1
00:00:02,505 --> 00:00:05,125
The Institute of Internal Auditors presents all
2
00:00:05,125 --> 00:00:06,565
things internal audit tech.
3
00:00:07,145 --> 00:00:08,765
In this episode, Dana Lawrence
4
00:00:08,905 --> 00:00:12,005
and Dal la Rubin Tanja discuss the complexities
5
00:00:12,025 --> 00:00:14,125
of auditing cryptocurrency in blockchain.
6
00:00:14,715 --> 00:00:16,365
They explore the unique challenges
7
00:00:16,425 --> 00:00:19,245
and opportunities these technologies offer internal auditors
8
00:00:19,625 --> 00:00:20,885
and share practical guidance
9
00:00:21,145 --> 00:00:23,005
for navigating this evolving landscape.
10
00:00:25,375 --> 00:00:27,135
Reuben, I am so excited
11
00:00:27,135 --> 00:00:28,215
to have this conversation
12
00:00:28,215 --> 00:00:29,495
with you. How are you doing today?
13
00:00:29,955 --> 00:00:30,975
I'm good. Thank you, Donna.
14
00:00:30,975 --> 00:00:32,375
And it's my pleasure to be here.
15
00:00:32,995 --> 00:00:34,775
So let's kick things off.
16
00:00:35,165 --> 00:00:39,135
What inspired your interest in, in exploring cryptocurrency
17
00:00:39,325 --> 00:00:40,695
with regards to internal audit?
18
00:00:41,475 --> 00:00:42,645
It's fascinating, uh,
19
00:00:42,745 --> 00:00:45,685
but also a bit overwhelming, uh, especially
20
00:00:45,685 --> 00:00:46,805
for internal auditors.
21
00:00:47,365 --> 00:00:50,965
I have seen organizations diving into blockchain, crypto,
22
00:00:51,185 --> 00:00:54,575
and even decentralized finance, uh, as they try
23
00:00:54,575 --> 00:00:56,015
to innovate and stay ahead.
24
00:00:56,315 --> 00:01:00,135
Uh, but with all this innovation comes a ton of new risks
25
00:01:00,795 --> 00:01:03,295
and, uh, complexities that are not part
26
00:01:03,295 --> 00:01:05,855
of traditional auditing frameworks, right?
27
00:01:05,885 --> 00:01:09,175
Yeah. Uh, for example, things like decentralized systems,
28
00:01:09,635 --> 00:01:10,975
uh, smart contracts
29
00:01:11,155 --> 00:01:14,895
and, uh, volatility of, uh, cryptocurrencies create
30
00:01:15,495 --> 00:01:18,335
challenges, uh, that require us as auditors
31
00:01:18,335 --> 00:01:19,535
to think differently.
32
00:01:20,035 --> 00:01:22,735
So, on top of that, the regulatory landscape, uh,
33
00:01:22,735 --> 00:01:26,375
around crypto is also continuously evolving.
34
00:01:26,915 --> 00:01:30,535
And so there's so much to keep up with, uh, these days.
35
00:01:31,545 --> 00:01:35,075
What are some of the challenges you see internal auditors
36
00:01:35,075 --> 00:01:38,875
facing when they're assessing activities related
37
00:01:38,895 --> 00:01:41,875
to digital assets, blockchain, cryptocurrency, et cetera?
38
00:01:42,615 --> 00:01:44,485
There are a lot of challenges still, Donna.
39
00:01:44,485 --> 00:01:46,085
I mean, I mean, it's, it's, it's, uh,
40
00:01:46,225 --> 00:01:49,925
the moment the technology becomes, uh, huge.
41
00:01:50,035 --> 00:01:53,405
Like, you know, the, this also comes together, uh,
42
00:01:53,405 --> 00:01:55,525
which is also huge in, in, in most cases.
43
00:01:55,985 --> 00:01:58,805
So the world of digital asset is so unique, uh,
44
00:01:58,805 --> 00:02:01,205
that it present some pretty distinct,
45
00:02:01,225 --> 00:02:02,685
uh, challenges for internal auditor.
46
00:02:02,905 --> 00:02:05,325
So maybe I can point out few of them.
47
00:02:05,425 --> 00:02:08,125
The key ones, uh, first itself is
48
00:02:08,305 --> 00:02:10,525
to understand the technology itself, right?
49
00:02:10,665 --> 00:02:12,285
Um, can, it can be a hurdle.
50
00:02:12,815 --> 00:02:14,925
Blockchain and cryptocurrencies, uh,
51
00:02:14,995 --> 00:02:18,205
operate very differently from traditional financial systems.
52
00:02:19,205 --> 00:02:21,625
Uh, so auditors need to grasp how they work
53
00:02:21,965 --> 00:02:24,105
to effectively evaluate risk and controls.
54
00:02:24,765 --> 00:02:28,265
Um, and it's not always easy to translate, uh,
55
00:02:28,335 --> 00:02:30,745
technical concepts like smart contracts
56
00:02:30,845 --> 00:02:34,945
or even decentralized finance, uh, into audit terms.
57
00:02:35,885 --> 00:02:38,425
Uh, then on top of then that there is a challenge
58
00:02:38,425 --> 00:02:40,665
of regulatory uncertainty, as I mentioned before.
59
00:02:40,725 --> 00:02:42,865
So digital assets are still relatively new,
60
00:02:43,855 --> 00:02:47,875
and the rules governing them very widely across, uh,
61
00:02:48,025 --> 00:02:50,635
regions, and they're constantly changing.
62
00:02:51,415 --> 00:02:54,275
Uh, I mean, as internal auditors, we need to keep up
63
00:02:54,275 --> 00:02:57,705
with this evolving landscape to ensure, I mean,
64
00:02:57,855 --> 00:03:00,085
invidia's case, our clients stay compliant.
65
00:03:00,225 --> 00:03:02,125
And, and that's not small task.
66
00:03:02,915 --> 00:03:04,255
And on top of that, as you know,
67
00:03:04,255 --> 00:03:07,095
Europe has its own regulatory framework, which is very new,
68
00:03:07,155 --> 00:03:09,535
and it's called markets Crypto Asset Regulation.
69
00:03:10,435 --> 00:03:14,815
And, um, the other jurisdictions like uk, us, Canada,
70
00:03:15,005 --> 00:03:18,375
Australia, Singapore, each other key financial markets
71
00:03:19,035 --> 00:03:20,495
are still figuring out how,
72
00:03:20,495 --> 00:03:21,855
what is the best course of action.
73
00:03:22,595 --> 00:03:25,215
Um, so you need to keep it, keep up with it,
74
00:03:25,275 --> 00:03:27,175
at least in your jurisdiction.
75
00:03:27,355 --> 00:03:29,415
Uh, I would say as, as internal auditors,
76
00:03:29,685 --> 00:03:31,655
another one I would say is cybersecurity.
77
00:03:32,035 --> 00:03:34,855
Um, I mean, digital assets are prime target for hackers.
78
00:03:35,765 --> 00:03:38,665
Uh, incidents like stolen private keys
79
00:03:38,725 --> 00:03:41,625
or compromised wallets can lead to massive losses.
80
00:03:42,365 --> 00:03:43,985
Um, and auditors have
81
00:03:43,985 --> 00:03:47,225
to evaluate whether there are good security measures are in
82
00:03:47,225 --> 00:03:48,945
place to protect these assets.
83
00:03:49,445 --> 00:03:51,145
And that often involves, uh,
84
00:03:51,145 --> 00:03:54,465
understanding highly technical safeguards.
85
00:03:55,085 --> 00:03:56,385
And then on
86
00:03:56,395 --> 00:03:58,225
after that, the valuation comes into
87
00:03:58,225 --> 00:03:59,385
play, which is also tricky.
88
00:04:00,085 --> 00:04:02,385
Uh, the cryptocurrencies are very volatile,
89
00:04:02,565 --> 00:04:05,665
and it makes it hard to assign a consistent value to them.
90
00:04:06,255 --> 00:04:08,265
There's a still debate ongoing, how
91
00:04:08,265 --> 00:04:10,385
to classify it from the accounting perspective.
92
00:04:11,235 --> 00:04:14,165
Then there's a challenge on the controls
93
00:04:14,185 --> 00:04:15,405
and, uh, governance.
94
00:04:16,065 --> 00:04:18,805
Uh, many organizations are still figuring out how
95
00:04:18,805 --> 00:04:21,205
to integrate digital assets into the operations,
96
00:04:21,825 --> 00:04:23,725
and auditors often find gaps in
97
00:04:23,725 --> 00:04:25,605
processes, policies, and controls.
98
00:04:26,305 --> 00:04:29,365
So I think staying curious, adaptable, maybe open
99
00:04:29,365 --> 00:04:32,845
to learning is, uh, important for internal auditors just
100
00:04:32,845 --> 00:04:35,405
to ensure these they can tackle these challenges.
101
00:04:36,425 --> 00:04:39,925
Mm-hmm. Yeah, it seems like there are a lot of challenges,
102
00:04:39,985 --> 00:04:42,045
but it also could be a great opportunity
103
00:04:42,105 --> 00:04:46,165
for internal auditors who really thrive on new technology
104
00:04:46,585 --> 00:04:48,905
and learning new information.
105
00:04:49,005 --> 00:04:50,945
So I think it, it could also be a cool
106
00:04:50,945 --> 00:04:52,065
opportunity career-wise.
107
00:04:53,055 --> 00:04:55,415
I wanna circle back to cybersecurity.
108
00:04:55,995 --> 00:04:57,855
Do you have any specific tips
109
00:04:58,315 --> 00:05:01,455
or auditing procedures that we can keep in mind,
110
00:05:02,415 --> 00:05:04,415
specifically thinking about cybersecurity
111
00:05:04,455 --> 00:05:06,815
controls with digital assets? So,
112
00:05:07,375 --> 00:05:10,165
Donna, uh, cyber security, as I said,
113
00:05:10,245 --> 00:05:11,765
like it's a massive concern when it comes
114
00:05:11,765 --> 00:05:13,765
to digital assets because mm-hmm.
115
00:05:14,315 --> 00:05:17,245
They're such a high value targets for hackers
116
00:05:17,245 --> 00:05:18,805
because of the value associated
117
00:05:18,805 --> 00:05:20,085
with cryptocurrencies, right?
118
00:05:20,745 --> 00:05:24,005
Uh, so recently I read an article, it was even in one
119
00:05:24,005 --> 00:05:28,805
of the I, which stated that 2.2 billion,
120
00:05:29,225 --> 00:05:31,165
uh, worth of that is in US dollars worth
121
00:05:31,165 --> 00:05:34,765
of cryptocurrency was stolen from various platforms in 2024.
122
00:05:34,945 --> 00:05:37,405
So I'm, I'm, I'm saying like a very recent number.
123
00:05:38,275 --> 00:05:39,655
So it's a key concern.
124
00:05:40,455 --> 00:05:43,335
I can point out some key risks, uh, maybe and, and, and,
125
00:05:43,335 --> 00:05:46,415
and how as internal audits we can tackle, tackle them.
126
00:05:47,175 --> 00:05:49,605
First, there is the risk of unauthorized access
127
00:05:49,665 --> 00:05:52,005
to wallets or private keys.
128
00:05:52,665 --> 00:05:55,565
Uh, for example, if someone gains access to these keys,
129
00:05:55,715 --> 00:05:58,310
they essentially control the digital assets, right?
130
00:05:58,385 --> 00:05:59,405
So, um,
131
00:05:59,625 --> 00:06:01,005
and there is no way to reverse
132
00:06:01,005 --> 00:06:02,245
transaction on the blockchain.
133
00:06:02,325 --> 00:06:03,885
I mean, that is the beauty of the blockchain.
134
00:06:04,025 --> 00:06:06,925
And, and, and of course, that is the con, uh, part
135
00:06:06,925 --> 00:06:07,925
of the blockchain as well.
136
00:06:08,505 --> 00:06:11,365
And, uh, auditors should prioritize assessing
137
00:06:11,365 --> 00:06:13,965
how pre private keys are generated, stored
138
00:06:13,985 --> 00:06:18,205
and access, uh, are they kept insecure, encrypted wallets,
139
00:06:18,865 --> 00:06:21,765
uh, or multisignature wallets in use, for example,
140
00:06:22,345 --> 00:06:24,245
and where multiple approvals are required
141
00:06:24,265 --> 00:06:26,205
for transaction like that.
142
00:06:26,465 --> 00:06:28,925
Um, and another big risk is phishing attacks.
143
00:06:29,125 --> 00:06:31,605
I mean, it's, it's there in the industry for sometime.
144
00:06:32,265 --> 00:06:36,125
Uh, hackers often trickle trick employees into giving up
145
00:06:36,125 --> 00:06:37,325
credentials or access.
146
00:06:38,005 --> 00:06:40,605
Auditors should review the organization's training programs
147
00:06:40,605 --> 00:06:44,445
to ensure, uh, employees are educated on these threats
148
00:06:45,145 --> 00:06:47,445
and, uh, assess incident response plans
149
00:06:47,445 --> 00:06:48,565
for handling phishing attempt.
150
00:06:49,215 --> 00:06:51,885
There is a risk of compromise platforms as well, like
151
00:06:52,405 --> 00:06:53,805
exchanges or custodial services.
152
00:06:54,465 --> 00:06:57,085
So, for example, if an organization use a third party
153
00:06:57,405 --> 00:07:00,765
provider to manage these assets, uh, I think auditors need
154
00:07:00,765 --> 00:07:03,485
to evaluate the due diligence performed on those providers,
155
00:07:03,635 --> 00:07:05,045
whether they're reputable,
156
00:07:05,145 --> 00:07:07,005
do they have strong security certifications,
157
00:07:07,005 --> 00:07:09,005
whether they have right protocols in place.
158
00:07:09,705 --> 00:07:11,725
And also, I can think of, for example,
159
00:07:11,725 --> 00:07:13,045
network security as well.
160
00:07:13,305 --> 00:07:17,045
Uh, digital assets are managed in environments, uh,
161
00:07:17,135 --> 00:07:19,845
where a breach could expose them to theft.
162
00:07:20,255 --> 00:07:23,405
Audit procedures here can include, like, for example,
163
00:07:23,405 --> 00:07:26,885
testing firewalls, uh, intrusion detection systems
164
00:07:27,145 --> 00:07:29,845
and monitoring controls to ensure
165
00:07:30,475 --> 00:07:33,445
anomalies are quickly identified and addressed.
166
00:07:34,045 --> 00:07:36,045
I mean, there are the things which you can do.
167
00:07:36,045 --> 00:07:39,485
For example, review access logs, uh, test the effectiveness
168
00:07:39,485 --> 00:07:43,365
of encryption protocols, verify u usual, some of the usual,
169
00:07:43,505 --> 00:07:44,965
uh, it controls like backup
170
00:07:45,145 --> 00:07:46,285
and recovery processes,
171
00:07:46,755 --> 00:07:48,725
even the incident response capabilities.
172
00:07:49,385 --> 00:07:51,885
So, uh, the moment the technology comes into play,
173
00:07:51,885 --> 00:07:55,325
there are a lot of things that needs to be done around, uh,
174
00:07:55,345 --> 00:07:58,325
to ensure that you're confident about the internal controls
175
00:07:58,465 --> 00:07:59,805
around the processes.
176
00:08:00,385 --> 00:08:02,955
Well, you've absolutely offered us some strong tips there.
177
00:08:03,775 --> 00:08:07,235
One thing that I think about is, anytime
178
00:08:07,995 --> 00:08:11,075
I am performing an audit, I do a, a risk assessment
179
00:08:11,215 --> 00:08:12,915
for planning to understand the scope,
180
00:08:13,415 --> 00:08:15,195
and then starting with the scope of services,
181
00:08:15,375 --> 00:08:17,995
you can apply some of those, uh,
182
00:08:18,025 --> 00:08:21,355
cybersecurity best practices to make sure that you know,
183
00:08:21,375 --> 00:08:23,035
you're, you have appropriate coverage.
184
00:08:23,725 --> 00:08:24,915
Let's pivot slightly
185
00:08:25,175 --> 00:08:28,995
and think about the evolving regulatory landscape.
186
00:08:29,585 --> 00:08:31,395
Depending on where you are in the world,
187
00:08:31,735 --> 00:08:34,995
you might have very different regulations governing
188
00:08:35,385 --> 00:08:38,315
what you can and can't do with regards to digital assets.
189
00:08:38,735 --> 00:08:42,635
In your opinion, how can we stay on top of
190
00:08:43,415 --> 00:08:45,555
the changes, the differences,
191
00:08:46,575 --> 00:08:49,435
and help our organizations stay in line
192
00:08:49,865 --> 00:08:51,395
with emerging regulations?
193
00:08:52,015 --> 00:08:54,275
And I'm gonna specifically call out Mika.
194
00:08:54,655 --> 00:08:55,655
So what are your thoughts?
195
00:08:56,675 --> 00:08:58,175
I'm glad you brought this up, Donna.
196
00:08:58,255 --> 00:09:01,495
I mean, this is a very, uh, it's something which is close
197
00:09:01,495 --> 00:09:03,495
to my profession, and we are continuously
198
00:09:03,495 --> 00:09:04,575
following this space.
199
00:09:05,155 --> 00:09:08,615
Uh, and I can speak from Mecca, which is, uh,
200
00:09:08,615 --> 00:09:09,935
Europe's specific regulation.
201
00:09:09,995 --> 00:09:12,855
And, uh, it's relevant to Malta, uh, where I'm based
202
00:09:13,795 --> 00:09:16,735
and countries hub for crypto businesses within the eu,
203
00:09:17,035 --> 00:09:18,335
uh, for last few years.
204
00:09:18,995 --> 00:09:22,375
Uh, for those less familiar, uh, Mika,
205
00:09:22,375 --> 00:09:26,215
which is the markets in crypto assets regulation, uh,
206
00:09:26,395 --> 00:09:29,015
is a comprehensive regulatory framework introduced
207
00:09:29,015 --> 00:09:31,335
by the European Union, with the intention
208
00:09:31,335 --> 00:09:34,335
of bringing clarity and consistency to the crypto sector.
209
00:09:35,125 --> 00:09:39,535
It's designed to cover everything from crypto asset issuers
210
00:09:39,915 --> 00:09:43,635
to service providers with the aim of fostering innovation,
211
00:09:44,015 --> 00:09:46,235
uh, while also ensuring investor
212
00:09:46,235 --> 00:09:47,555
protection and market integrity.
213
00:09:47,615 --> 00:09:49,995
So that's the basically whole idea about this.
214
00:09:50,455 --> 00:09:52,235
So, under me, for example,
215
00:09:52,295 --> 00:09:54,395
the crypto businesses operating in Malta
216
00:09:55,245 --> 00:09:59,465
and also even other new states, uh, will need to comply
217
00:09:59,465 --> 00:10:02,945
with, uh, some strict requirements such as licensing, uh,
218
00:10:02,965 --> 00:10:04,665
for crypto asset service providers.
219
00:10:05,325 --> 00:10:07,225
Uh, there should be enhanced transparency
220
00:10:07,245 --> 00:10:10,505
around white papers, port of issuers and,
221
00:10:10,725 --> 00:10:12,945
and robust governance frameworks as well.
222
00:10:13,765 --> 00:10:17,195
There are also specific provisions for consumer protection
223
00:10:17,195 --> 00:10:19,435
and market market abuse prevention as well.
224
00:10:20,025 --> 00:10:21,955
From internal auditor's perspective,
225
00:10:22,155 --> 00:10:25,475
I think Mika introduces a new layer of compliance.
226
00:10:25,495 --> 00:10:28,555
That's much, that must be one into the,
227
00:10:28,625 --> 00:10:30,915
they are traditional internal audit plans.
228
00:10:31,615 --> 00:10:33,915
Uh, I think staying informed is critical.
229
00:10:34,295 --> 00:10:35,475
Uh, and, and,
230
00:10:35,495 --> 00:10:39,075
and one way to do this is to maybe engage directly
231
00:10:39,075 --> 00:10:42,395
with resources provided by the local regulator, uh, in,
232
00:10:42,455 --> 00:10:43,715
in case of multi's, going
233
00:10:43,715 --> 00:10:45,515
to be multi financial services authority,
234
00:10:46,095 --> 00:10:48,715
who will oversee the meca implementation locally.
235
00:10:49,545 --> 00:10:51,435
From audit perspective, uh,
236
00:10:51,725 --> 00:10:54,995
there can be several things which can be done, uh,
237
00:10:55,175 --> 00:10:58,675
for example, to map the organization's activities
238
00:10:59,055 --> 00:11:00,315
to meca requirements.
239
00:11:00,615 --> 00:11:03,395
I'm, I'm referring to MIC A, it can contain regulation
240
00:11:04,015 --> 00:11:05,955
and then assess governance structures.
241
00:11:06,095 --> 00:11:08,675
For example, in Mica's case, uh, it, it,
242
00:11:08,695 --> 00:11:10,195
it emphasizes accountability.
243
00:11:10,255 --> 00:11:12,635
So auditors should ensure roles
244
00:11:12,735 --> 00:11:16,115
and responsibilities for compliance are clearly defined.
245
00:11:16,705 --> 00:11:19,275
Then, um, test the reporting mechanisms.
246
00:11:19,775 --> 00:11:21,755
Um, for example, in case of mica,
247
00:11:21,755 --> 00:11:24,155
it requires ongoing reporting to regulators.
248
00:11:24,855 --> 00:11:27,835
So auditors should evaluate whether these processes are
249
00:11:27,835 --> 00:11:29,595
robust, accurate, and timely.
250
00:11:29,935 --> 00:11:31,635
And also on top of that, there is, uh,
251
00:11:32,145 --> 00:11:33,595
risk management framework, right?
252
00:11:33,615 --> 00:11:36,995
So I think Mika demands that risk associated
253
00:11:36,995 --> 00:11:39,195
with crypto activities like operational market
254
00:11:39,195 --> 00:11:41,435
and cybersecurity risks, uh,
255
00:11:41,655 --> 00:11:43,555
are promptly identified and mitigated.
256
00:11:43,695 --> 00:11:46,995
But I would say generally all internal auditors should
257
00:11:46,995 --> 00:11:49,955
ensure that that proper risk manage frameworks.
258
00:11:53,045 --> 00:11:54,805
I mean, at the end of the day, um,
259
00:11:55,125 --> 00:11:58,125
a regulation gives guidelines for an operating framework,
260
00:11:58,545 --> 00:12:02,085
uh, which means the regulator has already considered
261
00:12:02,085 --> 00:12:03,445
certain risk aspects.
262
00:12:03,625 --> 00:12:06,885
So it makes intel auditors life a bit more easier
263
00:12:06,885 --> 00:12:11,205
because now we will now have a framework to operate within.
264
00:12:12,335 --> 00:12:15,355
So do you have any other tips to offer auditors
265
00:12:15,695 --> 00:12:18,795
to prepare the organizations for compliance
266
00:12:18,825 --> 00:12:20,315
with upcoming regulations?
267
00:12:20,805 --> 00:12:23,275
Definitely, I mean, it's, it's a critical topic as well.
268
00:12:23,275 --> 00:12:25,195
It's related to what we just spoke.
269
00:12:25,295 --> 00:12:27,315
Uh, I mean, preparation is key,
270
00:12:27,415 --> 00:12:29,675
not just from the compliance perspective,
271
00:12:29,815 --> 00:12:33,075
but also to position the organization
272
00:12:33,135 --> 00:12:35,755
as a credible player in the digital asset space.
273
00:12:36,505 --> 00:12:37,925
Uh, I think the first step,
274
00:12:37,925 --> 00:12:39,645
the auditors can consider a readiness
275
00:12:39,645 --> 00:12:40,765
assessment, for example.
276
00:12:41,105 --> 00:12:44,405
So this means evaluating the company's current operations,
277
00:12:44,665 --> 00:12:48,165
uh, policies and controls against the requirements
278
00:12:48,165 --> 00:12:49,285
set by the regulation.
279
00:12:49,865 --> 00:12:51,925
For example, under, uh,
280
00:12:51,925 --> 00:12:54,525
crypto asset service providers will need licensing,
281
00:12:54,825 --> 00:12:57,045
as I said, like, and there should be proper governance
282
00:12:57,205 --> 00:13:00,325
structures, and there should be transparent disclosures, so
283
00:13:01,005 --> 00:13:03,085
auditors can evaluate whether these are in place.
284
00:13:03,805 --> 00:13:05,445
I think on top of that, the auditors,
285
00:13:05,885 --> 00:13:08,565
internal auditors should also encourage the organization to
286
00:13:09,115 --> 00:13:12,725
establish and enhance the existing regulatory compliance
287
00:13:12,725 --> 00:13:15,365
framework to ensure they're in line with the,
288
00:13:15,505 --> 00:13:19,245
the expectations of the, uh, new regulatory requirements,
289
00:13:19,705 --> 00:13:22,245
and also to focus on data and reporting capabilities.
290
00:13:23,235 --> 00:13:26,125
Cybersecurity also ties into regulatory compliance,
291
00:13:26,265 --> 00:13:29,245
or auditors should ensure that digital asset custody
292
00:13:29,745 --> 00:13:31,645
and transaction processes are secure.
293
00:13:32,265 --> 00:13:35,605
For example, ika places emphasis on consumer protection,
294
00:13:35,605 --> 00:13:38,285
which includes safeguarding assets from
295
00:13:38,365 --> 00:13:39,965
unauthorized access or loss.
296
00:13:40,885 --> 00:13:43,085
I think another key area I would say is maybe
297
00:13:43,175 --> 00:13:44,645
staff training and awareness.
298
00:13:45,385 --> 00:13:47,735
These regulation introduce new requirements,
299
00:13:48,115 --> 00:13:51,595
and maybe not all employees are not familiar with, uh,
300
00:13:51,775 --> 00:13:54,115
so it's important to ensure that staff, uh,
301
00:13:54,115 --> 00:13:57,745
particularly the, those involved in compliance, uh,
302
00:13:57,885 --> 00:14:00,985
and maybe risk management to ensure that they know the, the
303
00:14:01,095 --> 00:14:03,465
what, what's, what's coming on their way.
304
00:14:04,185 --> 00:14:07,065
I would also say auditors should emphasize the importance
305
00:14:07,065 --> 00:14:09,185
of engaging with regulators maybe early.
306
00:14:09,965 --> 00:14:12,585
Um, so it's about building a relationship, uh,
307
00:14:12,585 --> 00:14:14,625
with the local regulator, uh,
308
00:14:14,725 --> 00:14:17,505
so they can gain some clarity on expectations,
309
00:14:17,515 --> 00:14:20,225
especially in areas where the regulation
310
00:14:20,225 --> 00:14:21,425
may be still evolving.
311
00:14:22,305 --> 00:14:25,845
So it's about turning compliance from a tick box exercise
312
00:14:25,985 --> 00:14:28,565
and maybe to convert into a strategic advantage
313
00:14:29,025 --> 00:14:30,765
for the organization's wider benefit.
314
00:14:31,045 --> 00:14:32,045
I would say.
315
00:14:32,495 --> 00:14:34,815
I love that with more
316
00:14:34,815 --> 00:14:37,775
and more people being interested in digital assets,
317
00:14:38,205 --> 00:14:42,375
potentially investing in cryptocurrency or,
318
00:14:43,195 --> 00:14:46,615
or other things ad exchanges or
319
00:14:46,615 --> 00:14:50,555
otherwise, we have seen some pretty epic failures,
320
00:14:50,555 --> 00:14:52,695
whether it's a hack or fraud
321
00:14:52,835 --> 00:14:55,055
or collapses of major exchanges.
322
00:14:55,715 --> 00:14:58,295
And I think back in 2022
323
00:14:59,115 --> 00:15:02,615
is when the IA first started demonstrating leadership
324
00:15:02,615 --> 00:15:03,615
around this topic
325
00:15:03,755 --> 00:15:05,615
and asking the question, why is there not,
326
00:15:05,995 --> 00:15:08,455
why is it not a requirement to have some sort
327
00:15:08,455 --> 00:15:09,575
of control testing
328
00:15:09,795 --> 00:15:13,815
or robust internal audit function at a large crypto exchange
329
00:15:14,285 --> 00:15:16,215
that has the ability to impact
330
00:15:16,275 --> 00:15:19,175
so many people if there is broader mismanagement?
331
00:15:20,275 --> 00:15:25,135
So the, I a recently has made some legislative proposals
332
00:15:25,535 --> 00:15:27,695
emphasizing that need, the need
333
00:15:27,695 --> 00:15:29,535
for stronger corporate governance at
334
00:15:29,535 --> 00:15:30,895
cryptocurrency exchanges.
335
00:15:31,865 --> 00:15:35,765
In your opinion, how can we effectively advocate
336
00:15:36,145 --> 00:15:39,565
for governance enhancements within the industry
337
00:15:40,105 --> 00:15:42,125
or within these specific organizations?
338
00:15:43,025 --> 00:15:46,845
That's really relevant and very timely question, Donna.
339
00:15:46,965 --> 00:15:49,605
I mean, especially with the increased scrutiny on
340
00:15:49,605 --> 00:15:52,525
cryptocurrency exchanges in recent years, the,
341
00:15:52,745 --> 00:15:55,805
the IAS proposal, I mean, came soon
342
00:15:55,805 --> 00:15:58,205
after the collapse of a cryptocurrency exchange, right?
343
00:15:58,785 --> 00:15:59,925
Um, I think first
344
00:16:00,025 --> 00:16:03,445
and foremost, uh, I would say internal auditors need
345
00:16:03,445 --> 00:16:05,685
to highlight the value of good governance
346
00:16:05,685 --> 00:16:06,885
to leadership and the board.
347
00:16:07,505 --> 00:16:09,365
Um, I think probably that's what even
348
00:16:09,945 --> 00:16:11,125
IA is trying to do here.
349
00:16:11,825 --> 00:16:13,405
Um, and, uh, I mean,
350
00:16:13,405 --> 00:16:16,685
strong corporate governance is not just about compliance.
351
00:16:17,345 --> 00:16:21,165
Um, it's about building trust, um, mitigating risks,
352
00:16:21,345 --> 00:16:24,325
and, uh, creating a sustainable framework for growth.
353
00:16:25,165 --> 00:16:27,005
I think by emphasizing the reputation
354
00:16:27,005 --> 00:16:31,285
and financial benefits, uh, of good governance, I mean,
355
00:16:31,285 --> 00:16:34,405
auditors can position these improvements as strategic
356
00:16:35,055 --> 00:16:38,725
priorities, uh, not just like, uh, regulatory obligations.
357
00:16:38,845 --> 00:16:43,735
I would say. Uh, I think then possibly internal auditors,
358
00:16:43,995 --> 00:16:47,415
uh, can start by evaluating the current governance framework
359
00:16:47,755 --> 00:16:51,695
within the exchanges or even, even even any organization.
360
00:16:51,725 --> 00:16:54,945
This means assessing key areas like the composition,
361
00:16:54,985 --> 00:16:57,945
independence of the board, uh, the adequacy
362
00:16:57,945 --> 00:17:00,665
of oversight mechanisms, and the clarity of roles
363
00:17:00,725 --> 00:17:01,745
and responsibilities.
364
00:17:03,035 --> 00:17:05,435
I think risk management frameworks are also very critical.
365
00:17:06,135 --> 00:17:09,115
Um, they should assess whether the organization has robust
366
00:17:09,185 --> 00:17:13,235
processes, uh, in place to identify, uh, measure
367
00:17:13,735 --> 00:17:16,845
and, uh, mitigate risks, especially those unique
368
00:17:16,905 --> 00:17:18,085
to crypto exchanges.
369
00:17:18,105 --> 00:17:20,725
So essentially, this will either come from a
370
00:17:21,355 --> 00:17:24,245
wide organization wide, uh, risk register,
371
00:17:24,345 --> 00:17:27,245
or even the independent risk assessment of the, uh,
372
00:17:27,485 --> 00:17:29,515
internal auditor in Malta.
373
00:17:29,755 --> 00:17:32,835
I mean, uh, I'm just giving Malta as an example here.
374
00:17:32,975 --> 00:17:35,475
Um, as soon as the operating licenses are granted
375
00:17:35,575 --> 00:17:39,595
for payment institutions, um, this can be, regardless
376
00:17:39,655 --> 00:17:40,875
of whether crypto is involved
377
00:17:40,875 --> 00:17:42,115
or not, um,
378
00:17:42,375 --> 00:17:44,915
an internal audit should be carried out on the governance
379
00:17:45,075 --> 00:17:47,435
structure and risk management processes within the first 12
380
00:17:47,435 --> 00:17:51,155
months of operation is even the regulatory.
381
00:17:51,335 --> 00:17:53,155
So, uh, picky about it.
382
00:17:53,175 --> 00:17:54,595
And, and they want, uh, uh,
383
00:17:55,045 --> 00:17:57,235
there should be like an internal audit done
384
00:17:57,235 --> 00:17:58,555
within that first 12 months.
385
00:17:59,175 --> 00:18:02,715
Uh, so, so there's like a, a, a very, uh,
386
00:18:03,235 --> 00:18:04,355
specific focus on this area.
387
00:18:05,315 --> 00:18:06,955
I mean, we should not forget that,
388
00:18:07,145 --> 00:18:10,155
that the internal auditors role is not limited
389
00:18:10,255 --> 00:18:11,475
to the assurance role, right?
390
00:18:11,535 --> 00:18:12,795
So it's beyond,
391
00:18:12,975 --> 00:18:15,915
and internal auditors can always wear advisory hats,
392
00:18:16,295 --> 00:18:18,555
so they can act as educators
393
00:18:19,215 --> 00:18:21,715
and advocates of governance as well, um,
394
00:18:21,845 --> 00:18:25,035
which is essentially what IE is trying to do in wider scale.
395
00:18:25,815 --> 00:18:27,465
Well, I appreciate your insight on that,
396
00:18:27,805 --> 00:18:31,905
and it's always difficult to have incidents like these,
397
00:18:32,055 --> 00:18:33,465
like I know we're alluding
398
00:18:33,465 --> 00:18:37,305
to the cryptocurrency exchange collapse of 2022 with regards
399
00:18:37,305 --> 00:18:41,575
to FTX, which, you know, it's very tough for a lot
400
00:18:41,575 --> 00:18:44,135
of people, even if they hopefully get their money back years
401
00:18:44,375 --> 00:18:45,695
later, years later.
402
00:18:45,695 --> 00:18:49,775
But I do think the silver lining is when we're speaking
403
00:18:49,875 --> 00:18:53,655
to organizations we're working with, we can show clearly,
404
00:18:54,395 --> 00:18:56,575
you know, we can point to what risks
405
00:18:57,095 --> 00:18:58,175
actually can end up happening
406
00:18:58,515 --> 00:19:01,815
and what, what outcomes can occur if we don't have
407
00:19:01,815 --> 00:19:03,375
that correct risk management.
408
00:19:03,595 --> 00:19:05,655
So I think the silver lining is,
409
00:19:05,655 --> 00:19:07,695
we have a clear example in talking points,
410
00:19:07,875 --> 00:19:10,055
so we can better inform our stakeholders,
411
00:19:10,695 --> 00:19:11,695
Definitely.
412
00:19:12,115 --> 00:19:16,805
Okay, let's think about how do we equip
413
00:19:17,445 --> 00:19:18,485
internal auditors to today
414
00:19:19,435 --> 00:19:23,865
with the technical knowledge they need around blockchain,
415
00:19:23,885 --> 00:19:26,625
around digital assets so they can do their work effectively.
416
00:19:27,135 --> 00:19:30,025
Because this is something I've also been very curious
417
00:19:30,165 --> 00:19:32,945
and passionate about for the last couple years, trying
418
00:19:32,945 --> 00:19:36,115
to sift through all things digital assets
419
00:19:36,215 --> 00:19:39,435
and figure out what is applicable to the world I operate in.
420
00:19:40,755 --> 00:19:42,805
This is something not just you, Dan,
421
00:19:42,905 --> 00:19:45,605
I'm in many internal audit that auditors are curious about,
422
00:19:45,605 --> 00:19:47,685
because it's true that blockchain
423
00:19:47,685 --> 00:19:50,485
and crypto platforms are quite technical, uh,
424
00:19:50,545 --> 00:19:53,005
and it can be seen daunting for auditors
425
00:19:53,225 --> 00:19:55,325
who came from a more traditional background, right?
426
00:19:55,345 --> 00:19:58,525
So traditionally, I mean, if you see the industry,
427
00:19:58,665 --> 00:20:00,845
you will find more accountants, uh,
428
00:20:01,465 --> 00:20:04,405
who is coming into internal audit, uh, than more people
429
00:20:04,465 --> 00:20:06,205
who are like techno technically
430
00:20:06,485 --> 00:20:07,565
advanced or technical experts.
431
00:20:08,465 --> 00:20:11,245
Uh, but the good news, um, is, is
432
00:20:11,245 --> 00:20:14,165
that while auditors don't need to become blockchain experts,
433
00:20:14,945 --> 00:20:18,285
uh, they do need to have, uh, some basic understanding
434
00:20:18,745 --> 00:20:20,085
how these technologies work
435
00:20:20,625 --> 00:20:23,765
to effectively assess digital asset, uh, operations.
436
00:20:24,015 --> 00:20:25,845
Think of it this way, for example,
437
00:20:26,045 --> 00:20:28,005
auditors should be like translators.
438
00:20:28,705 --> 00:20:32,165
Uh, they don't need to be coders or developers, uh,
439
00:20:32,305 --> 00:20:36,485
but they need enough knowledge to understand the risks
440
00:20:36,785 --> 00:20:40,245
and, uh, controls that are unique to digital assets.
441
00:20:40,785 --> 00:20:42,605
Uh, for example, they should know
442
00:20:42,665 --> 00:20:44,845
how transactions are recorded on the blockchain,
443
00:20:45,025 --> 00:20:48,365
how wallet work, and what smart contracts are.
444
00:20:49,325 --> 00:20:51,615
This foundational knowledge will help, uh,
445
00:20:51,695 --> 00:20:55,455
auditors understand what's happening behind the scenes, uh,
446
00:20:55,755 --> 00:20:58,295
and uh, allow them to ask the right questions.
447
00:20:59,085 --> 00:21:02,345
Uh, for instance, when reviewing the security
448
00:21:02,365 --> 00:21:05,105
of crypto wallets, auditors need to know the difference
449
00:21:05,105 --> 00:21:06,225
between hot wallet
450
00:21:06,405 --> 00:21:08,665
and cold wallets, which are whether it's connected
451
00:21:08,665 --> 00:21:10,475
to internet or not, uh,
452
00:21:10,475 --> 00:21:12,235
because the risk profiles are different here.
453
00:21:12,575 --> 00:21:14,995
Uh, similarly understanding the concept of, uh,
454
00:21:15,275 --> 00:21:18,195
consensus mechanisms like proof of work or proof of stake.
455
00:21:18,955 --> 00:21:21,375
So this can help auditors evaluate the integrity
456
00:21:21,375 --> 00:21:22,575
of blockchain networks.
457
00:21:23,205 --> 00:21:26,665
That said, uh, I think auditors don't have
458
00:21:26,665 --> 00:21:28,865
to do the deep technical analysis themselves.
459
00:21:29,095 --> 00:21:31,705
They can work with technical experts, uh, whether
460
00:21:31,705 --> 00:21:33,145
that's in-house specialist
461
00:21:33,165 --> 00:21:35,825
or external consultants to assess specific risks.
462
00:21:36,575 --> 00:21:40,305
What auditors do need is the ability to identify areas
463
00:21:40,375 --> 00:21:42,425
that require more technical review
464
00:21:42,925 --> 00:21:46,185
and to communicate effectively, uh, with those experts.
465
00:21:46,865 --> 00:21:50,185
I mean, ultimately, auditors need enough technical knowledge
466
00:21:50,185 --> 00:21:51,225
to ask the right questions
467
00:21:51,225 --> 00:21:53,905
and make informed judgements, uh, about risks.
468
00:21:54,525 --> 00:21:57,265
If they feel out of their depth, they should collaborate
469
00:21:57,265 --> 00:21:58,945
with the technical experts, uh,
470
00:21:58,945 --> 00:22:00,465
who can dive into the details,
471
00:22:00,915 --> 00:22:03,985
which ensures the whatever the internal audit engagement
472
00:22:03,985 --> 00:22:06,025
that they're, that we're carrying out is, uh,
473
00:22:06,055 --> 00:22:08,225
both comprehensive and also credible.
474
00:22:09,635 --> 00:22:13,135
As digital asset technology continues to evolve,
475
00:22:13,725 --> 00:22:17,055
what trends should we, as internal auditors be ready
476
00:22:17,075 --> 00:22:18,295
for in the near future?
477
00:22:19,005 --> 00:22:20,295
What are you predicting for
478
00:22:21,715 --> 00:22:22,715
Us? So, Donna, with
479
00:22:22,715 --> 00:22:24,575
how quickly cryptocurrency
480
00:22:24,635 --> 00:22:26,775
and blockchain technology are evolving, um,
481
00:22:26,905 --> 00:22:29,495
there are definitely some key trends
482
00:22:29,495 --> 00:22:31,815
that internal auditors need to be ready for.
483
00:22:32,515 --> 00:22:36,175
One trend that's already taking shape is the increased focus
484
00:22:36,175 --> 00:22:37,495
on regulation and compliance.
485
00:22:37,635 --> 00:22:39,855
We spoke about it. I mean, we're seeing governments
486
00:22:40,015 --> 00:22:42,535
around the world, including the EU with ika,
487
00:22:42,885 --> 00:22:44,895
tighten their grip on crypto space
488
00:22:45,195 --> 00:22:47,975
to ensure investor protection and financial stability.
489
00:22:48,155 --> 00:22:50,575
So auditors will need to stay on top
490
00:22:50,575 --> 00:22:52,055
of these regulatory developments,
491
00:22:52,475 --> 00:22:55,175
not just in their local jurisdiction, uh,
492
00:22:55,175 --> 00:22:56,455
but I would say even globally.
493
00:22:57,195 --> 00:22:59,735
Uh, that's because as the cross border nature
494
00:22:59,755 --> 00:23:01,055
of crypto means,
495
00:23:01,495 --> 00:23:04,175
compliant frameworks are often usually interconnected.
496
00:23:04,275 --> 00:23:07,335
So it's not limited to your jurisdiction anymore.
497
00:23:07,965 --> 00:23:09,655
Another trend is integration
498
00:23:09,655 --> 00:23:11,815
with the traditional financial systems.
499
00:23:12,625 --> 00:23:15,525
Uh, you can see the major banks now adapting
500
00:23:15,625 --> 00:23:18,325
cryptocurrencies into their books, um,
501
00:23:18,625 --> 00:23:20,645
and it's becoming more mainstream.
502
00:23:20,745 --> 00:23:23,765
So we will see, uh, more integration
503
00:23:23,765 --> 00:23:26,245
between the crypto world and the traditional banking
504
00:23:26,265 --> 00:23:27,485
and financial services.
505
00:23:28,495 --> 00:23:31,035
Uh, this could include everything from, uh,
506
00:23:31,125 --> 00:23:34,235
banks offering crypto products to crypto exchanges,
507
00:23:34,655 --> 00:23:37,395
and collaborating with established financial institutions.
508
00:23:38,435 --> 00:23:41,335
Uh, I think for auditors, this means needing
509
00:23:41,335 --> 00:23:44,295
to assess the risk associated with such integrations,
510
00:23:45,225 --> 00:23:46,805
things like counterparty risk
511
00:23:46,945 --> 00:23:48,965
and liquidity risk, um,
512
00:23:49,255 --> 00:23:51,205
which may be the risk profile will change.
513
00:23:51,465 --> 00:23:54,045
So I think the internal auditor should be ready for that.
514
00:23:55,085 --> 00:23:57,455
Then if you think about the technology,
515
00:23:57,475 --> 00:23:59,855
the underlying technology, which is blockchain, uh,
516
00:23:59,885 --> 00:24:02,495
this adaptation is also moving into new sectors,
517
00:24:02,915 --> 00:24:04,255
not just financial sector.
518
00:24:04,435 --> 00:24:07,135
So we're already seeing blockchain being used
519
00:24:07,155 --> 00:24:10,735
for things like supply chain traceability, uh, digital
520
00:24:11,255 --> 00:24:12,815
identity management, and even,
521
00:24:13,285 --> 00:24:15,095
even I have seen it in voting systems.
522
00:24:15,675 --> 00:24:17,255
So, because, because it's,
523
00:24:17,255 --> 00:24:19,135
it's much more secure when it comes to voting, right?
524
00:24:19,135 --> 00:24:23,855
So, uh, and for auditors, this means gaining familiarity
525
00:24:24,435 --> 00:24:28,055
and, uh, with how blockchain can improve operations, uh,
526
00:24:28,055 --> 00:24:29,375
across different industries.
527
00:24:30,275 --> 00:24:31,775
As we spoke earlier, I'm,
528
00:24:31,995 --> 00:24:33,895
I'm also seeing a rise in the importance
529
00:24:33,895 --> 00:24:36,495
of cybersecurity within the crypto space.
530
00:24:36,865 --> 00:24:38,135
Since the value goes up,
531
00:24:38,135 --> 00:24:41,015
they are becoming even more attractive for hackers, right?
532
00:24:41,555 --> 00:24:44,295
So, uh, auditors need to focus on cyber threats
533
00:24:44,475 --> 00:24:45,815
and the security measures.
534
00:24:46,905 --> 00:24:49,225
Probably the last part is going to be a bit more, uh,
535
00:24:49,265 --> 00:24:51,265
unspoken, but there I see the awareness,
536
00:24:51,315 --> 00:24:53,785
which is the environmental impact of crypto mining
537
00:24:54,085 --> 00:24:55,625
and may become a bigger topic.
538
00:24:55,885 --> 00:24:59,465
Uh, and, uh, as proof of work mining continues
539
00:24:59,465 --> 00:25:02,945
to draw attention towards its energy consumption.
540
00:25:03,245 --> 00:25:05,225
Uh, we could see more regulations
541
00:25:05,245 --> 00:25:08,185
and pressures to make crypto mining more sustainable.
542
00:25:09,565 --> 00:25:11,965
I think auditors should be prepared
543
00:25:11,985 --> 00:25:14,645
to assess an organizations environmental impact,
544
00:25:15,255 --> 00:25:19,035
and whether it's aligns with evolving any G standards.
545
00:25:20,035 --> 00:25:24,205
It's so fascinating to me how much power is used
546
00:25:24,585 --> 00:25:27,285
for technology in the region I live
547
00:25:27,285 --> 00:25:28,565
in, in the United States.
548
00:25:28,995 --> 00:25:30,725
There's a lot of conversation around
549
00:25:31,535 --> 00:25:34,205
farms being turned into data centers.
550
00:25:35,065 --> 00:25:36,565
Uh, it's Wild. So,
551
00:25:37,375 --> 00:25:41,355
No, I mean, it's, uh, it's, uh, we need to speak about it,
552
00:25:41,375 --> 00:25:44,555
but like, I think everybody's focused on the,
553
00:25:44,695 --> 00:25:47,435
the financial turnout, which is blockchain is,
554
00:25:48,335 --> 00:25:50,795
and we're forgetting that part actually. Mm-hmm.
555
00:25:51,475 --> 00:25:54,725
When you were talking about future predictions
556
00:25:54,745 --> 00:25:57,525
and trends, an idea popped into my mind,
557
00:25:57,745 --> 00:26:00,725
and that was, do you think we'll ever get to a point in time
558
00:26:00,855 --> 00:26:04,645
where we can buy a cup of coffee with Bitcoin
559
00:26:04,985 --> 00:26:07,125
or crypto at a point of sale?
560
00:26:08,895 --> 00:26:10,205
Definitely. I think it's,
561
00:26:10,325 --> 00:26:12,125
I I think they're not so far from that.
562
00:26:12,625 --> 00:26:16,325
Uh, and I'm seeing right now there are a number of payment,
563
00:26:16,505 --> 00:26:20,045
uh, uh, platforms, uh, licensed in across Europe
564
00:26:20,215 --> 00:26:24,975
where you can payments by, uh, Bitcoin, not just Bitcoin,
565
00:26:25,005 --> 00:26:27,815
even, even even other coins, like I can quote one
566
00:26:27,815 --> 00:26:29,375
of the famous one, which is a called re.
567
00:26:29,645 --> 00:26:33,375
Basically, if you want to pay someone instead
568
00:26:33,495 --> 00:26:36,015
of transferring it, it has like a fi currency.
569
00:26:36,195 --> 00:26:39,375
You can it as a, uh, uh, one of the coins
570
00:26:39,515 --> 00:26:41,215
or one of the digital assets.
571
00:26:41,275 --> 00:26:43,645
So it's, it's live, it's happening, it's
572
00:26:43,645 --> 00:26:44,645
Happening. It's
573
00:26:44,645 --> 00:26:46,365
gonna come into mass scale very soon.
574
00:26:46,425 --> 00:26:48,485
The, the day where McDonald's
575
00:26:48,485 --> 00:26:51,725
or, uh, KFCO of pizzas, uh, is, is,
576
00:26:51,745 --> 00:26:54,605
is gonna accept cryptocurrency as a payment.
577
00:26:54,795 --> 00:26:56,085
It's, it's not so far away.
578
00:26:56,465 --> 00:26:58,885
So when I see that in the news, I'm gonna think back
579
00:26:58,885 --> 00:27:01,925
to this conversation on January 9th, 2025,
580
00:27:02,145 --> 00:27:04,245
and just laughed to myself, like we called it.
581
00:27:06,475 --> 00:27:09,685
Okay. Let's say you work for an organization,
582
00:27:10,705 --> 00:27:11,805
you're an internal auditor,
583
00:27:12,305 --> 00:27:16,805
and you find out that they want to adapt cryptocurrency.
584
00:27:16,935 --> 00:27:18,445
Maybe they're gonna invest in it,
585
00:27:18,785 --> 00:27:21,205
or they're gonna create a blockchain project.
586
00:27:22,615 --> 00:27:27,125
What should you do as an internal auditor to help make sure
587
00:27:27,125 --> 00:27:29,885
that that is set up in a responsible way?
588
00:27:31,265 --> 00:27:34,935
Donna, this is, this really gets to the heart of
589
00:27:34,995 --> 00:27:37,455
how internal auditors can add value, right?
590
00:27:37,455 --> 00:27:42,175
Exactly. So, uh, I think as cryptocurrency adoption grows,
591
00:27:42,315 --> 00:27:44,415
um, I think it's important for organization
592
00:27:44,435 --> 00:27:48,285
to approach it responsibly, uh, balancing the potential
593
00:27:48,285 --> 00:27:51,085
for innovation and, uh, profit with, uh,
594
00:27:51,145 --> 00:27:53,645
strong risk management practices and,
595
00:27:53,645 --> 00:27:54,965
and robust controls as well.
596
00:27:55,775 --> 00:27:59,995
Um, internal auditors have a critical role, uh, here
597
00:28:00,015 --> 00:28:03,075
to play in ensuring that this balance is maintained.
598
00:28:03,735 --> 00:28:07,075
Um, auditors should start by evaluating the
599
00:28:07,585 --> 00:28:10,355
company's strategic approach to crypto cryptocurrency.
600
00:28:11,135 --> 00:28:12,835
What's the purpose behind adapting crypto?
601
00:28:12,865 --> 00:28:15,595
Like, you know, is it trading as a payment method
602
00:28:15,775 --> 00:28:17,755
or to offer crypto related services?
603
00:28:18,695 --> 00:28:22,715
Um, I think understanding the organization's goals helps,
604
00:28:23,095 --> 00:28:26,675
uh, auditors identify the specific risks involved.
605
00:28:27,295 --> 00:28:30,395
Uh, for instance, if the organization is holding crypto
606
00:28:31,055 --> 00:28:33,475
as an investment, uh, then auditors will need
607
00:28:33,475 --> 00:28:35,115
to assess the valuation process
608
00:28:35,255 --> 00:28:37,755
and ensure that risks like market
609
00:28:37,765 --> 00:28:39,835
volatility are managed properly.
610
00:28:40,455 --> 00:28:42,955
If they're accepting crypto as payment, for example,
611
00:28:43,025 --> 00:28:46,395
then auditors must ensure that the process for converting
612
00:28:46,395 --> 00:28:48,475
to fiat currency is secure and transparent.
613
00:28:48,975 --> 00:28:51,475
So, so there are a number of things, uh, that needs
614
00:28:51,475 --> 00:28:53,795
to be considered, depending on how, how,
615
00:28:53,795 --> 00:28:55,115
how the business is gonna work.
616
00:28:55,795 --> 00:28:58,375
Second, I would say auditors can help design strong
617
00:28:58,375 --> 00:28:59,375
governance frameworks.
618
00:28:59,515 --> 00:29:02,575
So this includes, as we spoke before, defining clear roles
619
00:29:02,675 --> 00:29:05,695
and responsibilities, uh, segregating duties,
620
00:29:06,155 --> 00:29:08,415
and ensuring, uh, there's a level
621
00:29:08,415 --> 00:29:10,815
of oversight on crypto related transactions.
622
00:29:11,515 --> 00:29:13,975
As I mentioned before, risk management is also crucial.
623
00:29:14,235 --> 00:29:18,375
So auditors can help identify the unique risk associated
624
00:29:18,375 --> 00:29:20,855
with cryptocurrency, such as cyber threats
625
00:29:20,995 --> 00:29:22,415
or even counterparty risks.
626
00:29:22,975 --> 00:29:25,335
I would say auditors should emphasize the importance
627
00:29:25,335 --> 00:29:27,415
of monitoring and continuous improvement as well,
628
00:29:27,925 --> 00:29:29,735
because cryptocurrency
629
00:29:30,475 --> 00:29:33,655
and the whole technology is in a fast moving space,
630
00:29:34,155 --> 00:29:36,935
so auditors should regularly review
631
00:29:36,995 --> 00:29:39,055
and update controls and processes.
632
00:29:39,685 --> 00:29:42,685
This could mean maybe conducting periodic risk assessment.
633
00:29:42,865 --> 00:29:45,525
So rather than doing it like annually, bi-annually,
634
00:29:45,525 --> 00:29:47,805
maybe you might need to do it like more frequently,
635
00:29:48,425 --> 00:29:50,165
do the risk assessment on audit and,
636
00:29:50,165 --> 00:29:52,365
and do audits on crypto activities,
637
00:29:52,945 --> 00:29:54,805
and, uh, assessing the effectiveness
638
00:29:54,805 --> 00:29:56,085
of cybersecurity controls.
639
00:29:56,915 --> 00:29:59,335
And, uh, I think being proactive
640
00:29:59,975 --> 00:30:03,535
and adapting to changes in the crypto landscape will ensure
641
00:30:03,535 --> 00:30:06,855
that the organization continues to manage risks, um,
642
00:30:07,405 --> 00:30:08,815
overall, I think effectively.
643
00:30:09,865 --> 00:30:10,915
Okay, fantastic.
644
00:30:11,855 --> 00:30:14,835
One personal tip I have would be
645
00:30:15,695 --> 00:30:19,155
for any internal auditor, assessing whether
646
00:30:19,155 --> 00:30:21,555
or not your organization has a good process
647
00:30:22,255 --> 00:30:24,595
to review the risks of new products and services.
648
00:30:24,855 --> 00:30:28,675
And that's such a, a good point is when
649
00:30:28,695 --> 00:30:32,035
before the, the thing is rolled out, is there some sort
650
00:30:32,035 --> 00:30:33,275
of risk management process, and
651
00:30:33,275 --> 00:30:35,555
that's something you can check for as an internal auditor.
652
00:30:36,065 --> 00:30:37,515
What are your final tips
653
00:30:37,655 --> 00:30:39,635
or takeaways that you wanna share
654
00:30:39,635 --> 00:30:41,115
with the internal audit community?
655
00:30:41,665 --> 00:30:43,235
With regards to digital assets?
656
00:30:44,615 --> 00:30:46,975
I think my key takeaway message, uh,
657
00:30:47,035 --> 00:30:50,055
for internal auditors would be this, stay informed,
658
00:30:50,235 --> 00:30:53,895
be adaptable, and focus on understanding the risks
659
00:30:53,955 --> 00:30:55,535
and the core of digital assets.
660
00:30:56,395 --> 00:30:59,335
Uh, the digital asset landscape is, as I said,
661
00:30:59,575 --> 00:31:02,015
evolving rapidly, and it can be overwhelming,
662
00:31:03,025 --> 00:31:05,365
but auditors play a vital role in helping
663
00:31:06,085 --> 00:31:09,485
companies navigate this space, uh, responsibly and securely.
664
00:31:10,235 --> 00:31:12,145
First, don't feel like you have
665
00:31:12,145 --> 00:31:14,705
to become an expert in blockchain or cryptocurrency.
666
00:31:15,565 --> 00:31:17,465
Uh, you don't need to be a developer,
667
00:31:17,525 --> 00:31:20,385
but you do need to develop a solid understanding
668
00:31:20,385 --> 00:31:24,275
of the fundamental concepts, um, like I said, like how
669
00:31:24,805 --> 00:31:27,715
blockchain works, what are the risk associated
670
00:31:27,715 --> 00:31:30,655
with different types of digital assets, uh,
671
00:31:30,715 --> 00:31:32,295
and the regulatory environment.
672
00:31:32,935 --> 00:31:35,375
I think this knowledge will empower you
673
00:31:35,395 --> 00:31:38,615
to ask the right questions, uh, when you, when you go
674
00:31:38,615 --> 00:31:41,655
for meetings or when you ask the, your process owners
675
00:31:42,435 --> 00:31:44,575
and assess the risks, uh, appropriately.
676
00:31:45,645 --> 00:31:47,725
I would also say maybe embrace collaboration.
677
00:31:47,785 --> 00:31:51,405
So the world of digital assets is very complex, so,
678
00:31:51,985 --> 00:31:54,805
and you will likely need to work closely with, uh,
679
00:31:54,835 --> 00:31:56,365
some technical experts
680
00:31:56,465 --> 00:31:58,765
and maybe the le maybe even legal advisors
681
00:31:59,105 --> 00:32:00,925
and even specialist.
682
00:32:01,225 --> 00:32:05,285
So collaboration is key to ensuring you have a holistic view
683
00:32:05,305 --> 00:32:08,605
of the organizations' operations and risk environment.
684
00:32:08,935 --> 00:32:10,005
Third, be proactive.
685
00:32:10,005 --> 00:32:13,085
As I said, I mean, the risk associated with digital assets,
686
00:32:13,335 --> 00:32:16,695
especially in areas like cybersecurity, uh,
687
00:32:16,805 --> 00:32:18,015
require forward thinking.
688
00:32:18,395 --> 00:32:21,175
Um, so don't wait issues to arise.
689
00:32:21,395 --> 00:32:23,695
Um, try to implement robust controls
690
00:32:24,395 --> 00:32:27,935
and staying ahead of, uh, emerging risks, uh, essential
691
00:32:28,715 --> 00:32:32,135
for maintaining the integrity of, uh, company's operations.
692
00:32:32,695 --> 00:32:34,455
I think to summarize, I would say, uh,
693
00:32:34,505 --> 00:32:36,535
maybe stay adaptable and be curious.
694
00:32:37,175 --> 00:32:39,525
I think I sounded like, uh, uh, Steve Jobs.
695
00:32:43,625 --> 00:32:45,805
No, I love it. I've really enjoyed the conversation.
696
00:32:45,805 --> 00:32:47,845
Thank you so much for sharing your expertise
697
00:32:48,865 --> 00:32:51,805
and uh, I hope you have a wonderful 2025.
698
00:32:52,245 --> 00:32:53,965
I feel like I'm gonna log off
699
00:32:53,965 --> 00:32:55,725
and go check my Bitcoin balances
700
00:32:55,755 --> 00:32:58,565
because I bought back in like 2021.
701
00:33:00,775 --> 00:33:03,525
Thank you, Donna. I really enjoyed, uh, this conversation
702
00:33:03,625 --> 00:33:06,285
and, uh, I wish should put 2025 as well.
703
00:33:07,945 --> 00:33:10,685
If you like this podcast, please subscribe and rate us.
704
00:33:10,985 --> 00:33:13,245
You can subscribe wherever you get your podcasts.
705
00:33:13,585 --> 00:33:17,685
You can also catch other episodes on YouTube or@theia.org.
706
00:33:17,945 --> 00:33:20,965
That's tia.org.
00:00:02,505 --> 00:00:05,125
The Institute of Internal Auditors presents all
2
00:00:05,125 --> 00:00:06,565
things internal audit tech.
3
00:00:07,145 --> 00:00:08,765
In this episode, Dana Lawrence
4
00:00:08,905 --> 00:00:12,005
and Dal la Rubin Tanja discuss the complexities
5
00:00:12,025 --> 00:00:14,125
of auditing cryptocurrency in blockchain.
6
00:00:14,715 --> 00:00:16,365
They explore the unique challenges
7
00:00:16,425 --> 00:00:19,245
and opportunities these technologies offer internal auditors
8
00:00:19,625 --> 00:00:20,885
and share practical guidance
9
00:00:21,145 --> 00:00:23,005
for navigating this evolving landscape.
10
00:00:25,375 --> 00:00:27,135
Reuben, I am so excited
11
00:00:27,135 --> 00:00:28,215
to have this conversation
12
00:00:28,215 --> 00:00:29,495
with you. How are you doing today?
13
00:00:29,955 --> 00:00:30,975
I'm good. Thank you, Donna.
14
00:00:30,975 --> 00:00:32,375
And it's my pleasure to be here.
15
00:00:32,995 --> 00:00:34,775
So let's kick things off.
16
00:00:35,165 --> 00:00:39,135
What inspired your interest in, in exploring cryptocurrency
17
00:00:39,325 --> 00:00:40,695
with regards to internal audit?
18
00:00:41,475 --> 00:00:42,645
It's fascinating, uh,
19
00:00:42,745 --> 00:00:45,685
but also a bit overwhelming, uh, especially
20
00:00:45,685 --> 00:00:46,805
for internal auditors.
21
00:00:47,365 --> 00:00:50,965
I have seen organizations diving into blockchain, crypto,
22
00:00:51,185 --> 00:00:54,575
and even decentralized finance, uh, as they try
23
00:00:54,575 --> 00:00:56,015
to innovate and stay ahead.
24
00:00:56,315 --> 00:01:00,135
Uh, but with all this innovation comes a ton of new risks
25
00:01:00,795 --> 00:01:03,295
and, uh, complexities that are not part
26
00:01:03,295 --> 00:01:05,855
of traditional auditing frameworks, right?
27
00:01:05,885 --> 00:01:09,175
Yeah. Uh, for example, things like decentralized systems,
28
00:01:09,635 --> 00:01:10,975
uh, smart contracts
29
00:01:11,155 --> 00:01:14,895
and, uh, volatility of, uh, cryptocurrencies create
30
00:01:15,495 --> 00:01:18,335
challenges, uh, that require us as auditors
31
00:01:18,335 --> 00:01:19,535
to think differently.
32
00:01:20,035 --> 00:01:22,735
So, on top of that, the regulatory landscape, uh,
33
00:01:22,735 --> 00:01:26,375
around crypto is also continuously evolving.
34
00:01:26,915 --> 00:01:30,535
And so there's so much to keep up with, uh, these days.
35
00:01:31,545 --> 00:01:35,075
What are some of the challenges you see internal auditors
36
00:01:35,075 --> 00:01:38,875
facing when they're assessing activities related
37
00:01:38,895 --> 00:01:41,875
to digital assets, blockchain, cryptocurrency, et cetera?
38
00:01:42,615 --> 00:01:44,485
There are a lot of challenges still, Donna.
39
00:01:44,485 --> 00:01:46,085
I mean, I mean, it's, it's, it's, uh,
40
00:01:46,225 --> 00:01:49,925
the moment the technology becomes, uh, huge.
41
00:01:50,035 --> 00:01:53,405
Like, you know, the, this also comes together, uh,
42
00:01:53,405 --> 00:01:55,525
which is also huge in, in, in most cases.
43
00:01:55,985 --> 00:01:58,805
So the world of digital asset is so unique, uh,
44
00:01:58,805 --> 00:02:01,205
that it present some pretty distinct,
45
00:02:01,225 --> 00:02:02,685
uh, challenges for internal auditor.
46
00:02:02,905 --> 00:02:05,325
So maybe I can point out few of them.
47
00:02:05,425 --> 00:02:08,125
The key ones, uh, first itself is
48
00:02:08,305 --> 00:02:10,525
to understand the technology itself, right?
49
00:02:10,665 --> 00:02:12,285
Um, can, it can be a hurdle.
50
00:02:12,815 --> 00:02:14,925
Blockchain and cryptocurrencies, uh,
51
00:02:14,995 --> 00:02:18,205
operate very differently from traditional financial systems.
52
00:02:19,205 --> 00:02:21,625
Uh, so auditors need to grasp how they work
53
00:02:21,965 --> 00:02:24,105
to effectively evaluate risk and controls.
54
00:02:24,765 --> 00:02:28,265
Um, and it's not always easy to translate, uh,
55
00:02:28,335 --> 00:02:30,745
technical concepts like smart contracts
56
00:02:30,845 --> 00:02:34,945
or even decentralized finance, uh, into audit terms.
57
00:02:35,885 --> 00:02:38,425
Uh, then on top of then that there is a challenge
58
00:02:38,425 --> 00:02:40,665
of regulatory uncertainty, as I mentioned before.
59
00:02:40,725 --> 00:02:42,865
So digital assets are still relatively new,
60
00:02:43,855 --> 00:02:47,875
and the rules governing them very widely across, uh,
61
00:02:48,025 --> 00:02:50,635
regions, and they're constantly changing.
62
00:02:51,415 --> 00:02:54,275
Uh, I mean, as internal auditors, we need to keep up
63
00:02:54,275 --> 00:02:57,705
with this evolving landscape to ensure, I mean,
64
00:02:57,855 --> 00:03:00,085
invidia's case, our clients stay compliant.
65
00:03:00,225 --> 00:03:02,125
And, and that's not small task.
66
00:03:02,915 --> 00:03:04,255
And on top of that, as you know,
67
00:03:04,255 --> 00:03:07,095
Europe has its own regulatory framework, which is very new,
68
00:03:07,155 --> 00:03:09,535
and it's called markets Crypto Asset Regulation.
69
00:03:10,435 --> 00:03:14,815
And, um, the other jurisdictions like uk, us, Canada,
70
00:03:15,005 --> 00:03:18,375
Australia, Singapore, each other key financial markets
71
00:03:19,035 --> 00:03:20,495
are still figuring out how,
72
00:03:20,495 --> 00:03:21,855
what is the best course of action.
73
00:03:22,595 --> 00:03:25,215
Um, so you need to keep it, keep up with it,
74
00:03:25,275 --> 00:03:27,175
at least in your jurisdiction.
75
00:03:27,355 --> 00:03:29,415
Uh, I would say as, as internal auditors,
76
00:03:29,685 --> 00:03:31,655
another one I would say is cybersecurity.
77
00:03:32,035 --> 00:03:34,855
Um, I mean, digital assets are prime target for hackers.
78
00:03:35,765 --> 00:03:38,665
Uh, incidents like stolen private keys
79
00:03:38,725 --> 00:03:41,625
or compromised wallets can lead to massive losses.
80
00:03:42,365 --> 00:03:43,985
Um, and auditors have
81
00:03:43,985 --> 00:03:47,225
to evaluate whether there are good security measures are in
82
00:03:47,225 --> 00:03:48,945
place to protect these assets.
83
00:03:49,445 --> 00:03:51,145
And that often involves, uh,
84
00:03:51,145 --> 00:03:54,465
understanding highly technical safeguards.
85
00:03:55,085 --> 00:03:56,385
And then on
86
00:03:56,395 --> 00:03:58,225
after that, the valuation comes into
87
00:03:58,225 --> 00:03:59,385
play, which is also tricky.
88
00:04:00,085 --> 00:04:02,385
Uh, the cryptocurrencies are very volatile,
89
00:04:02,565 --> 00:04:05,665
and it makes it hard to assign a consistent value to them.
90
00:04:06,255 --> 00:04:08,265
There's a still debate ongoing, how
91
00:04:08,265 --> 00:04:10,385
to classify it from the accounting perspective.
92
00:04:11,235 --> 00:04:14,165
Then there's a challenge on the controls
93
00:04:14,185 --> 00:04:15,405
and, uh, governance.
94
00:04:16,065 --> 00:04:18,805
Uh, many organizations are still figuring out how
95
00:04:18,805 --> 00:04:21,205
to integrate digital assets into the operations,
96
00:04:21,825 --> 00:04:23,725
and auditors often find gaps in
97
00:04:23,725 --> 00:04:25,605
processes, policies, and controls.
98
00:04:26,305 --> 00:04:29,365
So I think staying curious, adaptable, maybe open
99
00:04:29,365 --> 00:04:32,845
to learning is, uh, important for internal auditors just
100
00:04:32,845 --> 00:04:35,405
to ensure these they can tackle these challenges.
101
00:04:36,425 --> 00:04:39,925
Mm-hmm. Yeah, it seems like there are a lot of challenges,
102
00:04:39,985 --> 00:04:42,045
but it also could be a great opportunity
103
00:04:42,105 --> 00:04:46,165
for internal auditors who really thrive on new technology
104
00:04:46,585 --> 00:04:48,905
and learning new information.
105
00:04:49,005 --> 00:04:50,945
So I think it, it could also be a cool
106
00:04:50,945 --> 00:04:52,065
opportunity career-wise.
107
00:04:53,055 --> 00:04:55,415
I wanna circle back to cybersecurity.
108
00:04:55,995 --> 00:04:57,855
Do you have any specific tips
109
00:04:58,315 --> 00:05:01,455
or auditing procedures that we can keep in mind,
110
00:05:02,415 --> 00:05:04,415
specifically thinking about cybersecurity
111
00:05:04,455 --> 00:05:06,815
controls with digital assets? So,
112
00:05:07,375 --> 00:05:10,165
Donna, uh, cyber security, as I said,
113
00:05:10,245 --> 00:05:11,765
like it's a massive concern when it comes
114
00:05:11,765 --> 00:05:13,765
to digital assets because mm-hmm.
115
00:05:14,315 --> 00:05:17,245
They're such a high value targets for hackers
116
00:05:17,245 --> 00:05:18,805
because of the value associated
117
00:05:18,805 --> 00:05:20,085
with cryptocurrencies, right?
118
00:05:20,745 --> 00:05:24,005
Uh, so recently I read an article, it was even in one
119
00:05:24,005 --> 00:05:28,805
of the I, which stated that 2.2 billion,
120
00:05:29,225 --> 00:05:31,165
uh, worth of that is in US dollars worth
121
00:05:31,165 --> 00:05:34,765
of cryptocurrency was stolen from various platforms in 2024.
122
00:05:34,945 --> 00:05:37,405
So I'm, I'm, I'm saying like a very recent number.
123
00:05:38,275 --> 00:05:39,655
So it's a key concern.
124
00:05:40,455 --> 00:05:43,335
I can point out some key risks, uh, maybe and, and, and,
125
00:05:43,335 --> 00:05:46,415
and how as internal audits we can tackle, tackle them.
126
00:05:47,175 --> 00:05:49,605
First, there is the risk of unauthorized access
127
00:05:49,665 --> 00:05:52,005
to wallets or private keys.
128
00:05:52,665 --> 00:05:55,565
Uh, for example, if someone gains access to these keys,
129
00:05:55,715 --> 00:05:58,310
they essentially control the digital assets, right?
130
00:05:58,385 --> 00:05:59,405
So, um,
131
00:05:59,625 --> 00:06:01,005
and there is no way to reverse
132
00:06:01,005 --> 00:06:02,245
transaction on the blockchain.
133
00:06:02,325 --> 00:06:03,885
I mean, that is the beauty of the blockchain.
134
00:06:04,025 --> 00:06:06,925
And, and, and of course, that is the con, uh, part
135
00:06:06,925 --> 00:06:07,925
of the blockchain as well.
136
00:06:08,505 --> 00:06:11,365
And, uh, auditors should prioritize assessing
137
00:06:11,365 --> 00:06:13,965
how pre private keys are generated, stored
138
00:06:13,985 --> 00:06:18,205
and access, uh, are they kept insecure, encrypted wallets,
139
00:06:18,865 --> 00:06:21,765
uh, or multisignature wallets in use, for example,
140
00:06:22,345 --> 00:06:24,245
and where multiple approvals are required
141
00:06:24,265 --> 00:06:26,205
for transaction like that.
142
00:06:26,465 --> 00:06:28,925
Um, and another big risk is phishing attacks.
143
00:06:29,125 --> 00:06:31,605
I mean, it's, it's there in the industry for sometime.
144
00:06:32,265 --> 00:06:36,125
Uh, hackers often trickle trick employees into giving up
145
00:06:36,125 --> 00:06:37,325
credentials or access.
146
00:06:38,005 --> 00:06:40,605
Auditors should review the organization's training programs
147
00:06:40,605 --> 00:06:44,445
to ensure, uh, employees are educated on these threats
148
00:06:45,145 --> 00:06:47,445
and, uh, assess incident response plans
149
00:06:47,445 --> 00:06:48,565
for handling phishing attempt.
150
00:06:49,215 --> 00:06:51,885
There is a risk of compromise platforms as well, like
151
00:06:52,405 --> 00:06:53,805
exchanges or custodial services.
152
00:06:54,465 --> 00:06:57,085
So, for example, if an organization use a third party
153
00:06:57,405 --> 00:07:00,765
provider to manage these assets, uh, I think auditors need
154
00:07:00,765 --> 00:07:03,485
to evaluate the due diligence performed on those providers,
155
00:07:03,635 --> 00:07:05,045
whether they're reputable,
156
00:07:05,145 --> 00:07:07,005
do they have strong security certifications,
157
00:07:07,005 --> 00:07:09,005
whether they have right protocols in place.
158
00:07:09,705 --> 00:07:11,725
And also, I can think of, for example,
159
00:07:11,725 --> 00:07:13,045
network security as well.
160
00:07:13,305 --> 00:07:17,045
Uh, digital assets are managed in environments, uh,
161
00:07:17,135 --> 00:07:19,845
where a breach could expose them to theft.
162
00:07:20,255 --> 00:07:23,405
Audit procedures here can include, like, for example,
163
00:07:23,405 --> 00:07:26,885
testing firewalls, uh, intrusion detection systems
164
00:07:27,145 --> 00:07:29,845
and monitoring controls to ensure
165
00:07:30,475 --> 00:07:33,445
anomalies are quickly identified and addressed.
166
00:07:34,045 --> 00:07:36,045
I mean, there are the things which you can do.
167
00:07:36,045 --> 00:07:39,485
For example, review access logs, uh, test the effectiveness
168
00:07:39,485 --> 00:07:43,365
of encryption protocols, verify u usual, some of the usual,
169
00:07:43,505 --> 00:07:44,965
uh, it controls like backup
170
00:07:45,145 --> 00:07:46,285
and recovery processes,
171
00:07:46,755 --> 00:07:48,725
even the incident response capabilities.
172
00:07:49,385 --> 00:07:51,885
So, uh, the moment the technology comes into play,
173
00:07:51,885 --> 00:07:55,325
there are a lot of things that needs to be done around, uh,
174
00:07:55,345 --> 00:07:58,325
to ensure that you're confident about the internal controls
175
00:07:58,465 --> 00:07:59,805
around the processes.
176
00:08:00,385 --> 00:08:02,955
Well, you've absolutely offered us some strong tips there.
177
00:08:03,775 --> 00:08:07,235
One thing that I think about is, anytime
178
00:08:07,995 --> 00:08:11,075
I am performing an audit, I do a, a risk assessment
179
00:08:11,215 --> 00:08:12,915
for planning to understand the scope,
180
00:08:13,415 --> 00:08:15,195
and then starting with the scope of services,
181
00:08:15,375 --> 00:08:17,995
you can apply some of those, uh,
182
00:08:18,025 --> 00:08:21,355
cybersecurity best practices to make sure that you know,
183
00:08:21,375 --> 00:08:23,035
you're, you have appropriate coverage.
184
00:08:23,725 --> 00:08:24,915
Let's pivot slightly
185
00:08:25,175 --> 00:08:28,995
and think about the evolving regulatory landscape.
186
00:08:29,585 --> 00:08:31,395
Depending on where you are in the world,
187
00:08:31,735 --> 00:08:34,995
you might have very different regulations governing
188
00:08:35,385 --> 00:08:38,315
what you can and can't do with regards to digital assets.
189
00:08:38,735 --> 00:08:42,635
In your opinion, how can we stay on top of
190
00:08:43,415 --> 00:08:45,555
the changes, the differences,
191
00:08:46,575 --> 00:08:49,435
and help our organizations stay in line
192
00:08:49,865 --> 00:08:51,395
with emerging regulations?
193
00:08:52,015 --> 00:08:54,275
And I'm gonna specifically call out Mika.
194
00:08:54,655 --> 00:08:55,655
So what are your thoughts?
195
00:08:56,675 --> 00:08:58,175
I'm glad you brought this up, Donna.
196
00:08:58,255 --> 00:09:01,495
I mean, this is a very, uh, it's something which is close
197
00:09:01,495 --> 00:09:03,495
to my profession, and we are continuously
198
00:09:03,495 --> 00:09:04,575
following this space.
199
00:09:05,155 --> 00:09:08,615
Uh, and I can speak from Mecca, which is, uh,
200
00:09:08,615 --> 00:09:09,935
Europe's specific regulation.
201
00:09:09,995 --> 00:09:12,855
And, uh, it's relevant to Malta, uh, where I'm based
202
00:09:13,795 --> 00:09:16,735
and countries hub for crypto businesses within the eu,
203
00:09:17,035 --> 00:09:18,335
uh, for last few years.
204
00:09:18,995 --> 00:09:22,375
Uh, for those less familiar, uh, Mika,
205
00:09:22,375 --> 00:09:26,215
which is the markets in crypto assets regulation, uh,
206
00:09:26,395 --> 00:09:29,015
is a comprehensive regulatory framework introduced
207
00:09:29,015 --> 00:09:31,335
by the European Union, with the intention
208
00:09:31,335 --> 00:09:34,335
of bringing clarity and consistency to the crypto sector.
209
00:09:35,125 --> 00:09:39,535
It's designed to cover everything from crypto asset issuers
210
00:09:39,915 --> 00:09:43,635
to service providers with the aim of fostering innovation,
211
00:09:44,015 --> 00:09:46,235
uh, while also ensuring investor
212
00:09:46,235 --> 00:09:47,555
protection and market integrity.
213
00:09:47,615 --> 00:09:49,995
So that's the basically whole idea about this.
214
00:09:50,455 --> 00:09:52,235
So, under me, for example,
215
00:09:52,295 --> 00:09:54,395
the crypto businesses operating in Malta
216
00:09:55,245 --> 00:09:59,465
and also even other new states, uh, will need to comply
217
00:09:59,465 --> 00:10:02,945
with, uh, some strict requirements such as licensing, uh,
218
00:10:02,965 --> 00:10:04,665
for crypto asset service providers.
219
00:10:05,325 --> 00:10:07,225
Uh, there should be enhanced transparency
220
00:10:07,245 --> 00:10:10,505
around white papers, port of issuers and,
221
00:10:10,725 --> 00:10:12,945
and robust governance frameworks as well.
222
00:10:13,765 --> 00:10:17,195
There are also specific provisions for consumer protection
223
00:10:17,195 --> 00:10:19,435
and market market abuse prevention as well.
224
00:10:20,025 --> 00:10:21,955
From internal auditor's perspective,
225
00:10:22,155 --> 00:10:25,475
I think Mika introduces a new layer of compliance.
226
00:10:25,495 --> 00:10:28,555
That's much, that must be one into the,
227
00:10:28,625 --> 00:10:30,915
they are traditional internal audit plans.
228
00:10:31,615 --> 00:10:33,915
Uh, I think staying informed is critical.
229
00:10:34,295 --> 00:10:35,475
Uh, and, and,
230
00:10:35,495 --> 00:10:39,075
and one way to do this is to maybe engage directly
231
00:10:39,075 --> 00:10:42,395
with resources provided by the local regulator, uh, in,
232
00:10:42,455 --> 00:10:43,715
in case of multi's, going
233
00:10:43,715 --> 00:10:45,515
to be multi financial services authority,
234
00:10:46,095 --> 00:10:48,715
who will oversee the meca implementation locally.
235
00:10:49,545 --> 00:10:51,435
From audit perspective, uh,
236
00:10:51,725 --> 00:10:54,995
there can be several things which can be done, uh,
237
00:10:55,175 --> 00:10:58,675
for example, to map the organization's activities
238
00:10:59,055 --> 00:11:00,315
to meca requirements.
239
00:11:00,615 --> 00:11:03,395
I'm, I'm referring to MIC A, it can contain regulation
240
00:11:04,015 --> 00:11:05,955
and then assess governance structures.
241
00:11:06,095 --> 00:11:08,675
For example, in Mica's case, uh, it, it,
242
00:11:08,695 --> 00:11:10,195
it emphasizes accountability.
243
00:11:10,255 --> 00:11:12,635
So auditors should ensure roles
244
00:11:12,735 --> 00:11:16,115
and responsibilities for compliance are clearly defined.
245
00:11:16,705 --> 00:11:19,275
Then, um, test the reporting mechanisms.
246
00:11:19,775 --> 00:11:21,755
Um, for example, in case of mica,
247
00:11:21,755 --> 00:11:24,155
it requires ongoing reporting to regulators.
248
00:11:24,855 --> 00:11:27,835
So auditors should evaluate whether these processes are
249
00:11:27,835 --> 00:11:29,595
robust, accurate, and timely.
250
00:11:29,935 --> 00:11:31,635
And also on top of that, there is, uh,
251
00:11:32,145 --> 00:11:33,595
risk management framework, right?
252
00:11:33,615 --> 00:11:36,995
So I think Mika demands that risk associated
253
00:11:36,995 --> 00:11:39,195
with crypto activities like operational market
254
00:11:39,195 --> 00:11:41,435
and cybersecurity risks, uh,
255
00:11:41,655 --> 00:11:43,555
are promptly identified and mitigated.
256
00:11:43,695 --> 00:11:46,995
But I would say generally all internal auditors should
257
00:11:46,995 --> 00:11:49,955
ensure that that proper risk manage frameworks.
258
00:11:53,045 --> 00:11:54,805
I mean, at the end of the day, um,
259
00:11:55,125 --> 00:11:58,125
a regulation gives guidelines for an operating framework,
260
00:11:58,545 --> 00:12:02,085
uh, which means the regulator has already considered
261
00:12:02,085 --> 00:12:03,445
certain risk aspects.
262
00:12:03,625 --> 00:12:06,885
So it makes intel auditors life a bit more easier
263
00:12:06,885 --> 00:12:11,205
because now we will now have a framework to operate within.
264
00:12:12,335 --> 00:12:15,355
So do you have any other tips to offer auditors
265
00:12:15,695 --> 00:12:18,795
to prepare the organizations for compliance
266
00:12:18,825 --> 00:12:20,315
with upcoming regulations?
267
00:12:20,805 --> 00:12:23,275
Definitely, I mean, it's, it's a critical topic as well.
268
00:12:23,275 --> 00:12:25,195
It's related to what we just spoke.
269
00:12:25,295 --> 00:12:27,315
Uh, I mean, preparation is key,
270
00:12:27,415 --> 00:12:29,675
not just from the compliance perspective,
271
00:12:29,815 --> 00:12:33,075
but also to position the organization
272
00:12:33,135 --> 00:12:35,755
as a credible player in the digital asset space.
273
00:12:36,505 --> 00:12:37,925
Uh, I think the first step,
274
00:12:37,925 --> 00:12:39,645
the auditors can consider a readiness
275
00:12:39,645 --> 00:12:40,765
assessment, for example.
276
00:12:41,105 --> 00:12:44,405
So this means evaluating the company's current operations,
277
00:12:44,665 --> 00:12:48,165
uh, policies and controls against the requirements
278
00:12:48,165 --> 00:12:49,285
set by the regulation.
279
00:12:49,865 --> 00:12:51,925
For example, under, uh,
280
00:12:51,925 --> 00:12:54,525
crypto asset service providers will need licensing,
281
00:12:54,825 --> 00:12:57,045
as I said, like, and there should be proper governance
282
00:12:57,205 --> 00:13:00,325
structures, and there should be transparent disclosures, so
283
00:13:01,005 --> 00:13:03,085
auditors can evaluate whether these are in place.
284
00:13:03,805 --> 00:13:05,445
I think on top of that, the auditors,
285
00:13:05,885 --> 00:13:08,565
internal auditors should also encourage the organization to
286
00:13:09,115 --> 00:13:12,725
establish and enhance the existing regulatory compliance
287
00:13:12,725 --> 00:13:15,365
framework to ensure they're in line with the,
288
00:13:15,505 --> 00:13:19,245
the expectations of the, uh, new regulatory requirements,
289
00:13:19,705 --> 00:13:22,245
and also to focus on data and reporting capabilities.
290
00:13:23,235 --> 00:13:26,125
Cybersecurity also ties into regulatory compliance,
291
00:13:26,265 --> 00:13:29,245
or auditors should ensure that digital asset custody
292
00:13:29,745 --> 00:13:31,645
and transaction processes are secure.
293
00:13:32,265 --> 00:13:35,605
For example, ika places emphasis on consumer protection,
294
00:13:35,605 --> 00:13:38,285
which includes safeguarding assets from
295
00:13:38,365 --> 00:13:39,965
unauthorized access or loss.
296
00:13:40,885 --> 00:13:43,085
I think another key area I would say is maybe
297
00:13:43,175 --> 00:13:44,645
staff training and awareness.
298
00:13:45,385 --> 00:13:47,735
These regulation introduce new requirements,
299
00:13:48,115 --> 00:13:51,595
and maybe not all employees are not familiar with, uh,
300
00:13:51,775 --> 00:13:54,115
so it's important to ensure that staff, uh,
301
00:13:54,115 --> 00:13:57,745
particularly the, those involved in compliance, uh,
302
00:13:57,885 --> 00:14:00,985
and maybe risk management to ensure that they know the, the
303
00:14:01,095 --> 00:14:03,465
what, what's, what's coming on their way.
304
00:14:04,185 --> 00:14:07,065
I would also say auditors should emphasize the importance
305
00:14:07,065 --> 00:14:09,185
of engaging with regulators maybe early.
306
00:14:09,965 --> 00:14:12,585
Um, so it's about building a relationship, uh,
307
00:14:12,585 --> 00:14:14,625
with the local regulator, uh,
308
00:14:14,725 --> 00:14:17,505
so they can gain some clarity on expectations,
309
00:14:17,515 --> 00:14:20,225
especially in areas where the regulation
310
00:14:20,225 --> 00:14:21,425
may be still evolving.
311
00:14:22,305 --> 00:14:25,845
So it's about turning compliance from a tick box exercise
312
00:14:25,985 --> 00:14:28,565
and maybe to convert into a strategic advantage
313
00:14:29,025 --> 00:14:30,765
for the organization's wider benefit.
314
00:14:31,045 --> 00:14:32,045
I would say.
315
00:14:32,495 --> 00:14:34,815
I love that with more
316
00:14:34,815 --> 00:14:37,775
and more people being interested in digital assets,
317
00:14:38,205 --> 00:14:42,375
potentially investing in cryptocurrency or,
318
00:14:43,195 --> 00:14:46,615
or other things ad exchanges or
319
00:14:46,615 --> 00:14:50,555
otherwise, we have seen some pretty epic failures,
320
00:14:50,555 --> 00:14:52,695
whether it's a hack or fraud
321
00:14:52,835 --> 00:14:55,055
or collapses of major exchanges.
322
00:14:55,715 --> 00:14:58,295
And I think back in 2022
323
00:14:59,115 --> 00:15:02,615
is when the IA first started demonstrating leadership
324
00:15:02,615 --> 00:15:03,615
around this topic
325
00:15:03,755 --> 00:15:05,615
and asking the question, why is there not,
326
00:15:05,995 --> 00:15:08,455
why is it not a requirement to have some sort
327
00:15:08,455 --> 00:15:09,575
of control testing
328
00:15:09,795 --> 00:15:13,815
or robust internal audit function at a large crypto exchange
329
00:15:14,285 --> 00:15:16,215
that has the ability to impact
330
00:15:16,275 --> 00:15:19,175
so many people if there is broader mismanagement?
331
00:15:20,275 --> 00:15:25,135
So the, I a recently has made some legislative proposals
332
00:15:25,535 --> 00:15:27,695
emphasizing that need, the need
333
00:15:27,695 --> 00:15:29,535
for stronger corporate governance at
334
00:15:29,535 --> 00:15:30,895
cryptocurrency exchanges.
335
00:15:31,865 --> 00:15:35,765
In your opinion, how can we effectively advocate
336
00:15:36,145 --> 00:15:39,565
for governance enhancements within the industry
337
00:15:40,105 --> 00:15:42,125
or within these specific organizations?
338
00:15:43,025 --> 00:15:46,845
That's really relevant and very timely question, Donna.
339
00:15:46,965 --> 00:15:49,605
I mean, especially with the increased scrutiny on
340
00:15:49,605 --> 00:15:52,525
cryptocurrency exchanges in recent years, the,
341
00:15:52,745 --> 00:15:55,805
the IAS proposal, I mean, came soon
342
00:15:55,805 --> 00:15:58,205
after the collapse of a cryptocurrency exchange, right?
343
00:15:58,785 --> 00:15:59,925
Um, I think first
344
00:16:00,025 --> 00:16:03,445
and foremost, uh, I would say internal auditors need
345
00:16:03,445 --> 00:16:05,685
to highlight the value of good governance
346
00:16:05,685 --> 00:16:06,885
to leadership and the board.
347
00:16:07,505 --> 00:16:09,365
Um, I think probably that's what even
348
00:16:09,945 --> 00:16:11,125
IA is trying to do here.
349
00:16:11,825 --> 00:16:13,405
Um, and, uh, I mean,
350
00:16:13,405 --> 00:16:16,685
strong corporate governance is not just about compliance.
351
00:16:17,345 --> 00:16:21,165
Um, it's about building trust, um, mitigating risks,
352
00:16:21,345 --> 00:16:24,325
and, uh, creating a sustainable framework for growth.
353
00:16:25,165 --> 00:16:27,005
I think by emphasizing the reputation
354
00:16:27,005 --> 00:16:31,285
and financial benefits, uh, of good governance, I mean,
355
00:16:31,285 --> 00:16:34,405
auditors can position these improvements as strategic
356
00:16:35,055 --> 00:16:38,725
priorities, uh, not just like, uh, regulatory obligations.
357
00:16:38,845 --> 00:16:43,735
I would say. Uh, I think then possibly internal auditors,
358
00:16:43,995 --> 00:16:47,415
uh, can start by evaluating the current governance framework
359
00:16:47,755 --> 00:16:51,695
within the exchanges or even, even even any organization.
360
00:16:51,725 --> 00:16:54,945
This means assessing key areas like the composition,
361
00:16:54,985 --> 00:16:57,945
independence of the board, uh, the adequacy
362
00:16:57,945 --> 00:17:00,665
of oversight mechanisms, and the clarity of roles
363
00:17:00,725 --> 00:17:01,745
and responsibilities.
364
00:17:03,035 --> 00:17:05,435
I think risk management frameworks are also very critical.
365
00:17:06,135 --> 00:17:09,115
Um, they should assess whether the organization has robust
366
00:17:09,185 --> 00:17:13,235
processes, uh, in place to identify, uh, measure
367
00:17:13,735 --> 00:17:16,845
and, uh, mitigate risks, especially those unique
368
00:17:16,905 --> 00:17:18,085
to crypto exchanges.
369
00:17:18,105 --> 00:17:20,725
So essentially, this will either come from a
370
00:17:21,355 --> 00:17:24,245
wide organization wide, uh, risk register,
371
00:17:24,345 --> 00:17:27,245
or even the independent risk assessment of the, uh,
372
00:17:27,485 --> 00:17:29,515
internal auditor in Malta.
373
00:17:29,755 --> 00:17:32,835
I mean, uh, I'm just giving Malta as an example here.
374
00:17:32,975 --> 00:17:35,475
Um, as soon as the operating licenses are granted
375
00:17:35,575 --> 00:17:39,595
for payment institutions, um, this can be, regardless
376
00:17:39,655 --> 00:17:40,875
of whether crypto is involved
377
00:17:40,875 --> 00:17:42,115
or not, um,
378
00:17:42,375 --> 00:17:44,915
an internal audit should be carried out on the governance
379
00:17:45,075 --> 00:17:47,435
structure and risk management processes within the first 12
380
00:17:47,435 --> 00:17:51,155
months of operation is even the regulatory.
381
00:17:51,335 --> 00:17:53,155
So, uh, picky about it.
382
00:17:53,175 --> 00:17:54,595
And, and they want, uh, uh,
383
00:17:55,045 --> 00:17:57,235
there should be like an internal audit done
384
00:17:57,235 --> 00:17:58,555
within that first 12 months.
385
00:17:59,175 --> 00:18:02,715
Uh, so, so there's like a, a, a very, uh,
386
00:18:03,235 --> 00:18:04,355
specific focus on this area.
387
00:18:05,315 --> 00:18:06,955
I mean, we should not forget that,
388
00:18:07,145 --> 00:18:10,155
that the internal auditors role is not limited
389
00:18:10,255 --> 00:18:11,475
to the assurance role, right?
390
00:18:11,535 --> 00:18:12,795
So it's beyond,
391
00:18:12,975 --> 00:18:15,915
and internal auditors can always wear advisory hats,
392
00:18:16,295 --> 00:18:18,555
so they can act as educators
393
00:18:19,215 --> 00:18:21,715
and advocates of governance as well, um,
394
00:18:21,845 --> 00:18:25,035
which is essentially what IE is trying to do in wider scale.
395
00:18:25,815 --> 00:18:27,465
Well, I appreciate your insight on that,
396
00:18:27,805 --> 00:18:31,905
and it's always difficult to have incidents like these,
397
00:18:32,055 --> 00:18:33,465
like I know we're alluding
398
00:18:33,465 --> 00:18:37,305
to the cryptocurrency exchange collapse of 2022 with regards
399
00:18:37,305 --> 00:18:41,575
to FTX, which, you know, it's very tough for a lot
400
00:18:41,575 --> 00:18:44,135
of people, even if they hopefully get their money back years
401
00:18:44,375 --> 00:18:45,695
later, years later.
402
00:18:45,695 --> 00:18:49,775
But I do think the silver lining is when we're speaking
403
00:18:49,875 --> 00:18:53,655
to organizations we're working with, we can show clearly,
404
00:18:54,395 --> 00:18:56,575
you know, we can point to what risks
405
00:18:57,095 --> 00:18:58,175
actually can end up happening
406
00:18:58,515 --> 00:19:01,815
and what, what outcomes can occur if we don't have
407
00:19:01,815 --> 00:19:03,375
that correct risk management.
408
00:19:03,595 --> 00:19:05,655
So I think the silver lining is,
409
00:19:05,655 --> 00:19:07,695
we have a clear example in talking points,
410
00:19:07,875 --> 00:19:10,055
so we can better inform our stakeholders,
411
00:19:10,695 --> 00:19:11,695
Definitely.
412
00:19:12,115 --> 00:19:16,805
Okay, let's think about how do we equip
413
00:19:17,445 --> 00:19:18,485
internal auditors to today
414
00:19:19,435 --> 00:19:23,865
with the technical knowledge they need around blockchain,
415
00:19:23,885 --> 00:19:26,625
around digital assets so they can do their work effectively.
416
00:19:27,135 --> 00:19:30,025
Because this is something I've also been very curious
417
00:19:30,165 --> 00:19:32,945
and passionate about for the last couple years, trying
418
00:19:32,945 --> 00:19:36,115
to sift through all things digital assets
419
00:19:36,215 --> 00:19:39,435
and figure out what is applicable to the world I operate in.
420
00:19:40,755 --> 00:19:42,805
This is something not just you, Dan,
421
00:19:42,905 --> 00:19:45,605
I'm in many internal audit that auditors are curious about,
422
00:19:45,605 --> 00:19:47,685
because it's true that blockchain
423
00:19:47,685 --> 00:19:50,485
and crypto platforms are quite technical, uh,
424
00:19:50,545 --> 00:19:53,005
and it can be seen daunting for auditors
425
00:19:53,225 --> 00:19:55,325
who came from a more traditional background, right?
426
00:19:55,345 --> 00:19:58,525
So traditionally, I mean, if you see the industry,
427
00:19:58,665 --> 00:20:00,845
you will find more accountants, uh,
428
00:20:01,465 --> 00:20:04,405
who is coming into internal audit, uh, than more people
429
00:20:04,465 --> 00:20:06,205
who are like techno technically
430
00:20:06,485 --> 00:20:07,565
advanced or technical experts.
431
00:20:08,465 --> 00:20:11,245
Uh, but the good news, um, is, is
432
00:20:11,245 --> 00:20:14,165
that while auditors don't need to become blockchain experts,
433
00:20:14,945 --> 00:20:18,285
uh, they do need to have, uh, some basic understanding
434
00:20:18,745 --> 00:20:20,085
how these technologies work
435
00:20:20,625 --> 00:20:23,765
to effectively assess digital asset, uh, operations.
436
00:20:24,015 --> 00:20:25,845
Think of it this way, for example,
437
00:20:26,045 --> 00:20:28,005
auditors should be like translators.
438
00:20:28,705 --> 00:20:32,165
Uh, they don't need to be coders or developers, uh,
439
00:20:32,305 --> 00:20:36,485
but they need enough knowledge to understand the risks
440
00:20:36,785 --> 00:20:40,245
and, uh, controls that are unique to digital assets.
441
00:20:40,785 --> 00:20:42,605
Uh, for example, they should know
442
00:20:42,665 --> 00:20:44,845
how transactions are recorded on the blockchain,
443
00:20:45,025 --> 00:20:48,365
how wallet work, and what smart contracts are.
444
00:20:49,325 --> 00:20:51,615
This foundational knowledge will help, uh,
445
00:20:51,695 --> 00:20:55,455
auditors understand what's happening behind the scenes, uh,
446
00:20:55,755 --> 00:20:58,295
and uh, allow them to ask the right questions.
447
00:20:59,085 --> 00:21:02,345
Uh, for instance, when reviewing the security
448
00:21:02,365 --> 00:21:05,105
of crypto wallets, auditors need to know the difference
449
00:21:05,105 --> 00:21:06,225
between hot wallet
450
00:21:06,405 --> 00:21:08,665
and cold wallets, which are whether it's connected
451
00:21:08,665 --> 00:21:10,475
to internet or not, uh,
452
00:21:10,475 --> 00:21:12,235
because the risk profiles are different here.
453
00:21:12,575 --> 00:21:14,995
Uh, similarly understanding the concept of, uh,
454
00:21:15,275 --> 00:21:18,195
consensus mechanisms like proof of work or proof of stake.
455
00:21:18,955 --> 00:21:21,375
So this can help auditors evaluate the integrity
456
00:21:21,375 --> 00:21:22,575
of blockchain networks.
457
00:21:23,205 --> 00:21:26,665
That said, uh, I think auditors don't have
458
00:21:26,665 --> 00:21:28,865
to do the deep technical analysis themselves.
459
00:21:29,095 --> 00:21:31,705
They can work with technical experts, uh, whether
460
00:21:31,705 --> 00:21:33,145
that's in-house specialist
461
00:21:33,165 --> 00:21:35,825
or external consultants to assess specific risks.
462
00:21:36,575 --> 00:21:40,305
What auditors do need is the ability to identify areas
463
00:21:40,375 --> 00:21:42,425
that require more technical review
464
00:21:42,925 --> 00:21:46,185
and to communicate effectively, uh, with those experts.
465
00:21:46,865 --> 00:21:50,185
I mean, ultimately, auditors need enough technical knowledge
466
00:21:50,185 --> 00:21:51,225
to ask the right questions
467
00:21:51,225 --> 00:21:53,905
and make informed judgements, uh, about risks.
468
00:21:54,525 --> 00:21:57,265
If they feel out of their depth, they should collaborate
469
00:21:57,265 --> 00:21:58,945
with the technical experts, uh,
470
00:21:58,945 --> 00:22:00,465
who can dive into the details,
471
00:22:00,915 --> 00:22:03,985
which ensures the whatever the internal audit engagement
472
00:22:03,985 --> 00:22:06,025
that they're, that we're carrying out is, uh,
473
00:22:06,055 --> 00:22:08,225
both comprehensive and also credible.
474
00:22:09,635 --> 00:22:13,135
As digital asset technology continues to evolve,
475
00:22:13,725 --> 00:22:17,055
what trends should we, as internal auditors be ready
476
00:22:17,075 --> 00:22:18,295
for in the near future?
477
00:22:19,005 --> 00:22:20,295
What are you predicting for
478
00:22:21,715 --> 00:22:22,715
Us? So, Donna, with
479
00:22:22,715 --> 00:22:24,575
how quickly cryptocurrency
480
00:22:24,635 --> 00:22:26,775
and blockchain technology are evolving, um,
481
00:22:26,905 --> 00:22:29,495
there are definitely some key trends
482
00:22:29,495 --> 00:22:31,815
that internal auditors need to be ready for.
483
00:22:32,515 --> 00:22:36,175
One trend that's already taking shape is the increased focus
484
00:22:36,175 --> 00:22:37,495
on regulation and compliance.
485
00:22:37,635 --> 00:22:39,855
We spoke about it. I mean, we're seeing governments
486
00:22:40,015 --> 00:22:42,535
around the world, including the EU with ika,
487
00:22:42,885 --> 00:22:44,895
tighten their grip on crypto space
488
00:22:45,195 --> 00:22:47,975
to ensure investor protection and financial stability.
489
00:22:48,155 --> 00:22:50,575
So auditors will need to stay on top
490
00:22:50,575 --> 00:22:52,055
of these regulatory developments,
491
00:22:52,475 --> 00:22:55,175
not just in their local jurisdiction, uh,
492
00:22:55,175 --> 00:22:56,455
but I would say even globally.
493
00:22:57,195 --> 00:22:59,735
Uh, that's because as the cross border nature
494
00:22:59,755 --> 00:23:01,055
of crypto means,
495
00:23:01,495 --> 00:23:04,175
compliant frameworks are often usually interconnected.
496
00:23:04,275 --> 00:23:07,335
So it's not limited to your jurisdiction anymore.
497
00:23:07,965 --> 00:23:09,655
Another trend is integration
498
00:23:09,655 --> 00:23:11,815
with the traditional financial systems.
499
00:23:12,625 --> 00:23:15,525
Uh, you can see the major banks now adapting
500
00:23:15,625 --> 00:23:18,325
cryptocurrencies into their books, um,
501
00:23:18,625 --> 00:23:20,645
and it's becoming more mainstream.
502
00:23:20,745 --> 00:23:23,765
So we will see, uh, more integration
503
00:23:23,765 --> 00:23:26,245
between the crypto world and the traditional banking
504
00:23:26,265 --> 00:23:27,485
and financial services.
505
00:23:28,495 --> 00:23:31,035
Uh, this could include everything from, uh,
506
00:23:31,125 --> 00:23:34,235
banks offering crypto products to crypto exchanges,
507
00:23:34,655 --> 00:23:37,395
and collaborating with established financial institutions.
508
00:23:38,435 --> 00:23:41,335
Uh, I think for auditors, this means needing
509
00:23:41,335 --> 00:23:44,295
to assess the risk associated with such integrations,
510
00:23:45,225 --> 00:23:46,805
things like counterparty risk
511
00:23:46,945 --> 00:23:48,965
and liquidity risk, um,
512
00:23:49,255 --> 00:23:51,205
which may be the risk profile will change.
513
00:23:51,465 --> 00:23:54,045
So I think the internal auditor should be ready for that.
514
00:23:55,085 --> 00:23:57,455
Then if you think about the technology,
515
00:23:57,475 --> 00:23:59,855
the underlying technology, which is blockchain, uh,
516
00:23:59,885 --> 00:24:02,495
this adaptation is also moving into new sectors,
517
00:24:02,915 --> 00:24:04,255
not just financial sector.
518
00:24:04,435 --> 00:24:07,135
So we're already seeing blockchain being used
519
00:24:07,155 --> 00:24:10,735
for things like supply chain traceability, uh, digital
520
00:24:11,255 --> 00:24:12,815
identity management, and even,
521
00:24:13,285 --> 00:24:15,095
even I have seen it in voting systems.
522
00:24:15,675 --> 00:24:17,255
So, because, because it's,
523
00:24:17,255 --> 00:24:19,135
it's much more secure when it comes to voting, right?
524
00:24:19,135 --> 00:24:23,855
So, uh, and for auditors, this means gaining familiarity
525
00:24:24,435 --> 00:24:28,055
and, uh, with how blockchain can improve operations, uh,
526
00:24:28,055 --> 00:24:29,375
across different industries.
527
00:24:30,275 --> 00:24:31,775
As we spoke earlier, I'm,
528
00:24:31,995 --> 00:24:33,895
I'm also seeing a rise in the importance
529
00:24:33,895 --> 00:24:36,495
of cybersecurity within the crypto space.
530
00:24:36,865 --> 00:24:38,135
Since the value goes up,
531
00:24:38,135 --> 00:24:41,015
they are becoming even more attractive for hackers, right?
532
00:24:41,555 --> 00:24:44,295
So, uh, auditors need to focus on cyber threats
533
00:24:44,475 --> 00:24:45,815
and the security measures.
534
00:24:46,905 --> 00:24:49,225
Probably the last part is going to be a bit more, uh,
535
00:24:49,265 --> 00:24:51,265
unspoken, but there I see the awareness,
536
00:24:51,315 --> 00:24:53,785
which is the environmental impact of crypto mining
537
00:24:54,085 --> 00:24:55,625
and may become a bigger topic.
538
00:24:55,885 --> 00:24:59,465
Uh, and, uh, as proof of work mining continues
539
00:24:59,465 --> 00:25:02,945
to draw attention towards its energy consumption.
540
00:25:03,245 --> 00:25:05,225
Uh, we could see more regulations
541
00:25:05,245 --> 00:25:08,185
and pressures to make crypto mining more sustainable.
542
00:25:09,565 --> 00:25:11,965
I think auditors should be prepared
543
00:25:11,985 --> 00:25:14,645
to assess an organizations environmental impact,
544
00:25:15,255 --> 00:25:19,035
and whether it's aligns with evolving any G standards.
545
00:25:20,035 --> 00:25:24,205
It's so fascinating to me how much power is used
546
00:25:24,585 --> 00:25:27,285
for technology in the region I live
547
00:25:27,285 --> 00:25:28,565
in, in the United States.
548
00:25:28,995 --> 00:25:30,725
There's a lot of conversation around
549
00:25:31,535 --> 00:25:34,205
farms being turned into data centers.
550
00:25:35,065 --> 00:25:36,565
Uh, it's Wild. So,
551
00:25:37,375 --> 00:25:41,355
No, I mean, it's, uh, it's, uh, we need to speak about it,
552
00:25:41,375 --> 00:25:44,555
but like, I think everybody's focused on the,
553
00:25:44,695 --> 00:25:47,435
the financial turnout, which is blockchain is,
554
00:25:48,335 --> 00:25:50,795
and we're forgetting that part actually. Mm-hmm.
555
00:25:51,475 --> 00:25:54,725
When you were talking about future predictions
556
00:25:54,745 --> 00:25:57,525
and trends, an idea popped into my mind,
557
00:25:57,745 --> 00:26:00,725
and that was, do you think we'll ever get to a point in time
558
00:26:00,855 --> 00:26:04,645
where we can buy a cup of coffee with Bitcoin
559
00:26:04,985 --> 00:26:07,125
or crypto at a point of sale?
560
00:26:08,895 --> 00:26:10,205
Definitely. I think it's,
561
00:26:10,325 --> 00:26:12,125
I I think they're not so far from that.
562
00:26:12,625 --> 00:26:16,325
Uh, and I'm seeing right now there are a number of payment,
563
00:26:16,505 --> 00:26:20,045
uh, uh, platforms, uh, licensed in across Europe
564
00:26:20,215 --> 00:26:24,975
where you can payments by, uh, Bitcoin, not just Bitcoin,
565
00:26:25,005 --> 00:26:27,815
even, even even other coins, like I can quote one
566
00:26:27,815 --> 00:26:29,375
of the famous one, which is a called re.
567
00:26:29,645 --> 00:26:33,375
Basically, if you want to pay someone instead
568
00:26:33,495 --> 00:26:36,015
of transferring it, it has like a fi currency.
569
00:26:36,195 --> 00:26:39,375
You can it as a, uh, uh, one of the coins
570
00:26:39,515 --> 00:26:41,215
or one of the digital assets.
571
00:26:41,275 --> 00:26:43,645
So it's, it's live, it's happening, it's
572
00:26:43,645 --> 00:26:44,645
Happening. It's
573
00:26:44,645 --> 00:26:46,365
gonna come into mass scale very soon.
574
00:26:46,425 --> 00:26:48,485
The, the day where McDonald's
575
00:26:48,485 --> 00:26:51,725
or, uh, KFCO of pizzas, uh, is, is,
576
00:26:51,745 --> 00:26:54,605
is gonna accept cryptocurrency as a payment.
577
00:26:54,795 --> 00:26:56,085
It's, it's not so far away.
578
00:26:56,465 --> 00:26:58,885
So when I see that in the news, I'm gonna think back
579
00:26:58,885 --> 00:27:01,925
to this conversation on January 9th, 2025,
580
00:27:02,145 --> 00:27:04,245
and just laughed to myself, like we called it.
581
00:27:06,475 --> 00:27:09,685
Okay. Let's say you work for an organization,
582
00:27:10,705 --> 00:27:11,805
you're an internal auditor,
583
00:27:12,305 --> 00:27:16,805
and you find out that they want to adapt cryptocurrency.
584
00:27:16,935 --> 00:27:18,445
Maybe they're gonna invest in it,
585
00:27:18,785 --> 00:27:21,205
or they're gonna create a blockchain project.
586
00:27:22,615 --> 00:27:27,125
What should you do as an internal auditor to help make sure
587
00:27:27,125 --> 00:27:29,885
that that is set up in a responsible way?
588
00:27:31,265 --> 00:27:34,935
Donna, this is, this really gets to the heart of
589
00:27:34,995 --> 00:27:37,455
how internal auditors can add value, right?
590
00:27:37,455 --> 00:27:42,175
Exactly. So, uh, I think as cryptocurrency adoption grows,
591
00:27:42,315 --> 00:27:44,415
um, I think it's important for organization
592
00:27:44,435 --> 00:27:48,285
to approach it responsibly, uh, balancing the potential
593
00:27:48,285 --> 00:27:51,085
for innovation and, uh, profit with, uh,
594
00:27:51,145 --> 00:27:53,645
strong risk management practices and,
595
00:27:53,645 --> 00:27:54,965
and robust controls as well.
596
00:27:55,775 --> 00:27:59,995
Um, internal auditors have a critical role, uh, here
597
00:28:00,015 --> 00:28:03,075
to play in ensuring that this balance is maintained.
598
00:28:03,735 --> 00:28:07,075
Um, auditors should start by evaluating the
599
00:28:07,585 --> 00:28:10,355
company's strategic approach to crypto cryptocurrency.
600
00:28:11,135 --> 00:28:12,835
What's the purpose behind adapting crypto?
601
00:28:12,865 --> 00:28:15,595
Like, you know, is it trading as a payment method
602
00:28:15,775 --> 00:28:17,755
or to offer crypto related services?
603
00:28:18,695 --> 00:28:22,715
Um, I think understanding the organization's goals helps,
604
00:28:23,095 --> 00:28:26,675
uh, auditors identify the specific risks involved.
605
00:28:27,295 --> 00:28:30,395
Uh, for instance, if the organization is holding crypto
606
00:28:31,055 --> 00:28:33,475
as an investment, uh, then auditors will need
607
00:28:33,475 --> 00:28:35,115
to assess the valuation process
608
00:28:35,255 --> 00:28:37,755
and ensure that risks like market
609
00:28:37,765 --> 00:28:39,835
volatility are managed properly.
610
00:28:40,455 --> 00:28:42,955
If they're accepting crypto as payment, for example,
611
00:28:43,025 --> 00:28:46,395
then auditors must ensure that the process for converting
612
00:28:46,395 --> 00:28:48,475
to fiat currency is secure and transparent.
613
00:28:48,975 --> 00:28:51,475
So, so there are a number of things, uh, that needs
614
00:28:51,475 --> 00:28:53,795
to be considered, depending on how, how,
615
00:28:53,795 --> 00:28:55,115
how the business is gonna work.
616
00:28:55,795 --> 00:28:58,375
Second, I would say auditors can help design strong
617
00:28:58,375 --> 00:28:59,375
governance frameworks.
618
00:28:59,515 --> 00:29:02,575
So this includes, as we spoke before, defining clear roles
619
00:29:02,675 --> 00:29:05,695
and responsibilities, uh, segregating duties,
620
00:29:06,155 --> 00:29:08,415
and ensuring, uh, there's a level
621
00:29:08,415 --> 00:29:10,815
of oversight on crypto related transactions.
622
00:29:11,515 --> 00:29:13,975
As I mentioned before, risk management is also crucial.
623
00:29:14,235 --> 00:29:18,375
So auditors can help identify the unique risk associated
624
00:29:18,375 --> 00:29:20,855
with cryptocurrency, such as cyber threats
625
00:29:20,995 --> 00:29:22,415
or even counterparty risks.
626
00:29:22,975 --> 00:29:25,335
I would say auditors should emphasize the importance
627
00:29:25,335 --> 00:29:27,415
of monitoring and continuous improvement as well,
628
00:29:27,925 --> 00:29:29,735
because cryptocurrency
629
00:29:30,475 --> 00:29:33,655
and the whole technology is in a fast moving space,
630
00:29:34,155 --> 00:29:36,935
so auditors should regularly review
631
00:29:36,995 --> 00:29:39,055
and update controls and processes.
632
00:29:39,685 --> 00:29:42,685
This could mean maybe conducting periodic risk assessment.
633
00:29:42,865 --> 00:29:45,525
So rather than doing it like annually, bi-annually,
634
00:29:45,525 --> 00:29:47,805
maybe you might need to do it like more frequently,
635
00:29:48,425 --> 00:29:50,165
do the risk assessment on audit and,
636
00:29:50,165 --> 00:29:52,365
and do audits on crypto activities,
637
00:29:52,945 --> 00:29:54,805
and, uh, assessing the effectiveness
638
00:29:54,805 --> 00:29:56,085
of cybersecurity controls.
639
00:29:56,915 --> 00:29:59,335
And, uh, I think being proactive
640
00:29:59,975 --> 00:30:03,535
and adapting to changes in the crypto landscape will ensure
641
00:30:03,535 --> 00:30:06,855
that the organization continues to manage risks, um,
642
00:30:07,405 --> 00:30:08,815
overall, I think effectively.
643
00:30:09,865 --> 00:30:10,915
Okay, fantastic.
644
00:30:11,855 --> 00:30:14,835
One personal tip I have would be
645
00:30:15,695 --> 00:30:19,155
for any internal auditor, assessing whether
646
00:30:19,155 --> 00:30:21,555
or not your organization has a good process
647
00:30:22,255 --> 00:30:24,595
to review the risks of new products and services.
648
00:30:24,855 --> 00:30:28,675
And that's such a, a good point is when
649
00:30:28,695 --> 00:30:32,035
before the, the thing is rolled out, is there some sort
650
00:30:32,035 --> 00:30:33,275
of risk management process, and
651
00:30:33,275 --> 00:30:35,555
that's something you can check for as an internal auditor.
652
00:30:36,065 --> 00:30:37,515
What are your final tips
653
00:30:37,655 --> 00:30:39,635
or takeaways that you wanna share
654
00:30:39,635 --> 00:30:41,115
with the internal audit community?
655
00:30:41,665 --> 00:30:43,235
With regards to digital assets?
656
00:30:44,615 --> 00:30:46,975
I think my key takeaway message, uh,
657
00:30:47,035 --> 00:30:50,055
for internal auditors would be this, stay informed,
658
00:30:50,235 --> 00:30:53,895
be adaptable, and focus on understanding the risks
659
00:30:53,955 --> 00:30:55,535
and the core of digital assets.
660
00:30:56,395 --> 00:30:59,335
Uh, the digital asset landscape is, as I said,
661
00:30:59,575 --> 00:31:02,015
evolving rapidly, and it can be overwhelming,
662
00:31:03,025 --> 00:31:05,365
but auditors play a vital role in helping
663
00:31:06,085 --> 00:31:09,485
companies navigate this space, uh, responsibly and securely.
664
00:31:10,235 --> 00:31:12,145
First, don't feel like you have
665
00:31:12,145 --> 00:31:14,705
to become an expert in blockchain or cryptocurrency.
666
00:31:15,565 --> 00:31:17,465
Uh, you don't need to be a developer,
667
00:31:17,525 --> 00:31:20,385
but you do need to develop a solid understanding
668
00:31:20,385 --> 00:31:24,275
of the fundamental concepts, um, like I said, like how
669
00:31:24,805 --> 00:31:27,715
blockchain works, what are the risk associated
670
00:31:27,715 --> 00:31:30,655
with different types of digital assets, uh,
671
00:31:30,715 --> 00:31:32,295
and the regulatory environment.
672
00:31:32,935 --> 00:31:35,375
I think this knowledge will empower you
673
00:31:35,395 --> 00:31:38,615
to ask the right questions, uh, when you, when you go
674
00:31:38,615 --> 00:31:41,655
for meetings or when you ask the, your process owners
675
00:31:42,435 --> 00:31:44,575
and assess the risks, uh, appropriately.
676
00:31:45,645 --> 00:31:47,725
I would also say maybe embrace collaboration.
677
00:31:47,785 --> 00:31:51,405
So the world of digital assets is very complex, so,
678
00:31:51,985 --> 00:31:54,805
and you will likely need to work closely with, uh,
679
00:31:54,835 --> 00:31:56,365
some technical experts
680
00:31:56,465 --> 00:31:58,765
and maybe the le maybe even legal advisors
681
00:31:59,105 --> 00:32:00,925
and even specialist.
682
00:32:01,225 --> 00:32:05,285
So collaboration is key to ensuring you have a holistic view
683
00:32:05,305 --> 00:32:08,605
of the organizations' operations and risk environment.
684
00:32:08,935 --> 00:32:10,005
Third, be proactive.
685
00:32:10,005 --> 00:32:13,085
As I said, I mean, the risk associated with digital assets,
686
00:32:13,335 --> 00:32:16,695
especially in areas like cybersecurity, uh,
687
00:32:16,805 --> 00:32:18,015
require forward thinking.
688
00:32:18,395 --> 00:32:21,175
Um, so don't wait issues to arise.
689
00:32:21,395 --> 00:32:23,695
Um, try to implement robust controls
690
00:32:24,395 --> 00:32:27,935
and staying ahead of, uh, emerging risks, uh, essential
691
00:32:28,715 --> 00:32:32,135
for maintaining the integrity of, uh, company's operations.
692
00:32:32,695 --> 00:32:34,455
I think to summarize, I would say, uh,
693
00:32:34,505 --> 00:32:36,535
maybe stay adaptable and be curious.
694
00:32:37,175 --> 00:32:39,525
I think I sounded like, uh, uh, Steve Jobs.
695
00:32:43,625 --> 00:32:45,805
No, I love it. I've really enjoyed the conversation.
696
00:32:45,805 --> 00:32:47,845
Thank you so much for sharing your expertise
697
00:32:48,865 --> 00:32:51,805
and uh, I hope you have a wonderful 2025.
698
00:32:52,245 --> 00:32:53,965
I feel like I'm gonna log off
699
00:32:53,965 --> 00:32:55,725
and go check my Bitcoin balances
700
00:32:55,755 --> 00:32:58,565
because I bought back in like 2021.
701
00:33:00,775 --> 00:33:03,525
Thank you, Donna. I really enjoyed, uh, this conversation
702
00:33:03,625 --> 00:33:06,285
and, uh, I wish should put 2025 as well.
703
00:33:07,945 --> 00:33:10,685
If you like this podcast, please subscribe and rate us.
704
00:33:10,985 --> 00:33:13,245
You can subscribe wherever you get your podcasts.
705
00:33:13,585 --> 00:33:17,685
You can also catch other episodes on YouTube or@theia.org.
706
00:33:17,945 --> 00:33:20,965
That's tia.org.
