Audit

An audit is an independent examination of an organisation's records, statements, systems or processes to assess whether they are accurate, complete and in line with a set of rules or standards. The best-known type is the financial statement audit, in which an external auditor gives an opinion on whether a company's financial statements present a true and fair view under frameworks such as US GAAP or IFRS. Audits are also carried out on tax returns, compliance programmes, IT systems and, in crypto, smart contract code.

Audits exist because owners, lenders, regulators and the public cannot check an organisation's books themselves. An independent review adds credibility. Listed companies, banks and many large private firms are legally required to have annual audits, while others commission them voluntarily for lenders or investors. In the United States, audits of listed companies follow standards set by the Public Company Accounting Oversight Board.

Imagine a club treasurer who says the club has $5,000 in the bank. Members could take her word for it, or they could ask an outsider to check the bank statements, receipts and spending records and report back. That check is an audit. The outsider does not run the club; they just say whether the numbers can be trusted.

Auditors rarely check every single receipt. They test samples, look for unusual items and ask hard questions where mistakes or fraud are most likely. Their report gives reasonable comfort, not a guarantee.

• External financial audit. An independent firm examines annual accounts and issues an opinion published in the auditor's report.
• Internal audit. A company's own team reviews risks, controls and processes and reports to management and the audit committee.
• Tax audit. A tax authority such as the Internal Revenue Service examines returns to check what is owed.
• Compliance audit. A review of whether a firm follows laws and policies, such as an AML audit of an anti-money laundering programme.
• IT and security audit. An assessment of systems, access controls and data protection, often against recognised standards.
• Smart contract audit. A code review of blockchain contracts to find bugs and vulnerabilities before deployment.

1. Planning and risk assessment. The auditor learns the business, sets materiality and identifies areas where misstatement is most likely.
2. Testing controls. The auditor evaluates internal controls, such as segregation of duties and approval processes.
3. Substantive testing. The auditor checks balances and transactions through confirmations with banks and customers, physical inventory counts, recalculations and analytical review.
4. Evaluating estimates and disclosures. The auditor challenges judgements such as valuations and provisions and considers whether the going concern assumption is appropriate.
5. Reporting. The auditor issues an opinion and communicates key matters to those charged with governance.

An unqualified, or clean, opinion means the auditor found the statements fairly presented in all material respects. A qualified opinion flags a specific material problem. An adverse opinion says the statements as a whole are materially misstated, and a disclaimer means the auditor could not obtain enough evidence to form an opinion. Reports may also include a paragraph on material uncertainty about going concern. Statements that have been through this process are referred to as audited financial statements.

Crypto firms face audit questions of their own. Exchanges and stablecoin issuers have often published attestations or proof of reserves reports rather than full audits, which check assets at a point in time but may not cover liabilities or controls. Auditing digital assets requires evidence that the firm controls the private keys, not just that coins sit at an address. Smart contract audits, carried out by specialist security firms, reduce but do not eliminate the risk of hacks, and many exploited protocols had been audited.

Audits provide reasonable, not absolute, assurance. They rely on sampling, management information and judgement, and collusion or sophisticated fraud can evade them. High-profile failures, such as the collapses of Enron in 2001 and Wirecard in 2020, led to reforms and debate about auditor independence, scepticism and the concentration of large-company audits among the Big Four firms.