Search

Blockchain consortia offer firms several advantages, including the ability to maintain a shared transaction ledger that is secure, verified, and agreed-upon by key business partners. While these benefits are largely derived from blockchain's distributed architecture, this same architecture poses challenges to auditors working to provide assurance on a technology owned, operated, and maintained across several firms' borders. Indeed, participating in a blockchain consortium transitions a firm from relying solely on its own IT infrastructure and processes, to being vulnerable to how other firms collectively maintain the shared ledger. As blockchain consortia grow and are used to process and record material transactions, members will require assurance that other members maintain the blockchain in a well-controlled manner. Given the complexities of auditing a distributed environment, this study proposes three design choices intended to improve the auditability of consortium blockchains. Practitioners then evaluate these designs and offer additional considerations/alternative paths forward. [ABSTRACT FROM AUTHOR]

We examine how an IT service provider's persuasive communication related to SOC2 report findings influences management's (i.e., user-entities') perceptions of the outsourced services. Within SOC2 reports, service providers can attempt to influence management's impressions of auditor-identified issues and, due to the report's limited audience, also follow up with management about these issues. Using dual-process theories of persuasion, we predict the type of persuasion used by a service provider in a SOC2 report (contend or concede), and its consistency with follow-up persuasive appeals (contend or concede), will influence management's perceptions of the services provided. In an experiment, only when the service provider first contends the auditor's findings does a follow-up concession (rather than contention) result in more favorable perceptions. Persuasion tactics also influence management's processing of risk factors, which impact their trust in the service. Thus, IT service providers' initial and follow-up persuasive communications influence management's assessment of SOC2 auditor-identified issues. Data Availability: Data used in this study are available upon request. [ABSTRACT FROM AUTHOR]

Blockchain brought about the potential for improved data reliability, but only when those data are the result of transactions that happen completely within a blockchain. The reliability of blockchain data is threatened when information is introduced from the outside world, such as when oracles are used to observe occurrences and provide this information to smart contracts. This specific threat to the reliability of blockchain data is known as the oracle problem. This study offers a working definition of blockchain oracles and argues that they should be viewed as service organizations under the auditing standards from the AICPA and PCAOB. The study then discusses risks associated with the oracle's function of collecting, storing, transforming, and transmitting information, and proposes control objectives for auditors to consider when evaluating the information provided by oracles. Finally, the study closes by discussing open questions the audit profession still needs to address with the oracle problem. [ABSTRACT FROM AUTHOR]

This case examines auditing implications of Bitcoin and blockchain, and is intended for either undergraduate or graduate auditing and assurance courses. Students are asked to engage in aspects of planning and risk assessment for the audit of an online retailer. The case provides an interesting setting in which to achieve the learning objectives of: (1) identifying risks of material misstatement, (2) linking risks of material misstatement to relevant financial statement assertions, (3) explaining changes in audit procedures for responding to risks, (4) understanding a financial statement auditor's use of service auditor reports, and (5) understanding management specialists and the role they play in an audit. The modular case can be used for in-class discussion or as an out-of-class assignment and requires minimal advance preparation by the instructor. The case may be assigned in part or in its entirety. Student responses indicate the case is interesting and offers a positive learning experience. [ABSTRACT FROM AUTHOR]