Impacts of Blockchain on the Auditing Profession

Blockchain’s disruptive effect is widely recognized in the financial sector, although the level of awareness in other sectors and their professions is still in its infancy. Elimination of intermediary activities (disintermediation) or transformation of these activities is expected to occur in all sectors of the economy.^{1, 2, 3} This is particularly well illustrated in the auditing field. The potential impact of the technology on audit practice and on the overall profession should be analyzed to help auditors reflect on the changes to come and acquire the proper skills to prepare for those changes.

Some people claim that blockchain is a hot topic that is going to fade, and others see it as a revolution comparable to the Internet. New articles appear daily in the press or on social media explaining the disruptive effects that blockchain will have on business models and the overall economy. Transparency, security, immutability and traceability are all features of blockchain. Blockchain’s main applications are in the financial field, with Bitcoin and Ether cryptocurrencies being the best known. Applications are currently being developed in other areas, such as insurance, international trade, healthcare and government services. In today’s debate about the disruptive effect of blockchain technology, audit and control professions are not in the spotlight; however, some specialists anticipate profound changes in their profession. These changes could be as significant as the changes that retail and travel professionals have experienced with the Internet.⁴

What Is Blockchain?

Blockchain technology is a distributed transactional database, a kind of general ledger or registry, in which transactions and details of these transactions (date, place, amount, anonymized participants and their encrypted signatures) are recorded and verified through consensus algorithms.⁵ Each completed transaction is encrypted, the involved participants are identified by a string of characters and, after a certain amount of time, the transaction becomes part of the block. A block is a group of transactions that is linked to the previous block, hence the term blockchain. It is then distributed to all parties associated with this network.⁶ Once a transaction is recorded on blockchain, it cannot be changed or canceled, which makes this technology both accurate and secure. from an auditing point of view, it provides a reliable audit trail where the authenticity and validity of transactions can be verified.

Unlike traditional databases, blockchain also allows for the immutable encoding of rules and procedures related to specific transactions in order to standardize activities; smart contracts are one example. These are stand-alone programs that, once started, automatically execute predefined conditions encoded within the blockchain. They work just like any conditional statement of the “if-then” type (if such a condition is satisfied, then such a consequence runs).⁷ With smart contracts, for example, it is possible to create an automated and transparent insurance system that compensates insured passengers after the cancellation of their flight. No form of human intervention is needed to process those transactions.

Thus, blockchain offers features—autonomy, decentralization, security and transparency—that are usually provided by trusted third parties such as notaries, financial intermediaries in international trade transactions or auditors. Ultimately, the use of blockchain could simplify or even replace the work of these trusted third parties. This phenomenon is known as disintermediation and is accompanied by cost savings and significant changes to the professions concerned. for example, using blockchain in auditing would facilitate access to customer data and increase the efficiency and effectiveness of an audit, thus reducing its duration, complexity and cost. It is not surprising, then, to imagine a commoditization of financial auditing, which is often perceived as a control dictated by law with no added value. It is in this context that, in 2016, a team of researchers from the Geneva School of Business Administration (HEG Geneva) obtained a research and impulse fund (RCSO) from the network of expertise of the University of Applied Sciences Western Switzerland (HES-SO) to conduct a study in Switzerland on the potential impacts of blockchain on the auditing profession. The research team interviewed 34 financial and IT auditors working in firms of different sizes (from small firms to Big 4 international firms) with levels of responsibility ranging from manager to partner.

Figure 1 presents the categorization of interviewees.

Findings show that 94 percent of the interviewees, regardless of their function (IT or financial) or their level of responsibility, anticipate changes in their jobs and professions.

Figure 2 shows the potential impacts that were identified by the interviewees and presented in this article.

From Financial Audit to Blockchain Audit via Information Systems

Sixty-two percent of interviewees believe that the audit profession will become more IT-oriented. They anticipate that the main objective of a financial audit will no longer be to ensure the regularity and sincerity of a company’s financial statements, but rather to review the information systems and, in particular, to ensure that the blockchain technology is properly set up and deployed. Indeed, as controls can be encoded into the technology and automated, and as the existence, accuracy and completeness of transactions can be guaranteed by the technology itself, some of the interviewees go even further and make the assumption that the auditor’s role will be to perform an in-depth blockchain source code and parameters review. As such, auditors would primarily be “IT engineer auditors,” whose function would be to certify the blockchain, instead of being financial auditors, whose role is to certify the financial statements of their clients, as it stands today.

A Growing Need for Technological Skills

Today, in most cases, when the IT environment is not complex, even if financial auditors are not IT experts and are not trained in auditing information systems, they perform IT audit work by following a predetermined audit program,⁸ as explained by the interviewees. However, blockchain technology, with its two main technical features—asymmetric cryptography and distributed systems—is a perfect example of a sophisticated technology. As a result, it is not well understood by most financial auditors and even by many IT auditors, as demonstrated by the answers obtained during the interviews. None of the participants has had any practical experience with blockchain, and none of them knows how to audit such technology. They point out that there is currently no blockchain-specific auditing standard and report a lack of personal experience with this technology, suggesting the need for audit firms to incorporate new skills. It is in this context that 82 percent of audit respondents believe that financial auditors and IT auditors, in practice or in training, need more in-depth technical and technological knowledge. fifty-three percent of the interviewees anticipate that to fully benefit from the advantages of new technologies and meet the needs of their clients, audit firms will have to hire more IT auditors as well as new profiles, such as analytical specialists, data scientists or even statisticians. This trend, if it is confirmed, will have two major impacts, first on the training of the auditors and then on the configuration and organization of the audit teams.

Indeed, the courses that are currently offered to candidates who want to become Certified Public Accountants (CPAs) are related to accounting, financial analysis and tax, or to IT auditing. However, if the role of auditors shifts from auditing financial data to auditing blockchain and certifying that it is correctly implemented, they will have to be able to understand the two main functions of blockchain (asymmetric cryptography and distributed systems). They will have to not only broaden their technical skills to master computer coding, hashing and cryptography, but also keep working on their soft skills such as communication. for example, if smart contracts that automatically execute predefined conditions in blockchain are used by auditees, auditors will first need to understand the underlying code and then be able to communicate clearly with lawyers to ensure that these contracts are legally valid. Moreover, as audit firms, especially large and medium-sized firms, use more intensively computer-based tools capable of processing and analyzing large volumes of data, they will have to recruit data scientists or train their auditors to properly analyze and interpret the data to meet auditing requirements. Therefore, it seems essential to review education programs to meet evolving needs.

In addition, the configuration of audit teams will change. In the future, teams will be led by an auditor with solid accounting and financial knowledge, in addition to computer skills, who will work closely with IT auditors and other kinds of specialists (i.e., accounting, tax, data visualization, blockchain, big data). However, scientific literature shows that the value of the IT auditor role in an audit is often poorly communicated and indirect ^{9, 10} and, in practice, the level of engagement between auditors and IT auditors is low,¹¹ whereas IT environments become more sophisticated¹² and more complex. If audit firms hire people with a wider range of skills, including more IT auditors, then the composition of audit teams will change. According to research conducted in the audit field,¹³ it seems important for the functioning of the teams to evolve toward a greater interaction, a better integration of IT audit work, and a smoother communication between financial and IT auditors on the one hand and other specialists on the other hand, to ensure that audits are of higher quality and as efficient and effective as the use of new technology seems to imply.

Productivity and Quality Gains...

Thanks to its characteristics, the use of blockchain will make it possible to automate audit tests, or at least facilitate them, thus reducing the duration of audits. for now, auditors confirm the accuracy of their clients’ data by reconciling the different sources of these data. The implementation of blockchain will make these reconciliations unnecessary because all transactions will be recorded on this single transactional distributed database. To look at another example, banks’ balances, customers’ balances and suppliers’ balances will no longer need to be confirmed, since the auditor, and possibly even the regulator, will have access to data from auditees and other participants in the blockchain in real time. Traceability and continuous monitoring can, therefore, be guaranteed. As a result, some audit-related tasks that are time consuming and discontinuous and that do not require specific technical expertise will disappear, generating productivity gains. As such, 65 percent of interviewees think they will be able to devote more time to value-added activities such as complex fair-value analyses or risk analyses, for which they will need to use their professional judgment, experience, expertise and particular knowledge (of an industry, for example). Thus, auditors will be able to provide better insights to their audit clients and even become their strategic business partners.

In addition, the use of other technologies such as data mining and data visualization allows auditors to analyze all of their customers’ data instead of performing sample-based tests, which increases the level of assurance achieved and thereby improves the quality of the audit. This will be reinforced by the use of blockchain, as auditors will have access to their customers’ data in real time. Auditors’ checks and reviews can, therefore, be done on a continuous basis using authenticated, traceable and immutable information.

Real-time auditing has the potential to enable auditors to be more effective, proactive, adaptive and forward-looking,¹⁴ meeting the expectations of investors and other stakeholders who would like the auditors to go beyond the pass/fail evaluation of the traditional financial audit report and make more meaningful recommendations¹⁵ and more sophisticated analyses. To date, auditing is a past-oriented activity that is intended to provide reasonable assurance that “the audited entity’s financial statements have been prepared in all material respects in accordance with a set of applicable accounting standards”¹⁶ in order to issue an audit opinion¹⁷ for a specified period of time. Through the use of blockchain and data analysis, auditors will be able to make new types of forward-looking analyses. Audit clients could then expect recommendations and strategic advice from their CPAs, which is not currently authorized by the US-based Public Company Accounting Oversight Board (PCAOB) and is limited by other national bodies, such as Expertsuisse in Switzerland. This situation could represent an ethical challenge for the profession, perhaps involving a complete redefinition of the role and the profession of auditors.

...That Will Impact the Organizational Structure of Audit Firms

As explained previously, some tests and tasks that do not require specific technical skills and that are currently performed by junior auditors will disappear in favor of analyses that require expertise and experience. Audit firms will, therefore, need more experienced professionals instead of juniors. The very pyramidal organizational structure of those entities, where there are fewer and fewer employees climbing up the hierarchy (junior, senior, manager, senior manager, partner), will be strongly impacted. Young accountants and other recent graduates currently start their careers as external auditors to gain exposure to a wide range of clients in terms of business sectors or organization size. They continue their training in the field under the coaching of more experienced auditors and, after a few years, they often leave the audit sector to take on new roles in the industry. However, it seems that this model is likely to diminish or even be reversed if, instead of recruiting juniors, accounting firms recruit more experienced profiles. In the future, recent graduates will first work in the industry to develop some expertise and then join an audit firm. This change in trends will encourage those firms to review their human resources policies marked by a high turn over.

More Adequate Audit Standards

It is important to note that 85 percent of audit respondents believe that auditing standards must evolve at two levels to better take into account new technologies, especially blockchain technology. first, more and more audit firms are using big-data-based IT tools, which allow them to analyze all transactions and all accounting records of an organization instead of using sample-based tests, as recommended by current audit standards. As a result, when audit firms use their capacity to analyze large volumes of data instead of doing sample-based tests, they get a higher level of assurance on the financial data (not on the quality of the internal control system), but they do not meet the requirements of current auditing standards. Therefore, audit companies end up in a paradoxical situation in which compliance with the existing auditing standard reduces the level of assurance that could be achieved through the full use of technology. Second, to date, no audit standard describes how to conduct an audit of blockchain.

The extent and rate at which international rules are changing relative to the growth of blockchain usage and other technologies such as data analysis and artificial intelligence remain unknown at this stage. Perhaps indicative is the fact that the International Auditing and Assurance Standards Board (IAASB) has initiated a working group called the Data Analytics Working Group (DAWG) to explore the growing use of technology in auditing, with a focus on data analytics. DAWG’s request for comments to audit professionals highlights the need for the IAASB to reflect the digital era in application guidance and advises DAWG members to consider other technologies, such as blockchain, which deserve further consideration.¹⁸ It is important to note that, to the best of current knowledge, the International Auditing Standards (IAS) do not remedy the lack of standards regarding new technologies, like blockchain. However, financial auditors already face the challenge of auditing enterprises active on blockchain or organizations that have set up blockchain platforms to execute some of their business processes. This situation forces them to use their professional judgment when auditing standards are nonexistent or inadequate.

Conclusion

With the increasing use of new technologies, blockchain in particular, it is in the interest of audit firms to think about what the audit of tomorrow will look like. The deployment of blockchain involves a paradigm shift of the auditing profession at two levels. first, the scope of the audit mission will shift from certifying the financial statements to testing the information systems and, more particularly, certifying the proper implementation of blockchain. As Andreas Toggwyler, Partner, EMEIA financial Services Advisory, Ernst & Young Ltd, pointed out in an interview,

Certifying the blockchain would allow us to stop performing tests that seek to confirm the existence, completeness, and accuracy of the transactions. However, it is important to keep in mind that blockchain would not replace the auditor’s professional judgment.¹⁹

Second, if authorized by the law and regulations, auditing, which has always been a backward-looking activity, could become a forward-looking strategic analysis and consulting activity based on the study of large volumes of data.

Finally, audit firms have to identify whether their audit teams have the skills needed to deal with potential changes in the profession. To date, the Big 4 have already invested in technologies such as data analysis software, and all of them have engaged blockchain-related projects. However, it appears that smaller audit firms have not begun to adopt these new technologies. In fact, 76 percent of the auditors interviewed who are not part of a Big 4 firm work for audit firms that have not started to investigate the subject. They are in a wait-and-see mode and hope that they will be able to catch up on any new developments when the time comes, which could be too late.

Endnotes

¹ Von Gunten, C.; M. Mainelli; “Chain of a Lifetime: How Blockchain Technology Might Transform Personal Insurance,” Long Finance, December 2014
² Schatsky, D.; C. Muraskin; “Beyond Bitcoin, Blockchain Is Coming to Disrupt Your Industry,” Deloitte Insight, 7 December 2015, http://www2.deloitte.com/insights/us/en/focus/signals-for-strategists/trends-blockchain-bitcoin-security-transparency.html
³ Swan, M.; Blockchain: Blueprint for a New Economy, O’Reilly Media, USA, 2015
⁴ Sheehan, K.; “The Ongoing Audit Transformation,” Accountancy Ireland, December 2017
⁵ Erbguth, J.; J. H. Morin; “Towards Distributed Trustworthy Traceability and Accountability,” earticle.net, 2016, p. 223-225
⁶ Smith, S. S.; “Blockchain, AI, and Accounting,” IFAC, 20 November 2017
⁷ Blockchain France, “Les applications prometteuses des smart contracts,” 28 January 2016, http://blockchainfrance.net/2016/01/28/applications-smart-contracts/
⁸ Axelsen, M.; P. Green; G. Ridley; “Explaining the Information Systems Auditor Role in the Public Sector Financial Audit,” International Journal of Accounting Information Systems, vol. 24, 2017, p. 15-31
⁹ Ibid.
¹⁰ Bagranoff, N. A.; V. P. Vendrzyk; “The Changing Role of IS Audit Among the Big five US-Based Accounting firms,” Information Systems Control Journal, vol. 5, 2000
¹¹ Janvrin, D.; J. Bierstaker; D. J. Lowe; “An Investigation of factors Influencing the Use of Computer-Related Audit Procedures,” Journal of Information Systems, vol. 23, no. 1, 2009, p. 97-118, http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.462.4775&rep=rep1&type=pdf
¹² Curtis, M. B.; J. Jenkins; J. Bedard; D. Deis; “Auditors’ Training and Proficiency in Information Systems: A Research Synthesis,” Journal of Information Systems, vol. 23, no. 1, 2009, p. 76-96, http://aaajournals.org/doi/abs/10.2308/jis.2009.23.1.79?code=aaan-site
¹³ Op cit Axelsen
¹⁴ Hoelscher, J.; “Taking the Lead on Blockchain,” Internal Auditor, March 2018
¹⁵ Gambier, A.; N. Jeffrey; “The Future of Audit,” IFAC, 16 May 2016, http://www.ifac.org/global-knowledge-gateway/audit-assurance/discussion/future-audit
¹⁶ Swiss Audit Manual, “Ordinary Control,” Expertsuisse, 2016
¹⁷ Ibid.
¹⁸ International Auditing and Assurance Standards Board, “Feedback Statement—Exploring the Growing Use of Technology in the Audit, With a focus on Data Analytics,” 2018
¹⁹ Toggwyler, Andreas (Partner, EMEIA Financial Services Advisory, Ernst & Young Ltd), interviewed by Nathalie Brender, Geneva, Switzerland, 16 December 2016