It depends on the blockchain model that is adopted. Blockchain is a very flexible tool that can be used differently in business models. When using blockchain to register financial transactions, auditors can assess and collect evidence more efficiently. However, this new trend of doing business is developing slowly.

Rami Alkhudary I agree with you, this trend is not widely adopted, but do you think that auditors will design a new and different audit plan to be suitable for auditing in case of using blockchain technology or they will increase their emphasis on the evaluation of the effectiveness of the related internal control system?

Hebatallah Abd El Salam Badawy This question is quite important. I think that there is no direct or general answer to this question.

The answer widely varies depending on the business model, objective, or industry (finance, logistics, etc.).

For now, I think that auditors will increase their emphasis on the evaluation of the effectiveness of related internal control systems even when using blockchain. This is due to the reason that blockchain does not fill the gap between the digital and physical worlds. Paperwork, for example, will be required at least for the coming twenty years.

Dear Hebatallah Abd El Salam Badawy

we touched your question during our last blockchain security paper which propose so-called individual accountability as security notion for (permissioned) blockchains and distributed ledgers (https://eprint.iacr.org/2020/386). The paper provides as case study an analysis of the prominent blockchain "Hyperledger Fabric" which cannot ensure accountability on some deeper levels in the protocol. While the paper does not analyze the accountability of transactions - which I guess is typically the main goal of an auditor - the approach can be applied to transactions as well.

However, to answer your question: our formalization shows that auditors (in the paper called "judges") can be part of blockchains to do their work. Indeed, auditors could leverage from blockchain infrastructures by automating checks and, e.g., implement (in the spirit of the paper) "judging procedures" which generate undeniable cryptographic evidence for misbehavior (if the judging procedure is correctly constructed). On the other hand, our approach allows off-band analysis to ensure accountability as well. However, both approaches have trade-off. Auditors using a blockchain framework to automate their work suffer from bugs in blockchain frameworks. Auditors using off-band analysis would have to "re-implement" all the necessary checks to validate data from the blockchain.

Cheers,

Mike

Dear Mohd Majid Akhtar

Thank you for your valuable answer. If we want to ensure that auditors can rely on the evidence related to Blockchain, we can put the internal control system and its effectiveness in the first place. As, if auditors evaluate control risk at a lower level, they can rely on the output of the system. Additionally, this can be partially achieved if the auditor is part of the Blockchain itself. What do you think?

Dear Mike Graf

Thank you very much for your helpful response. I totally agree with you that auditors are to be part of the Blockchain itself and can benefit from such technology in the collection and evaluation of evidence. My main emphasis is that auditors should place more emphasis on the internal control system; its security, accessibility, authentication ....etc, as they can rely on the system and its outputs if they can trust it. On the other side, if for example the system itself is not reliable or proven to be insecure, auditors can't rely on it or its outputs and we can say that this system is un-audible.

I appreciate your feedback and I wish you all the best.

Dear Mohd Majid Akhtar,

I agree with you that auditor's participation depends on whether this blockchain is a permissioned or a permissionless one.