A Bitcoin audit tests the same things as any other asset audit: that the asset exists, that the company owns it, that it is valued correctly and that the records are complete. What is different is the evidence. Bitcoin sits on a public ledger and is controlled by private keys, so auditors need to see proof of control, reliable custody records and a clear pricing policy.
This checklist sets out what finance teams should prepare before their first year-end audit with Bitcoin on the balance sheet.
What auditors will focus on
Audit work on Bitcoin generally covers five assertions.
| Assertion | The question auditors ask | Typical evidence |
|---|---|---|
| Existence | Does the Bitcoin exist at the reporting date? | Custodian confirmations, on-chain verification |
| Rights and obligations | Does the company control it, and is it free of claims? | Custody agreements, proof of control, review of pledges |
| Valuation | Is it measured correctly under the framework? | Pricing source, principal market analysis, cut-off policy |
| Completeness | Are all holdings and transactions recorded? | Reconciliations, trade confirmations, wallet listings |
| Presentation and disclosure | Are the accounts and notes correct? | Policy documents, disclosure workings, roll-forward |
Professional bodies have published practice guidance on auditing digital assets. Your audit firm will apply its own methodology, so engage early.
Existence and ownership
Proving that Bitcoin exists and belongs to the company is the core of the audit.
If you use a third-party custodian:
- Obtain a direct confirmation of balances from the custodian at the reporting date.
- Provide the custody agreement, showing that assets are segregated and held for the company.
- Obtain the custodian's independent controls report (often a SOC 1 Type 2 report) and review any exceptions.
- Document complementary user entity controls the custodian expects you to operate.
If you hold keys directly or through a multisig arrangement:
- Be ready to demonstrate control, for example by signing a message with the relevant key or moving a small test amount at the auditor's request.
- Provide documented key management procedures, signer lists and approval rules.
- Show how keys are backed up and how access is restricted.
See corporate Bitcoin custody: the options explained for the custody models auditors will encounter.
Valuation
Under the FASB standard on digital assets (ASU 2023-08), in-scope holdings are measured at fair value. Under IFRS, they are generally measured under IAS 38 or IAS 2. Either way, auditors will test the numbers.
Prepare:
- A written analysis identifying the principal market the company can access.
- The pricing source used and why it is reliable.
- A fixed cut-off time for period-end valuation, applied consistently.
- For IFRS cost-model reporters, the impairment assessment and supporting workings.
For background, see ASU 2023-08: fair value accounting for Bitcoin explained and how Bitcoin is accounted for under IFRS.
Completeness and reconciliations
Auditors will want to see that every transaction is captured and that the ledger agrees to custody.
- Maintain lot-level records for every acquisition and disposal, with trade confirmations.
- Reconcile custody balances to the general ledger at least monthly.
- Track transfers between the company's own accounts or wallets.
- Record fees, and confirm their treatment is consistent with policy.
- Keep a full list of addresses and accounts controlled by the company.
The cost basis method should be documented and applied consistently. See cost basis methods for corporate Bitcoin holdings.
CFO tip: run a dry-run audit at your first quarter-end. Ask your team to produce the full evidence pack as if the auditor had requested it. Gaps found in month three are cheap to fix; gaps found at year-end are not.
Controls
Bitcoin transactions are generally irreversible. That makes controls over initiation and approval especially important.
Auditors will typically look for:
- Authorisation. A board-approved Bitcoin treasury policy setting limits, approvers and permitted counterparties.
- Segregation of duties. The person who initiates a trade or transfer should not be the person who approves or records it.
- Multi-person approval for withdrawals and transfers, enforced by the custody setup.
- Address whitelisting, so transfers can only go to pre-approved destinations.
- Access management, including prompt removal of leavers from signing and platform access.
- IT general controls over any systems used to record or report Bitcoin.
Related parties, restrictions and other disclosures
Auditors will also ask about:
- Any Bitcoin pledged as collateral or subject to sale restrictions.
- Any lending or borrowing arrangements involving Bitcoin.
- Transactions with related parties.
- Significant changes in value after the reporting date.
Under ASU 2023-08, specific disclosures are required on significant holdings, cost basis, restrictions and an annual roll-forward. Build the templates in advance.
The pre-audit checklist
- Accounting policy for Bitcoin approved and documented.
- Treasury policy approved by the board.
- Custody agreements and controls reports on file.
- Custodian confirmation process agreed with the auditor.
- Pricing source, principal market and cut-off time documented.
- Lot-level records complete and reconciled.
- Signer lists and key management procedures current.
- Disclosure templates drafted and reviewed.
- Tax treatment reviewed with advisers.
Companies should take their own accounting, tax and legal advice, and agree the audit approach directly with their auditors.
How The Bitcoin World helps
We help finance teams build the policy, record-keeping and evidence pack that a Bitcoin audit requires, and we structure execution so that every trade produces clean, reconcilable confirmations. Execution and custody are carried out by licensed third-party institutions. See our custody architecture and board advisory services.