IIA District Conference

Unlocking Blockchain -Overview and Risks

Bernie WiegerPartner, IT AdvisoryAugust 2019

DRAFTDRAFT

2© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Source: https://www.youtube.com/watch?v=RplnSVTzvnU&feature=youtu.be

Bettina Warburg Ted Talk - How the Blockchain will radically transform the economy (Dec 8, 2016)Say hello to the decentralized economy -- the blockchain is about to change everything. In this lucid explainer of the complex (and confusing) technology, Bettina Warburg describes how the blockchain will eliminate the need for centralized institutions like banks or governments to facilitate trade, evolving age-old models of commerce and finance into something far more interesting: a distributed, transparent, autonomous system for exchanging value.

From “Accounting Today” on March 27, 2018“’In the future, virtually every function in the world of financial services will be displaced, disintermediated and decentralized,” said Ron Quaranta, chairman of the Wall Street Blockchain Alliance during an American Institute of CPAs / CPA.com Executive Roundtable in February. “The Internet gave us a powerful way to share and access information. Blockchain now gives us a powerful way to share and access value”. Like most forms of technology, Blockchain in accounting and audit greatly reduces the potential for errors when reconciling complex and disparate information from multiple sources. Further, accounting records are not alterable once committed under Blockchain, even by the owners of the accounting system. Because every transaction is recorded and verified, the integrity of financial records is guaranteed. While impressive, this technology has the potential to greatly reduce or even eliminate the need for auditing resources — potentially disrupting the accounting profession as a whole.

“How the blockchain will radically transform the economy”

3© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Blockchain: Why it MattersWe are in the early stages of economic and societal transformation driven by the Blockchain. Blockchain is designed to establish digital trust between strangers without reliance on a third-party intermediary.

The Blockchain concept is important because it represents a technological framework for decentralization. Many industries, such as banking, credit scoring, money transfers, etc.., rely on someone in the middle to manage the integrity of the system, and they usually charge a significant fee in the process. Once they become one of—or the—standards, they can change rules, fees, etc. without much ability for consumers to object.

The Blockchain changes this by offering a system whereby the users themselves manage the entire process, and where there is full transparency into costs, fees, etc.

Source: A Blockchain Primer, https://danielmiessler.com/study/blockchain/#gs.ubwdcZI retrieved 9/5/2017

4© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Barclays and innovative start-up company Wave have become the first organisations to execute a global trade transaction using blockchain technology. The letter of credit transaction between Ornua (formerly the Irish Dairy Board) and Seychelles Trading Company is the first to have trade documentation handled on the new Wave platform, with funds sent via Swift. https://www.barclayscorporate.com/insight-and-research/trading-and-exporting/blockchain-revolution-in-trade-finance.html(9/2016)

Uses of blockchain

Nasdaq, Inc. and Citi Treasury and Trade Solutions announced today a new integrated payment solution that enables straight through payment processing and automates reconciliation by using a distributed ledger to record and transmit payment instructions. A number of payment transactions have been concluded, including Citi's automated processing of cross-border payments. This collaboration has created a pioneering institutional banking solution that tightly integrates blockchain technology with Citi's global financial network. http://www.citigroup.com/citi/news/2017/170522a.htm (5/22/2017)

Seven firms representing various stakeholders in the credit default swaps trading process [including Citi] today announced they successfully tested replicating the process using blockchain technology. The announcement is the latest that signals an acceleration of the rate at which financial incumbents are embracing both blockchain technology and distributed ledgers. https://www.coindesk.com/blockchain-credit-default-swaps-wall-street/ (4/7/2016)

The first cross-border transaction between banks using multiple blockchain applications has taken place, Commonwealth Bank of Australia and Wells Fargo & Co said on Monday, resulting in a shipment of cotton to China from the United States. The blockchain trade, for 88 bales, totaled $35,000, Commonwealth Bank told Reuters. https://www.reuters.com/article/us-australia-tech-banks/major-banks-mark-first-ever-international-trade-using-blockchain-tech-idUSKCN12O0DX (10/24/2016)

Barclays

Citibank

Wells Fargo

5© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Shareholder records in DelawareBlockchain got a big boost on Tuesday [August 1, 2017] when a Delaware law went into effect that lets corporations maintain shareholder lists, along with other corporate records, using [blockchain] technology. Already, several companies, including the retailer Overstock, say they intend to use [blockchain for business transactions]. (Source: Fortune August 1, 2017 http://fortune.com/2017/08/01/blockchain-shareholders-law/ )Land registry in SwedenSweden’s land registry authority is called the Lantmäteriet. Since last June [2016] the body has been testing a way to record property transactions on a blockchain. This could save the Swedish taxpayer over €100 million ($106 million) a year by eliminating paperwork, reducing fraud, and speeding up transactions, according to an estimate by the consultancy Kairos Future, which is also involved in the project. (Source: Quartz April 3, 2017 https://qz.com/947064/sweden-is-turning-a-blockchain-powered-land-registry-into-a-reality/ )NHS Healthcare records (UK)Google’s AI-powered health tech subsidiary, DeepMind Health, is planning to use a new technology, [blockchain,] to let hospitals, the NHS and eventually even patients track what happens to personal data in real-time.Dubbed “Verifiable Data Audit”, the plan is to create a special digital ledger that automatically records every interaction with patient data in a cryptographically verifiable manner. This means any changes to, or access of, the data would be visible. (Source: The Guardian March 9, 2017 https://www.theguardian.com/technology/2017/mar/09/google-deepmind-health-records-tracking-blockchain-nhs-hospitals )

Government Use Cases on Blockchain

6© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Example uses of BlockchainAsset Titles Diamonds Designer brands Car leasing & SalesHome Mortgages & payments Land title ownershipDigital asset records

GovernmentVotingVehicle registrationWIC, Vet, SS, benefits, distribution Licensing & identification Copyrights

IdentityPersonalObjectsFamilies of objects Digital assets Multifactor Auth Refugee tracking Education & badgingPurchase & review tracking Employer & Employee reviews

MediaDigital rights managementGame monetizationArt authenticationPurchase & usage monitoring Ticket purchasesFan trackingAd click fraud reduction Resell of authentic assetsReal time auction & ad placements

Computer Science Micronization of work (pay for algorithms, tweets, ad clicks, etc..) Expanse of marketplace Disbursement of workDirect to developer payments API platform plays Notarization & certificationP2P storage & compute sharing DNS

MedicalRecords sharing Prescription sharing Compliance Personalized medicine DNA sequencing

IoTDevice to Device payments Device directories Operations (e.g. water flow) Grid monitoringSmart home & office management Cross-company maintenance markets

PaymentsMicropayments (apps, 402) B2B international remittance Tax filing & collection Rethinking wallets & banks

ConsumerDigital rewardsUber, AirBNB, Apple PayP2P selling, craigslistCross company, brand, loyalty tracking

Supply ChainTrade finance (L/Cs)Provenance/Chain-of-custody integrityDynamic ag commodities pricing Real time auction for supplydelivery Pharmaceutical tracking & purity Agricultural food authentication Shipping & logistics management

FinancialTradingDeal originationPOs for new securities EquitiesFixed income Derivatives tradingTotal Return Swaps (TRS) 2nd generation derivativesThe race to a zero middle office Collateral management SettlementsPayments Transferring of valueKnow your client (KYC) Anti money laundering (AML)Client and product reference data.Crowd FundingPeer-to-peer lending Compliance reportingTrade reporting & risk visualizations Betting & prediction markets

InsuranceClaim filings MBS/Property paymentsClaims processing & admin Fraud prediction Telematics & ratingsSmart contracts for policies

Source: KPMG research and analysis

7© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Blockchain 2.0The possibilities for programmable money and contracts were baked into the protocol

Jan 2009 Jan 2017Jan 2011 Jan 2013 Jan 2015

Blockchain

Protocol

Currency

Market cap

italization

for B

itcoin

Bitcoinis digital cash and transacted via the Internet. It was created as a purely peer-to-peer online payment system without banks.Due to its nature, Bitcoin and the Blockchain can be described as a self-updating, open spreadsheet.

A brief history of Blockchain

Advancing from BitcoinSince 2011, various other cryptocurrencies have developed and advanced upon the Bitcoin protocol, albeit none were as successful as Bitcoin. Ripple e.g. aims to address corporate customers, while Ethereum focuses on Smart Contract capabilities. Banks have noticed and started to invest heavily in 2014

Bitcoinwas introducedin a White Paper by Satoshi Nakamoto

Blockchain captures interestin Fintech & Financial Institutions

$462 millioninvested in 2015 alone asBlockchain R&D activities accelerate

Blockchain gainsmedia interests

$921 millionCumulative VC investment in Blockchain companies

>805Blockchain start-ups

$2 billion in the U.S. and

$6 billion globally estimated annual capital markets savings from Blockchain technologies according to Goldman Sachs report

8© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Blockchain: What is it?Definition: • Decentralized database using peer-to-peer network• Orders transactions• Verifies transactions through consensus• Chronologically records transactions • Securely records transactions with a cryptographic

audit trail

Also called “distributed ledger technology” or “DLT”.

Source: A Blockchain Primer, https://danielmiessler.com/study/blockchain/#gs.ubwdcZI retrieved 9/5/2017

9© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

How Blockchain worksIBM Think Academy: Blockchain, How it Works (3:34)

10© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Blockchain: What is it used for?A foundational shift in record keeping.

Recording the transfer of value. Value could be a • Service• Product• Approval

11© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Blockchain: Basics of Smart ContractsComputer Program/Code

Works primarily off an If/Then series of statementsExample 1: Simple Contractor Assignment• if contractor A completes his assigned task, then the contractor requests an

inspection• If the inspector accepts the quality and the completeness of the work, then

contractor A is paid• The recording of this series of transactions are completed on the Blockchain

and replicated to the peer-to-peer computers of the related parties

For a construction smart contract, human input would be needed to clarify requirements. Additionally, approvals of pre-construction and construction phases could be recorded.

12© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Blockchain: Basics of DAOA Decentralized Autonomous Organization can be created and run via rules encoded into the smart contracts. The Project Schedule could be and example of a DAO.

Example of smart contracts within a Construction DAO are:

1. If the architect and engineers create a 3D building model, then the owner’s respective fund’s will be paid.

2. The General Contractor will establish further key milestones in the project as wall as related funds to be released at that point.

3. These milestones become the basis to form hundreds of smart contracts with the owner.

13© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Blockchain: Basics of DAO (cont)

4. Additionally the subcontractors form the same type of smart contract with the General Contractor.

5. Upon completion and verification of the completed work, funds move automatically from the General Contractor to the Subs.

6. The recording of this series of transactions are completed on the Blockchain and replicated to the peer-to-peer computers of the related parties

14© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Potential Benefits of BlockchainFully digitized trade cycle

reduces # of apps and

infrastructure

Operational efficiencies

due to blockchain inherent

automation

Settlement time reduced to near real

time

Lower compliance and

regulatory coverage costs

Lower risk management

costs

Cost of capital reduced due to lesser balance sheet exposure

Cos

t sa

ving

sQ

ualit

ativ

e be

nefit

s

Compliance through audit

trail

Transparency of history of

events

Immutability: Data stored in multiple

locations

Regulatory automation

Record of consensus, cryptographically determined,

auditable trail

Counterparty and settlement risks addressed in

permissioned systems

Can introduce unprecedented cohesion to the internal record-keeping

process

Source : Accenture Capital Markets Blog/ Author: Sigrid Seibold

15© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

— Multiple parties transact

— All transactions are recorded including transaction’s date, time, parties and amount wants to do a transaction

— The transaction is added in order into a network’s ‘block’ and presented

— Entries can be added but not deleted

— Each node in the network owns a full copy of the ledger

— The ‘block’ is broadcasted to every party and their nodes in the network

— Network of computer nodes verifies, validates by running a software which continuously replicates the ledger

— The network, verifies, validates and approves; the confirmation is broadcasted to the other nodes

— Consensus (agreed mathematical mechanism) is recorded and provides the basis for trust mechanism

— The confirmed block is added in a linear and chronological order to the chain

— That provides a transparent record of transactions; Audit trail; traceable digital fingerprint

— Data is pervasive and persistent and creates a reliable transaction record

— Nodes have access to can be a shared single source of truth

— A completed block gives way to the next block in the blockchainConsensus Mechanism Applied

Initiate transactionPost & Record transaction to

the networkBroadcast

Validate via Consensus and confirm

Immutable, encrypted BlockTransaction completed

1 2 3 4 5 6

4

31

2

BLOCKS

5

6

1

1

How do Blockchains work?

Source: KPMG Research

16© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

—Multiple parties transact—All transactions are recorded including

transaction’s date, time, parties and amount wants to do a transaction

Initiate transaction

1

1

2

1

1

How do Blockchains work?

Source: KPMG Research

17© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

1

2

1

1

How do Blockchains work?

Source: KPMG Research

— The transaction is added in order into a network’s ‘block’ and presented

—Entries can be added but not deleted

—Each node in the network owns a full copy of the ledger

Post & Record transaction to the network

2

18© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

How do Blockchains work?

Source: KPMG Research

—The ‘block’ is broadcasted to every party and their nodes in the network

—Network of computer nodes verifies, validates by running a software which continuously replicates the ledger

—The network, verifies, validates and approves; the confirmation is broadcasted to the other nodes

—Consensus (agreed mathematical mechanism) is recorded and provides the basis for trust mechanism

Consensus Mechanism Applied

Broadcast Validate via Consensus and confirm

3 4

4

3

19© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

—The confirmed block is added in a linear and chronological order to the chain

—That provides a transparent record of transactions; Audit trail; traceable digital fingerprint

—Data is pervasive and persistent and creates a reliable transaction record

Immutable, encrypted Block

5

BLOCKS

5

6

How do Blockchains work?

Source: KPMG Research

20© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

BLOCKS

5

6

How do Blockchains work?

Source: KPMG Research

—Nodes have access to can be a shared single source of truth

—A completed block gives way to the next block in the blockchain

Transaction completed

6

FOR INTERNAL USE ONLY

Blockchain Risks

22© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Why is Blockchain important to KPMG and Other Auditors?1. Our clients are accepting Blockchain currencies for services.

2. Our clients may have investments in Blockchain currencies at year end, e.g., Bitcoin. There are 16.9 million bitcoins in existence which have been valued at more than $7,700 per bitcoin. With over $130 billion in digital assets in existence for bitcoin alone, we are starting to see these assets appear on the balance sheets of our audit clients.

3. Our clients are participating in Blockchain platforms and consortia and exploring uses of Blockchain technology within their client facing product suite. Engineering and Construction are no different and their product and product delivery will change.

4. As client’s internal processes change to adopt Blockchain, the manner in which we audit those processes and related risks will have to change. This is true for Internal Audit as well.

23© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Blockchain Risks Attributable to All Blockchains• System Interoperability & Integration Risk– The extent to which systems and devices can exchange

data, and interpret that shared data and thus there is a risk that Blockchain systems don’t speak the same language as the other or integrate with legacy applications. Blockchains are complex platforms with varying levels of smart contract functionality, transaction schemes, and consensus models.

• Auditability – While there is improved auditability as all participants will access a common ledger for recording and reporting transaction, a company may not be able to move ahead with initiatives due to Legal, Compliance or Internal Audit not being able to “audit” or independently verify the Blockchain before it is place in service. Additionally there may be contractual obligations between parties which will need to monitored for compliance.

• Control & Collusion - Conceivably, Blockchain systems could be vulnerable to fraud, if a significant minority of participants colluded to defraud the rest*** Cyber attacks where an unauthorized individual can take over 51% of the network nodes, could introduce false blocks and achieve consensus through it’s 51% control of the nodes.

• Scalability and Performance – Every recordable transaction requires peer-to-peer verification, which can become time-consuming with the number of blocks involved. As more users incur more transactions, it takes longer for verification, with waiting times increasing. Blockchain technology is still unproven and whose capacity has not been tested. Low transaction speed may impact scalability as the technology introduces delays. ***Source: Business Insider http://www.businessinsider.com/us-government-warns-of-blockchain-risks-2016-6

24© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Blockchain Risks Attributable to All Blockchains• Business Continuity and Disaster Recovery Risk – While resilient to disaster incidents due to its redundancy

feature, Blockchains could be vulnerable to technology and operational failures. Additionally, since Blockchainsdepend on a rapid consensus to function, the recovery time objective for these systems is usually heightened. Inadequate incident response management could cause significant delays in responding to issues with the Blockchain operation.

• Strategic Risk – Adopting the wrong Blockchain platform could limit the capabilities of the company.

• Account/Wallet Security – Blockchain provides transaction security however does not provide account/wallet security. Possibility of account takeover and theft of value could occur with inappropriate key management.

• Talent Management Risk – There is a limited number of technical specialists and wages for these specialists continue to escalate.

• Regulatory and Compliance Risk – Much regulation and compliance requirements are still yet to be seen and could pose a risk of hampering a company’s Blockchain initiatives. Each country may different privacy and data protection laws that may prevent cross-border transactions.

• Third Party Risk – Since most of the Blockchain Technology is sourced from external vendors, third party vulnerabilities may expose companies to significant risks.

• Privacy Risk – Will immutable Blockchains continue to store information that a user ( for example under GDPR) may want to remove.

25© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Additional Value Transferred Blockchain Risks • Consensus Mechanism and Network Management – As each Blockchain framework uses a

cryptographic protocol to determine consensus, the protocol should be operating according to the requirements of the participants and the requirements of the use case however consensus protocol flaws could exist.

• Key Management and Cryptography – Effective key management is essential because consensus protocols are susceptible to theft of private keys and therefore a potential loss of digital assets. While transactions are stored in an encrypted format, certain metadata is always available to participants and can be used to monitor activity and volume thus causing concern over confidentiality.

• Counter Party Risk – As opposed to current business practices where an intermediary assumes the counter party risk, the Blockchain environment relies on the dispute resolutions arrangements made when the Blockchain initiated.

26© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Additional Smart Contract Blockchain Risks • Legal Risk – Smart contracts need to fully define the legal arrangements between the

participants of the network. Areas such as exception handling need to fully thought through and be in unison with other smart contracts that might exist on the network. Enforcement of smart contracts has not been tested in the courts. Areas such as legal liability for improper administration of a smart contract when a loss of digital assets occurs in many cases has not been defined.

• Regulatory Risk - Smart contracts need to be compliance with regulations which may span, cities, states and countries. Currently few if any regulations govern smart contracts.

• Smart Contract Information Security Risks – Smart contracts may be open to security breaches or improper administration and governance. Inadequate change control over new or amendments to existing smart contracts could expose the unintended results.

• Oracle/Agent Risk – Oracles are agents that find and verify real-world occurrences (i.e. payments, price changes..) and submits this information into a smart contact. Smart contracts use this information to execute predefined algorithms and thus trigger an event on the Blockchain. Malicious attacks on these Oracles could cause inaccurate information to be submitted into the Blockchain which could cause events to be prematurely triggered.

27© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Source: prepared by KPMG audit staff

Cx

C7

C2

Blockchain Control

28© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

• W1: Access is not appropriately provisioned/de-provisioned for the Blockchain nodes (assuming not a public Blockchain)

• This risk would potentially be addressed by access controls covered by a SOC-1 type report over the Blockchain (C, A)

• W2: Critical terms of the trade are not correct in the Smart Contract

• C2: Smart Contract terms are authenticated by the counterparty on the Blockchain (E, A)

• W3: Smart Contract is not transmitted to the Blockchain / W4: Consensus on the Blockchain is not achieved for the Smart Contract

• Management reviews a report of unexecuted Smart Contracts, following up with front office personnel to ensure there is a plan for authentication (C)

• Generation of unexecuted Smart Contracts (IPE)

• W5: The consensus configuration of the Blockchain is not appropriate / W6: Incorrect transactions (new blocks) are recorded on the Blockchain

• This risk would potentially be addressed by testing the consensus configuration and related change management controls as part of a SOC-1 type report over the Blockchain (E, A)

• W7: The Smart Contract is not designed correctly

• C7: Management tests the configuration of the Smart Contract (C, A)

• W8: Off-chain transaction information does not reconcile to on-chain transaction information

• Automated matching configuration control in the back-end system of record (A)

• Management reviews the exception report and resolves mismatched items (A)

• Generation of exception report showing mismatches between on-chain and off-chain data (IPE)

• W9: Data from the Blockchain does not interface to the back-end system of record correctly

• Configuration of system-generated reports output from the Blockchain (C, A)

Identified risk points, control objectives, and assertions to consider:

Inputs Blockchain Processing Reporting

Blockchain audit considerations (What Can Go Wrong (Cont’d))

Source: prepared by KPMG audit staff

FOR INTERNAL USE ONLY

Blockchain Resources Referenced

30© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

FOR INTERNAL USE ONLY

Eamon Maguire, Partner, Global Head of Digital Labor Services and Global lead for blockchain

David Montes, Managing Director, US Lead for blockchain in the financial industry

Packy Kelly, Audit BUPIC, blockchain lead partner

Erich Braun, Audit Partner, blockchain lead partner

Bernie Wieger, IT Attestation Partner, blockchainlead partner

Twitter

@blockchain, @Bitcoin, @coindesk, @ethereumproject, @blockchainster

Selected blockchain resourcesHBR “The Truth about Blockchain” January-February 2017 Issue

https://hbr.org/2017/01/the-truth-about-blockchain

A beginners guide to blockchain technology

https://www.coindesk.com/information/

The Blockchain: The Technology behind Bitcoin

https://www.slideshare.net/JrmeKehrli/the-blockchain-the-technology-behind-bitcoin

How can blockchain technology help business and IT audit industry with data completeness and accuracy by Yazhou Hu (KPMG US) https://www.linkedin.com/pulse/how-can-blockchain-technology-help-business-audit-yazhou

ConsenSys Balance3 – materials obtained in attendance at ConsenSys session

Additional Resources

Blockchain Revolution by Don Tapscott

Ethereum: Blockchains, Digital Assets, Smart Contracts, Decentralized Autonomous Organizations by Henning Diedrich

Newsletters: CoinDesk, Blockchainster, Reddit Blockchain

People and Twitter Print/Web Video

“KPMG’s Digital Ledger Services is Transforming the Way our Clients do Business using the Blockchain”

KPMG Digital Ledger Services - Eamon Maguire and Dave Montes

What is blockchain (World Economic Forum) https://www.youtube.com/watch?v=6WG7D47tGb0

IBM Think Academy: How blockchain works https://youtu.be/lD9KAnkZUjU

Dutchain: The real value of bitcoin and cryptocurrency technology - the Blockchain Explained

https://youtu.be/YIVAluSL9SU

Additional KPMG Videos

Consensus opportunities: Blockchain and beyond

Securing the Blockchain

31© 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Source: World Economic Forum YouTube posted January 21, 2016https://www.youtube.com/watch?v=6WG7D47tGb0

World Economic Forum https://www.weforum.org/about/world-economic-forum

What “Blockchain” isWhat Blockchain Is (World Economic Forum) (2:19)

© 2017 KPMG International Cooperative (‘KPMG International’), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International provides no services to clients. No member firm has any authority to obligate or bind KPMG International or any other member firm vis-à-vis third parties, nor does KPMG International have any such authority to obligate or bind any member firm. All rights reserved.NDPPS 613298

The KPMG name, logo are registered trademarks or trademarks of KPMG International.

The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely information, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. No one should act on such information without appropriate professional advice after a thorough examination of the particular situation.

kpmg.com/socialmedia

Bernard Wieger | Advisory Partner | KPMG LLP1000 Walnut, Suite 1000, Kansas City, MO 64106Direct: 816.802.5810 | Fax: 816.817.0399Mobile: 913.706.3993bwieger@kpmg.comkpmg.com/us | KPMG on LinkedIn | KPMG on Twitter