Crypto accounting for auditors

Auditing crypto means proving existence, ownership, completeness, and valuation — usually from a client's messy exports. CryptaCount gives you the trail, the recalculation, and the on-chain verification to do it with confidence.

The crypto audit challenge

Crypto holdings are hard to audit: ownership lives behind wallet addresses, completeness spans many exchanges and chains, valuation depends on point-in-time pricing, and cost basis depends on a methodology you have to be able to test. Client spreadsheets rarely give you the evidence you need.

What CryptaCount gives the audit

• Complete, traceable trail. Every GL line drills down to the underlying transaction — assertion-level evidence for completeness and accuracy.
• Independent recalculation. Cost basis and gains are computed by a defined, testable method (12 supported), so you can re-perform and tie out.
• On-chain verification. Holdings and transactions tie back to on-chain data via our own infrastructure — supporting existence and ownership.
• Hashed records. Double-entry entries carry integrity hashing, giving you verifiable, tamper-evident records.
• Point-in-time valuation. Valuations sourced from our pricing engine, with the basis transparent.
• Exportable evidence. Pull the detail, reconciliations, and reports you need into your working papers.

Built around the assertions you test

• Existence / ownership — on-chain verification of addresses and balances
• Completeness — full ingestion across exchanges, wallets, and chains
• Valuation — transparent, point-in-time pricing
• Accuracy — independent, re-performable cost-basis calculation
• Methodology — the cost-basis method is explicit and consistent, not a black box; jurisdiction-mandated treatments (UK Section 104, Canada ACB) apply automatically

See the sub-ledger → · Compliance & reporting →

Why client crypto records rarely survive testing

When an auditor first receives a client's crypto records, the problem is usually not that the numbers are wrong — it is that they are unverifiable. A balance presented in a spreadsheet has no inherent link to the chain, a gain figure has no method behind it that can be re-performed, and a 'transfer' may or may not have been a disposal depending on a fact the working papers do not capture. The evidence chain that an audit depends on — from the financial statement line, through the ledger, to a verifiable source — simply does not exist in most client-prepared crypto files. CryptaCount exists to make that chain present and walkable, so the audit can test assertions against evidence rather than against a client's assertions about its own evidence. The structure is described on the crypto sub-ledger → page.

The distinction matters because crypto fails differently from cash. With a bank balance there is an independent third party to confirm; with a self-custodied wallet, existence and ownership have to be demonstrated from the chain itself, and completeness has to span every venue the entity touched. A record that cannot tie back to on-chain data, and cannot reproduce its own cost-basis figures, leaves the auditor reconstructing the population by hand — exactly the situation the sub-ledger is built to avoid.

The audit workflow CryptaCount supports

An auditor approaches crypto through the assertions, and the platform is organised so each assertion has a corresponding source of evidence. Existence and ownership are supported by on-chain verification of addresses and balances; completeness by full ingestion across exchanges, wallets and chains; valuation by transparent, point-in-time pricing; and accuracy by a cost-basis calculation that is defined, consistent and re-performable. Rather than asking the client to assemble evidence after the fact, the auditor works from a record that was built to be tested.

• Define the population — full ingestion across every venue gives a completeness baseline to sample from
• Tie to chain — addresses and balances verify against on-chain data for existence and ownership
• Re-perform cost basis — the method is explicit and testable, so gains can be independently recalculated and tied out
• Test valuation — point-in-time pricing is transparent, so the valuation basis can be inspected rather than taken on trust
• Trace any line — each GL figure drills to the source transaction and its hash for assertion-level evidence
• Export to working papers — the detail, reconciliations and reports pull out into the evidence file

Because every posted entry is double-entry and carries integrity hashing, the records are tamper-evident: a figure cannot be quietly altered without breaking the trail the auditor relies on. How the postings themselves are constructed is set out on the journal entries → page.

Independence and re-performance

The value of a sub-ledger to an auditor is that it makes re-performance possible. Cost basis and realized results are computed by a defined method rather than a black box, so the auditor can take the same population, apply the same method, and confirm the figures independently — the essence of substantive testing. Where a jurisdiction mandates a particular treatment, such as a pooling approach or an average-cost basis, that treatment is applied automatically and consistently, which means the auditor is testing against a stated, reproducible rule rather than a one-off calculation no one can explain. The method, the measurement policy and the classification decisions are all recorded, so a reviewer can see not just the number but the basis on which it was produced.

Valuation, completeness and the assertions

Valuation is often the hardest assertion in a crypto audit because price depends on a point-in-time source the auditor must be able to inspect. CryptaCount draws valuations from a point-in-time pricing basis that is transparent, so the auditor can see what was used and when, rather than accepting an opaque figure. Completeness is addressed at the ingestion layer: because the sub-ledger pulls activity across all connected exchanges, wallets and chains, the auditor has a defensible population to sample, and unexplained gaps surface as exceptions rather than hiding in a partial export. Existence and ownership rest on the on-chain tie-out of addresses and balances, which is the closest crypto analogue to a third-party confirmation. Together these give the auditor evidence aligned to the assertions actually being tested.

Reporting frameworks the audit touches

Audited entities are increasingly subject to structured crypto reporting, and the auditor needs the underlying data to be coherent with it. Frameworks such as the OECD's CARF, the EU's DAC8 exchange-of-information rules, and the MiCA regime are raising the bar for how crypto activity is recorded and disclosed. A complete, classified, traceable sub-ledger is the foundation those regimes assume, and it is also what lets the auditor reconcile what the entity reports under them to the books. Measurement under IFRS or US GAAP is applied in the sub-ledger per the entity's policy, so the auditor can test the measurement basis against a consistent rule — see crypto compliance reporting → and IFRS crypto accounting →.

Building the working-paper file from the sub-ledger

An efficient crypto audit depends on getting evidence out of the client's system and into the working papers in a form a reviewer can follow. Rather than asking the client to prepare bespoke schedules — which simply moves the reconstruction problem onto the engagement — the auditor can export the detail directly from the sub-ledger: the transaction population, the wallet reconciliations, the cost-basis workings, and the period reports that support each balance. Each exported figure carries its link back to the source transaction and its on-chain hash, so the trail from a number in the working papers to the underlying chain activity is preserved rather than severed at the point of export. That continuity matters when a file is reviewed months later or revisited in a subsequent year: a reviewer can re-walk the chain of evidence without the client's help, because the evidence stands on its own. The same exports support the documentation an audit file is expected to contain — the basis of valuation, the cost-basis method applied, the completeness of the population sampled, and the reconciliation of recorded balances to the chain. Because the sub-ledger applies its method consistently and records the policy behind each figure, the auditor is documenting a stated, reproducible treatment rather than reverse-engineering what the client must have done. The practical effect is a faster fieldwork cycle and a file that withstands second-partner and regulatory review, because the evidence was captured as the activity happened rather than assembled defensively at year-end.

Common pitfalls in crypto audit evidence

• Relying on client spreadsheets — re-keyed figures have no link to the chain and cannot be re-performed; insist on a record that ties to source
• No defined cost-basis method — a gain with no reproducible method behind it cannot be substantively tested
• Partial venue coverage — sampling from an incomplete population undermines the completeness assertion; the population must span every venue
• Self-transfers booked as disposals — internal wallet moves treated as sales overstate gains and distort the trail
• Opaque valuation — a price with no inspectable source cannot support the valuation assertion
• Editable records — figures that can be changed without trace are not audit evidence; integrity-hashed double-entry records are

How CryptaCount helps auditors

For an auditor, CryptaCount converts a client's crypto activity into testable evidence: a complete, traceable trail from each GL line to the source transaction and its on-chain hash, an independent and re-performable cost-basis calculation, transparent point-in-time valuation, tamper-evident records, and exports that drop straight into the working papers. It does not replace the auditor's judgment — it gives that judgment something solid to test, aligned to the existence, ownership, completeness, valuation and accuracy assertions the engagement turns on. Explore the crypto sub-ledger → and journal entries → to see how the evidence is built.

Can we sample from a defensible population?

Yes. Because the sub-ledger ingests activity across every connected exchange, wallet and chain, the recorded population reflects the entity's full footprint rather than a partial export. That gives you a completeness baseline to sample from, and unexplained gaps surface as exceptions rather than passing unnoticed.

How do we know a figure has not been altered after posting?

Entries are recorded as double-entry with integrity hashing, so any change to a posted figure breaks the trail. The records are tamper-evident by design, which means you are testing against evidence that cannot be quietly edited between your fieldwork and your sign-off.

Can we re-perform the cost-basis calculation ourselves?

Yes. The method is explicit and consistent rather than a black box, so you can take the same population, apply the same method, and independently recalculate gains to tie out. Where a jurisdiction mandates a specific treatment it is applied automatically, so you are re-performing against a stated rule.

What can we take into our working papers?

You can export the transaction detail, the reconciliations and the reports that support each assertion, so the evidence sits in your file rather than living only in the client's system. Each exported figure still traces back to its source, so the link from working paper to source is preserved.

What auditors get from a crypto sub-ledger

For an audit, the value of a crypto sub-ledger is evidence. Rather than a portfolio snapshot, you get a complete, reconciled record where every balance and every gain ties back to a source transaction, with a consistent measurement policy applied throughout. That is what lets you test completeness and accuracy, follow a figure from the financial statements down to the chain, and re-run a prior period and get the same answer. CryptaCount is built around that traceability — see the sub-ledger and journal entries it produces, and the compliance reporting it supports.