Audit evidence for company bitcoin

Last checked 31 October 2026. Your auditor decides what evidence is enough. This page lists what auditing guidance says they look for, so you can prepare. If anything here conflicts with the linked source, the source wins.

For bitcoin, the hard audit questions are not about price. They are whether the company really controls the coins on the balance sheet date, whether anyone else can move them, and whether the records are complete. Auditing standards on both sides of the Atlantic ask for sufficient, appropriate evidence, and say evidence from independent sources is generally more reliable than evidence the company produces itself.

Source: PCAOB: AS 1105: Audit evidence, FRC: ISA (UK) 500: Audit evidence.

What auditors ask for

The PCAOB has reminded auditors that being able to see or use a private key is not, on its own, enough evidence of who owns the bitcoin, that controls over how keys are generated matter, and that data from a block explorer needs its reliability assessed. ICAEW guidance says auditors are often present at key and wallet generation ceremonies, look at who has access to which keys, and check the block chain for signs that someone else is using the wallet.

Source: PCAOB: Spotlight: Observations and reminders on audits involving crypto assets (June 2023, PDF), ICAEW: Considerations for auditing cryptocurrencies.

Proving control without moving funds

1. Watch-only access

   Give the auditor the wallet descriptor or extended public keys. A watch-only wallet shows every address, balance and transaction, but cannot spend. It proves existence and completeness for that wallet, not control.

   Source: Bitcoin BIPs: BIP 380: Output script descriptors, general operation (wallet backups and exports), Bitcoin BIPs: BIP 32: Hierarchical deterministic wallets (extended keys).

2. Signed message

   The auditor chooses a short message, such as their firm name and the date. The company signs it with the keys behind an address, and the auditor verifies the signature. BIP 322 defines a general format, including proof of funds, and notes that a multisig signature needs the signers to coordinate. Wallet support varies, so test it with your auditor before year end.

   Source: Bitcoin BIPs: BIP 322: Generic signed message format (proof of funds, multisig).

3. Observed signing

   An auditor can observe two keyholders sign a transaction that is not broadcast, showing the quorum works. A small payment to yourself proves the same thing on the public ledger, but costs a network fee.

   Source: Bitcoin BIPs: BIP 174: Partially Signed Bitcoin Transaction format (PSBT).

If a custodian holds the bitcoin

Auditors usually ask for a confirmation from the custodian and look at the custodian's independent controls report (an ISAE 3402 or SOC 1 report). Our custodian questionnaire covers how to ask for these before you sign.

Source: ICAEW: Considerations for auditing cryptocurrencies, AICPA and CIMA: System and Organization Controls: the SOC suite of services.

A year end evidence pack

• Wallet descriptors and the list of every wallet and account.
• Key register: who holds which key, where, since when.
• Key ceremony and recovery drill records.
• Transaction list with dates, amounts, transaction IDs and board approvals.
• Price source and time stamps for valuation.
• Custodian statements, confirmations and controls report, if used.

How long to keep records

Under the Companies Act, a private company must keep its accounting records for 3 years and a public company for 6 years. For tax, GOV.UK says "You must keep records for 6 years from the end of the last company financial year they relate to", and the company can be fined £3,000 for not keeping them.

Source: legislation.gov.uk: Companies Act 2006, section 388: where and for how long records to be kept, GOV.UK: Running a limited company: company and accounting records.

The IRS says to keep records for 3 years in general, 6 years if income was under-reported by more than 25%, 7 years for a claim for a loss from worthless securities or bad debt, and employment tax records for at least 4 years.

Source: IRS: How long should I keep records?.

Read next

• Accountant's corner, rules and exports.
• Recovery drill guide, a record that doubles as evidence.
• US company accounting under ASU 2023-08.

Sources

Primary sources only. Each link was checked on 31 October 2026. Rules change, so confirm the current version with your adviser.

1. PCAOBAS 1105: Audit evidence
2. FRCISA (UK) 500: Audit evidence
3. PCAOBSpotlight: Observations and reminders on audits involving crypto assets (June 2023, PDF)
4. ICAEWConsiderations for auditing cryptocurrencies
5. Bitcoin BIPsBIP 380: Output script descriptors, general operation (wallet backups and exports)
6. Bitcoin BIPsBIP 32: Hierarchical deterministic wallets (extended keys)
7. Bitcoin BIPsBIP 322: Generic signed message format (proof of funds, multisig)
8. Bitcoin BIPsBIP 174: Partially Signed Bitcoin Transaction format (PSBT)
9. AICPA and CIMASystem and Organization Controls: the SOC suite of services
10. legislation.gov.ukCompanies Act 2006, section 388: where and for how long records to be kept
11. GOV.UKRunning a limited company: company and accounting records
12. IRSHow long should I keep records?

Next step: your own node. Once the keys, backups and drill are in place, a company can check the chain itself. Running your own bitcoin node.