Research Highlights

What is Distributed Ledger Technology?

• Distributed ledger technology (DLT; also known as blockchain) is emerging in Canada and around the world as a potentially disruptive technology, with important ramifications in financial and record management.

How will DLT impact auditors?

• DLT is still immature and presents some risks as well as opportunities.
• The ultimate impacts on the audit profession are not clear but are expected to be substantial. Potential impacts on financial auditing include greater automation of financial controls, the emergence of “smart contracts” capable of generating financial transactions and the advent of “real-time” auditing. For performance auditing, possible implications will be derived from changes in the management of data and digital assets by audited organizations.
• Legislative auditors should be ready to take advantage of the opportunities that DLT could generate for them, such as being able to monitor real-time financial information and to follow an audit trail

Introduction

Distributed ledger technology is emerging as a potentially game-changing technology. First introduced after the global financial crisis in 2008 as the underlying technology of the crypto-currency known as Bitcoin, DLT was designed to eliminate the need for a trusted third party for online transactions.¹ The World Economic Forum’s Global Agenda Council on the Future of Software & Society identified the blockchain as one of six software and services megatrends shaping society.² CPA Canada has put this innovative technology on its radar screen and keeps abreast of developments, given its potential impact on the accounting profession.³ The Bank of Canada is also monitoring this technology.

Why is DLT a game changer?

A distributed ledger is essentially an asset database that can be shared across a network of multiple sites, geographies, or institutions. All participants within a network can have their own identical copy of the ledger. Any changes to the ledger are reflected in all copies within minutes, or in some cases, seconds. The assets can be financial, legal, physical, or electronic. The security and accuracy of the assets stored in the ledger are maintained cryptographically through “keys” and signatures to control who can do what within the shared ledger. Entries can also be updated by one, some, or all of the participants, according to rules agreed to by the network.⁴ The UK Government Office of Science has produced a five-minute video, that sums it up effectively.

The transactions recorded with DLT have the following characteristics:

• Transparent: Transactions are open and accessible to all participants.
• Distributed: The ledger is replicated and provided to all participants, thus making unilateral alterations impossible (because diverging versions are rejected).
• Synchronized: Every time a new transaction is added, all copies of the ledger are updated simultaneously.
• Secured: Complex cryptographic characteristics combined with the other attributes of blockchains (transparent, distributed, and synchronized) ensure that the blockchains are immutable (cannot be modified). They contain a built-in audit trail.

The technology underlying DLT is potentially disruptive because it solves a crucial problem that has faced the Internet since its inception: whether there is the capacity to trust others to execute transactions. So far, the solutions have always included third parties, with additional costs, delays, and inefficiencies.

Computers in a blockchain use an automated process to validate the format of the transaction record to be included in the next “block.” Once this “consensus” is reached, the information is recorded in a block. The full set of chained blocks forms a “ledger” referred to as the blockchain. Each computer in the blockchain network maintains a copy of the complete ledger, which is updated in real time as new blocks are created and validated.

As participants reach a consensus on the transaction, there is no need for facilitation by a trusted third-party intermediary. The blockchain-based “distributed trust” model stands in contrast to the centralized trust models used today to transact. For example, upon agreement, one participant could transfer digital currency (such as Bitcoin) to another participant across the blockchain network without using a bank.

Like all new promising technology, DLT has downsides and wrinkles that will have to be ironed out before it is ready for prime time. A recent example of DLT’s vulnerability was the June 2016 attack on the investor-directed venture capital fund The DAO that resulted in a loss of $70 million. Although not a failure of DLT per se, but rather of other software it was relying on, the attack showed that DLT is not foolproof if implemented without due diligence and prudence.⁵

Impact on the audit profession

The implications of DLT for audits are beginning to emerge. Everything we have learned about DLT indicates that it will be disruptive for auditors and will require some measure of adaptation.

For financial auditing, speculations range from the theoretical total removal of financial audit requirements due to the immutability of distributed ledgers to a complete integration of audit activities in the ongoing operation of blockchain-driven financial statements. The first scenario is contemplated in the paper disseminated by the Blockchain Supercluster (and sponsored by the Government of Canada):

“Consider the single impact of triple-entry accounting on government transparency and accountability. It’s entirely possible, for example, that the federal auditor general function could be replaced by real-time auditing on a new government blockchain platform. Rather than finding inappropriate expenses or waste a year later, such expenses could be nipped in the bud.” ⁶

On the other hand, the blockchain platform may present new business opportunities. The Big Four accounting firms have all formed working groups that are exploring the opportunities provided by DLT technologies.⁷

For performance auditing, possible implications include profound changes in the management of data and digital assets by audited organizations. This will necessitate a re-thinking of how and what evidence could be collected to reach conclusions at the level of assurance required by professional standards.

Opportunities for legislative auditors

• Enhancing their knowledge of business of entities audited. As stated above, there are multiple applications of DLT that are presently being developed specifically for government, such as tax collection, record management, voting, regulatory oversight, and identity management. Of course other generic applications related to financial management and accounting, supply-chain management, cybersecurity, trade, and so on, will be also be transferable to the public sector. Therefore, simply to understand how their auditees operate, legislative auditors will have to deepen their understanding of DLT and how it is used in audited organizations.
  
  
• Ensuring the proper implementation of DLT applications prior to their deployment. DLT is designed to eliminate third parties while ensuring instantaneous and secure updates of records. In that context, it is expected that the need for periodic financial audits will be greatly modified and possibly reduced. However, as shown by the DAO experience, DLT implementation can be vulnerable. Auditors could add considerable value by conducting IT audits that would address risks and ensure that proper and effective controls are implemented.
  
  
• Leveraging DLT capacity to deliver real-time financial information to provide timely assurance. Distributed ledger technology will enable auditees to monitor their processes continuously, supply an audit trail, and provide account analysis at the push of a button.⁸ In a DLT future, management could give a set of blockchain digital “keys” to external auditors that would provide unprecedented access to detailed, time-stamped information about all transactions. Such access will significantly affect an auditor’s approach to an audit.
  
  
• Developing a better capacity to use data analytics. Distributed ledger technology will intensify an already data-centric digital environment. Organizations using DLT could have a powerful new set of reporting tools, complete with full transaction visibility, to manage and communicate their financial condition. Legislative auditors will have to continue and even accelerate their efforts toward acquiring and using better and more comprehensive data analytics skills to match the growing quantity and complexity of data from the audited organizations.⁹  This will require the usual strategies already deployed in this area: hiring more experts, developing expertise among audit staff through training and professional certification, and staying on top of the information systems’ architecture and data holdings of audited organizations.