Auditing Mutual Distributed Ledgers (aka Blockchains)

1 Auditing Mutual Distributed Ledgers (aka Blockchains) A Foray Into Distributed Governance & Forensics November 2017 Auditing Mutual Distributed Ledgers Long Finance 1/37 Z/Yen Group, 2017 Auditing Mutual Distributed Ledgers (aka Blockchains) A Foray Into Distributed Governance & Forensics Professor Michael Mainelli Executive Chairman, Z/Yen Group Matthew Leitch Z/Yen Group Auditing Mutual Distributed Ledgers Long Finance 2/37 Z/Yen Group, 2017 Foreword We are thrilled to sponsor this much needed project to promote serious thinking about the creation of an international Auditing standard for Mutual Distributed Ledgers .

2 This is a very interesting challenge and one that has so far been almost entirely overlooked. The audit issues around multi-site, Distributed data storage and processing, controlled by sophisticated cryptographic means, are complex. To investigate them, the project team has combined desk research with their own expert knowledge of Mutual Distributed Ledgers and Auditing techniques. They also hosted a day-long symposium that gathered together experts to discuss the challenges and possible solutions.

3 It was an absorbing event that we were pleased to attend. The project work was carried out during September and October 2017 with financial support from DasCoin. We are pleased to share this final project report with you and hope that you find it helpful and inspiring. We intend for it to be an important contribution in an area that needs to be dealt with properly if the technology of Mutual Distributed Ledgers is to achieve its full potential. Michael Mathias Founder & CEO, DasCoin Auditing Mutual Distributed Ledgers Long Finance 3/37 Z/Yen Group, 2017 Contents Foreword.

4 2 Project Overview .. 4 The Symposium .. 5 Session 1 Auditing Distributed Ledgers .. 8 Applications Using Mutual Distributed Ledgers .. 8 Auditing .. 9 MDL Risk Assessment .. 9 Audit Tools and Techniques .. 12 Quantity Of Audit Work .. 14 Session 2 Auditing Distributed Data .. 15 Distributed Copies of the Data Store .. 15 Date Cut-Offs .. 15 Reconciling Differences .. 16 Evaluating Technical Designs .. 17 Distributed Controls Operated by People .. 18 Session 3 Auditing Distributed Smarts .. 20 Embedded Code.

5 20 Audit Aspects Of Smart Contracts .. 22 Quality Assurance for Code .. 22 Money Supply Algorithms .. 23 High-Tech Audit Techniques .. 24 Session 4 Auditing Consortium MDL 26 Consortium MDL Systems .. 26 Governance Needed .. 26 Other Potential Audit Issues .. 29 Suggestions for the Profession .. 31 35 Participants .. 36 Auditing Mutual Distributed Ledgers Long Finance 4/37 Z/Yen Group, 2017 Project Overview This project, Auditing Mutual Distributed Ledgers (MDLs, aka Blockchains), was commissioned by DasCoin in the summer of 2017.

6 Z/Yen s Long Finance project team reviewed the limited literature on the topic to produce four discussion papers that described the issues and explored some potential ways of addressing them. On 4 October 2017, Long Finance held a symposium to explore the discussion papers in the ornate Main Reception Room at Chartered Accountants Hall in London. The 28 participants had wide ranging backgrounds and interests. They included representatives from regulators, professional associations, external audit firms, technology companies, and academia.

7 This Report includes the background information chapters shown in Figure 1, along with a brief summary of the symposium discussions. The final chapter makes suggestions for the audit profession to address. Figure 1 The coverage of the background information chapters is linked to the main parts of an audit. Audit Planning & Risk AssessmentSession 1 Auditing Distributed LedgersSystems & Controls Audit ApproachSession 2 Auditing Distributed DataSession 3 Auditing Distributed 'Smarts'Session 4: Auditing Consortium Blockchain SystemsAccounting & Financial Statement Audit ApproachOther potential audit issuesAuditing Mutual Distributed Ledgers Long Finance 5/37 Z/Yen Group, 2017 The Symposium Background The 4 October symposium began by focusing on MDLs as multi-organisational databases with a super audit trail.

8 The relevant technology and approaches date back to the 1970s. Even smart contract concepts date back to LISP code, capable of writing code and then executing it itself. What is new is the increasing interest and confidence in deploying MDLs. MDLs with blockchains are not cheaper and not faster than a central database. The fundamental change is to the role of central third parties. Some relevant symposium points from the open discussion include: Trusted third parties are not eliminated by MDLs (though their functions are changed).

9 A rapid growth in MDL applications has not happened and is unlikely; steady growth is more likely. There will be multiple technologies for building MDLs, not a single dominant one. MDLs will be different for different applications, a high-speed internet-of-things ledger versus a payment system. Applications may well combine different MDLs, identity, transaction, documentation, and payment MDLs. MDL implementations are slow because technical complexity is higher (say, 10 times more difficult than a traditional database) and because multiple organisations are involved project complexity is higher (say, 10 times higher).

10 The result can be a project that is 100 times more complex than a simple database installation; and many organisations find simple database installations tough. MDLs are not necessarily anonymous; that depends on how they are designed. Mutual systems are not new. We (auditors) already rely on some systems that are not owned by anyone, such as email, and depend on other Mutual systems such as TCP/IP. Session 1 Auditing Mutual Distributed Ledgers The first discussion session was a broad introduction to the subject with participants making initial comments rather than getting into details of audit methods or technology.