Your Auditor Will Not Sign Off on the Crypto Balances: What to Do Before Year-End

An auditor who will not sign off on your crypto balances is not being difficult. They are being correct, and the fix is usually available if you start before the year-end rather than after it.

The call tends to arrive in November. The audit started on time, the revenue testing went fine, the payables circularisation came back clean, and then the engagement reached the line on the balance sheet that says digital assets. Now it has stopped. The audit manager is asking for something the finance team does not recognise as a reasonable request, the finance team is sending screenshots, and both sides are becoming quietly convinced the other does not understand the subject.

Both sides are usually right about that. What follows is the translation, written from the auditor's side of the table, because the fastest way out is to understand precisely what they are stuck on.

What Your Auditor Is Actually Stuck On

An audit of any balance tests a small number of assertions. For an asset those are, roughly: does it exist, do you have the rights to it, is it valued correctly, and is the list complete. A bank balance satisfies all four cheaply, because a bank is a third party who will confirm in writing what you hold, and a bank statement is produced by someone with no incentive to help you misstate it.

A blockchain removes that third party. The balance is public and verifiable by anyone, which sounds like it should make the audit easier, and for existence it does. The problem is the other three.

Rights and control. An address holding 400 ETH proves that 400 ETH sits at that address. It proves nothing about whose ETH it is. Copying somebody else's address into a schedule is trivial, and a schedule of addresses prepared by management is precisely the kind of assertion the audit exists to test independently rather than accept. This is the assertion that stalls most engagements, and it is the one most finance teams are surprised by, because from the inside there has never been any doubt about whose wallets they are.

Completeness. Existence testing starts from your list and checks the items on it. Completeness runs the other way: it asks whether anything is missing from the list. A wallet nobody remembered, an exchange sub-account opened for one trade in March, a staking position, a bridged balance sitting on a chain the finance team does not follow. There is no equivalent of a bank confirmation that returns every account you hold, so completeness has to be built from the transaction history outward.

Valuation. Usually the most tractable of the three, but not automatic. It needs a documented price source, a documented time of day, a consistent treatment across assets, and the correct accounting model. Most crypto holdings are intangible assets under IAS 38 unless the entity is a broker-trader, in which case IAS 2 may apply, and the measurement consequences of that choice are significant. The IFRS Interpretations Committee agenda decision of June 2019 is still the reference point.

What Happens If It Stays Stuck

This is the part that tends to focus minds, because the common assumption is that an unresolved crypto balance delays the audit. It does not. It changes the opinion.

When an auditor cannot obtain sufficient appropriate audit evidence over a balance, they are required to consider the effect on their report. If the amount is material but not pervasive, the result is a qualified opinion: the accounts are fair except for the digital assets, with the reason stated in the report for anyone to read. If the digital assets are most of the balance sheet, which for a crypto-native business they usually are, the effect is pervasive and the result is a disclaimer of opinion. The auditor states that they were unable to form a view at all.

Either outcome is a public document filed with the Registrar of Companies. Banks read it. Acquirers read it during diligence and price it. Investors with information rights read it. If you hold a CASP authorisation, your supervisor reads it, and a qualification over client assets invites a question you would rather not be answering. A modified opinion is not a paperwork problem that gets tidied up next year; it sits in the filing history permanently.

Fix One: Reconcile the Ledger to the Chain

Before anything else can be tested, the ledger has to agree with the chain. In practice this means every wallet and exchange account in scope is identified, every movement in the period is pulled from the chain and the exchange APIs, each movement is matched to a journal entry, and the differences are investigated rather than plugged.

The breaks that come out of this are predictable: internal transfers booked as disposals, network fees never recorded, staking rewards accumulating with no entry at all, an exchange account that was funded and forgotten, and a handful of movements nobody can explain because the person who made them has left. None of these are unusual and none of them are fatal. They simply have to be resolved before an auditor can test anything, and resolving them is transaction reconciliation rather than audit work. An auditor cannot both prepare your records and express an independent opinion on them.

This is the step most commonly underestimated. A year of history across several chains, reconstructed in December, is a matter of weeks rather than days, and it is the precondition for everything below.

Fix Two: Prove Wallet Control Without Moving the Keys

The rights assertion is the one people assume is impossible to satisfy without doing something dangerous with the private keys. It is not. There are two accepted methods and neither requires exposing a key.

A signed message. The wallet signs a short piece of text supplied by the auditor, typically containing the entity name and the date so it cannot be reused. Anyone can verify the resulting signature against the public address. It demonstrates that whoever produced it holds the private key, and it moves nothing.

A nominal transfer on instruction. The auditor specifies a small amount, a destination and a moment, and the entity makes that transfer. Because the auditor chose the parameters and the timing, the transaction shows the entity could move the funds on demand. This is the fallback where the custody arrangement will not produce an arbitrary signed message, which is common with some institutional custodians and multi-party computation setups.

For assets held at an exchange or a custodian, neither method applies, because you do not hold the keys. That position is confirmed directly with the custodian, which is an ordinary third-party confirmation and carries the ordinary limitation: it is only as good as the counterparty's own records and controls.

The timing point matters more than any of the detail. Control is proven in the present tense. You can demonstrate today that you control a wallet, and that evidence is strong. You cannot demonstrate in March that you controlled a wallet the previous December if the keys have since been rotated, the custodian has changed, or the employee who held the hardware device has left. Every month of delay makes this harder and some of it eventually becomes impossible.

Fix Three: Bring in an Auditor's Expert Under ISA 620

The third fix is the one that resolves most engagements, and it is routine rather than exotic. ISA 620 covers the use of an auditor's expert: where the engagement team needs expertise in a field other than accounting and auditing to obtain sufficient appropriate evidence, they may engage a specialist while remaining solely responsible for the opinion.

Auditors do this constantly for property valuations, actuarial assumptions, and complex legal questions. Digital assets are the same pattern. The audit firm keeps the engagement, the client relationship and the opinion. The expert performs the on-chain examination, and the audit file records the expert's competence, capability and objectivity, the scope agreed in writing, and the findings in a form the engagement team can evaluate.

From the client's side this is usually the least disruptive route, because the auditor you already have does not have to be replaced. From the auditor's side it is a well-understood mechanism that their own quality reviewers will recognise. This is what our crypto audit support engagement is, and audit firms engage us on that basis as often as their clients do.

Where the engagement needs the full statutory audit rather than support to an existing one, that runs through statutory crypto audits with our ICPAC-licensed audit partner, who signs the opinion.

The Timeline for a December Year-End

Working backwards from a 31 December reporting date, and assuming you are reading this with the year-end still ahead of you:

• Now. Produce the complete inventory of wallets, exchange accounts and custodial positions. This single document is the most valuable thing you can create today, and it is the one that takes longest if you leave it.
• Now. Prove control of every self-custodied wallet on that list, while the keys and the people are where they are. This is the piece that decays.
• Before year-end. Reconcile the year to date and resolve the breaks, so December is a short exercise rather than a reconstruction.
• At year-end. Capture balances at the reporting date with the block heights and timestamps recorded, alongside the custodian confirmations.
• January. Hand the working papers to the audit team with the methodology documented, so their testing is evaluation rather than investigation.

If the year-end has already passed, none of this becomes impossible. It becomes more expensive, and some evidence degrades from proof to inference, which the auditor will weigh accordingly.

A Short Checklist to Take to Your Auditor

If you want to shorten the next conversation, arrive with answers to these:

• Which wallets, exchange accounts and custodial positions are in scope, and who confirmed the list is complete?
• For each self-custodied wallet, can you produce a signed message or accept an instructed transfer?
• For each custodial position, who will sign the confirmation and by when?
• Is the ledger reconciled to the chain for the full period, and what remains unexplained?
• What is the price source, the time of day, and the accounting model, and is it applied consistently?
• Has the engagement team decided whether it is using an auditor's expert, and if so, has scope been agreed in writing?

An auditor who cannot get comfortable is not an obstacle to work around. They are telling you, early and in writing, that your records do not currently support the numbers in your accounts. That is worth knowing in November, and considerably less pleasant to discover from a supervisor, an acquirer, or a bank.

How Ondology Labs can help: We are engaged by audit firms as an auditor's expert and by companies whose audit has stalled. That work is crypto audit support: wallet ownership verification, balances read from the chain, and working papers your audit file can carry. Where the books need to be tied to the chain first, that is transaction reconciliation, and where you need the full opinion, statutory crypto audits run with our ICPAC-licensed partner.

Related reading: How auditors verify crypto wallet ownership · Who needs a crypto audit in Cyprus · What a crypto audit costs in Cyprus