selected price reflects relevant trading activity and whether thin trading makes observable prices less reliable. Under IFRS 13, thinly traded digital assets may require Level 2 or Level 3 fair value techniques. The audit work examines the inputs and assumptions supporting management’s chosen method.

What audit evidence is needed for exchange and custodian-held crypto assets?

Useful evidence can include account statements, transaction histories, reconciliations, external confirmations, and service auditor reports. Under ISA 505, auditors obtain external confirmations; ISA 402 addresses third-party service organisations. Evidence should relate to the account and reporting period being tested. For an omnibus exchange wallet, blockchain balances alone cannot establish an individual customer’s balance, so account-level records and reconciliation evidence are important.

How do auditors assess private key controls and wallet security?

Auditors examine how private keys are generated, stored, accessed, and used to authorize transactions. They assess whether permissions match approved responsibilities and whether key-management controls could be overridden. A signed-message test can demonstrate control of an address without transferring assets. For example, a review can compare documented access approvals with system permissions and investigate access changes that lack supporting authorization.

How do auditors evaluate crypto asset impairment, custody, and loss events?

Auditors assess impairment indicators by considering market trends, token usability, and the entity’s intentions. For a custody incident or reported loss, they can examine incident records, transaction histories, custodian correspondence, and recovery updates to establish what happened and which balances may be affected. They then evaluate how the event affects reported amounts and disclosures under the applicable accounting framework, documenting the evidence behind their conclusions.

Article by

Mahad Mohamed

Mahad Mohamed is an accountant and the CEO of Block3 Finance, with over 26+ years of Canadian and international tax and accounting experience. A crypto accounting specialist since the early days of Bitcoin, he has consulted for over 38 crypto companies and collaborated with legal professionals on regulatory matters. His expertise spans corporate reorganization, cross-border tax structuring (Canada & US), tax disputes, and CRA audits.
Previously, Mahad worked for the Canada Revenue Agency (CRA), Big4 accounting firms, and served as a Rulings Officer for the Federal Tax Authority of the UAE before acquiring Tax Partners in 2014.
Block3 Finance and Tax Partners has 44 full-time accountants and over 9,800+ clients.