Evidence of wallet control in a US audit: answer the right assertion

2 hours ago

2 min read

Signing a message or making a small transfer can demonstrate technical capability. The audit question is broader: does that capability support the relevant assertion for the audited company?

Establish the engagement framework

Established rule. AS 1105 requires sufficient appropriate evidence in audits conducted under PCAOB standards. This article does not automatically extend those requirements to other engagement frameworks.

BECTRA illustration — Assessing rights before choosing an accounting classification.

Technical capability and rights may differ

BECTRA analysis. A person may hold keys for another entity. Conversely, a company may have economic rights without directly holding keys when custody is outsourced.

Explain what a test establishes: address access at a particular date, ability to dispose of the balance or attribution of that authority to the entity. One procedure does not necessarily answer all those questions.

Fictional example

A director authorises a demonstration transfer from a personal address also containing company funds. The test establishes signing capability, but not the company’s precise share or completeness of its holdings.

Methodological limit. Audit procedures and their extent require the auditor’s judgment. This article explains assertions rather than providing a mechanical audit programme.

BECTRA illustration — Transfer restrictions require a separate assessment of rights and measurement.

Examine how the evidence reaches the auditor

Established rule. AS 1105.10A addresses external electronic information provided by the company. It requires consideration of its source and processing, and testing of modifications or relevant controls. A company-processed blockchain export therefore raises reliability questions as well as assertion questions. Applying the requirement to a particular file remains the auditor’s judgment.

Conclusion

Useful evidence answers a defined question. Wallet control must be connected to the entity, rights and date rather than treated as comprehensive proof.