Does Blockchain Technology Use Increase Audit Risks?

If you spend any time reading business news, it’s nearly impossible to avoid headlines that tout the benefits of blockchain technology. Practical, working blockchain networks have been around since the introduction of Bitcoin in 2009, and many companies are using it to improve various aspects of their operations. After all, blockchain technology promises transparency, speed, and accuracy—what accountant wouldn’t appreciate more of those things?

Yet adopting any new technology comes with risks. While blockchain may be the technology of the future, companies implementing it must deal with the operational headaches that accompany this type of innovation.

Here are a few risks firms should be aware of before implementing blockchain technology:

• Existing accounting, supply chain, and enterprise resource planning systems may not be designed to handle the technology.
• Staff may lack expertise in blockchain features, like smart contracts, key management, or tokens.
• Blockchain and cryptocurrency laws and regulations vary greatly across jurisdictions and are evolving rapidly.

Auditors have also seemed to notice the increased risk that blockchain introduces. In recently published research, “Opportunities or Challenges? Audit Risk and Blockchain Disclosures in 10-K Filings,” DePaul University Professor Tawei (David) Wang, Ph.D., MBA, and his co-authors Feiqi (Freddy) Huang, Ph.D., (Pace University), and Ju-Chun Yen, Ph.D., (National Central University), examined the www.icpas.org/insight | Fall 20259 relationship between audit clients’ blockchain activities (including cryptocurrency related) and audit fees.

THE IMPACT OF BLOCKCHAIN ACTIVITIES ON AUDIT RISK

“We had a discussion with five professionals (both external and internal auditors) about auditing clients with blockchain activities, including cryptocurrency activities. The discussion was also about current adoption challenges and different risks or factors that may affect auditors’ assessment of risks,” Wang notes.

That discussion sparked an interesting insight. As noted in their research paper, “all five practitioners suggested that blockchain activities are likely to increase audit risk.” The reasons mentioned for this included the lack of official guidelines, immature technology, smart contract design, high fluctuation in the valuation of crypto assets, proof of ownership, inconsistent regulation across countries, smart contract management, digital wallet verification, and other cybersecurity issues.

These conversations provided the researchers with anecdotal evidence that the practical issues involved in adopting blockchain technology are a big concern for companies and auditors.

“The downside to implementing blockchain is that there’s an increase in audit risk due to the increase in inherent and control risks,” Wang explains. “Because of the features of blockchain activities, there’s also a need to better understand it when assessing the risks.”

COMPARING DISCLOSURE USE

To examine the impact of any perceived increase in audit risk, the researchers examined 10-K filings from 2013 to 2020 and used relevant keywords to separate companies into three groups: those that were currently implementing blockchain activities, those that were planning to do so, and those that made no mention of blockchain activities.

According to the data, the number of companies disclosing blockchain activities in their 10-K filings grew from three in 2013 to 72 in 2020 (there were no mentions of the relevant keywords prior to 2013). The researchers’ paper also notes that “blockchain activity disclosures are heavily concentrated in the business equipment industry (i.e., computers, software, and electronic equipment, 64.6 percent); followed by other industries (i.e., mines, construction, building management, transportation, hotels, bus services, and entertainment, 12.6 percent); and wholesale, retail, and services (8.7 percent).”

After controlling for factors known to affect audit fees (e.g., company size, market-to-book value of equity, return on assets, etc.), the researchers compared companies disclosing blockchain activities to those without such disclosures. Their research findings were exactly in line with the anecdotal evidence from their interviews: “In terms of economic significance, we find that audit fees are about 9.2 percent, or $89,850 higher for firms disclosing blockchain activities in 10-Ks.” The increase in audit fees was even higher for companies with greater involvement in blockchain activities, providing further support for the notion that increased blockchain activities would necessitate increased effort from external auditors.

Prior research into blockchain disclosures in United States Securities and Exchange Commission filings shows that the content of these disclosures can signal different types and levels of engagement with blockchain technologies. Knowing this, Wang and his co-authors examined whether there was a difference in audit fees for companies currently implementing blockchain versus those that were planning to do so. As noted in the researchers’ paper, “For companies that plan to engage in blockchain activities, the business risk may be lower than for those already implementing blockchain activities; the former may be confronted by the risk of failing to keep pace with new developments in the technology, whereas the latter may face a higher risk associated with blockchain systems and security.”

Once again, after controlling for factors known to affect audit fees, the researchers’ expectations were supported. Comparing companies with blockchain disclosures to those without, the data showed that audit fees were higher only for firm-years disclosing currently implemented blockchain activities and not firm-years disclosing planned or future blockchain activities. Similar to the first part of the study, this result was even stronger for companies with greater (current) involvement in blockchain activities. The researchers concluded that the higher audit fees in the overall data set were primarily driven by clients disclosing current engagement in high-intensity blockchain activities.

The researchers also found evidence that the increased audit fees weren’t driven by internal control issues. As the researchers noted, “clients engaging in blockchain activities or planning to do so are not more likely to disclose material weaknesses in internal controls over financial reporting.” This suggests that any perceived increase in audit risk is primarily driven by a rise in the perceived inherent risk of blockchain activities rather than an increase in perceived control risk.

Finally, the researchers explored the relationship between blockchain disclosures, audit fees, and auditor and client characteristics. They found that the greatest audit fee increases occurred when clients disclosed their current blockchain activities and whose auditors weren’t part of a Big Four firm, had a smaller office, had short audit tenure, or lacked industry expertise.

ARE FIRMS AT RISK?

Wang says that the takeaway from these findings for practitioners is clear: “Clients’ currently implemented blockchain activities are related to higher inherent risks. This is a bigger concern when the auditors don’t have enough resources or expertise to fully understand the implementation.”

Since emerging technologies may affect future audits in so many different ways, including additional risk assessments or even helping auditors perform their tasks differently, Wang notes that he and his colleagues have more research in progress on this front: “Our new studies have been investigating how artificial intelligence may support auditors in making better judgments and in transferring implicit knowledge.”

While the benefits of new technologies like blockchain are often touted (and realized), a complete analysis needs to include all the relevant costs. Research like this study’s shows that audit fee increases may need to be included in these costs, as these fee increases are even more pronounced when auditors lack technical expertise, industry specialization, or firm resources.

Overall, as blockchain adoption grows, both companies and auditors must prepare for the operational complexity and demands that come with it.

Related Content:

• Why Auditors Need to Think Like Litigators for Risk Management: When it comes to audit risk management, it’s not enough to focus on audit quality. Research shows it’s also critical to focus on what would happen if an auditor goes before a judge and jury.
• Can Social Media Enhance an Audit? Research examines how social media posts can help auditors understand a company’s financial health, risks, and future performance.