Wednesday, September 13, 2017

Bitcoin clampdown: Towards a corporate-cryptocurrency?

WSJ reported that the Chinese government was working to shut down Bitcoin exchanges:

"China’s central bank together with other regulators has drafted instructions banning Chinese platforms from providing virtual-currency trading services, according to people familiar with the matter...regulators told at least one of the exchanges that the decision to shutter them has been made, one of the people said. Another said the order may take several months to implement."
China, however, is not the only has such issues with crypto currency. The US also has limited the use of Bitcoin by taxing it as a capital gain:

"Capital-gains tax rules could make using bitcoin as a currency a logistical nightmare. It meant that when U.S. citizens filed taxes, they had to account for every single bitcoin acquired, sold, or used for purchases, and the prices and dates at which those transactions happened. If you purchased 0.5 bitcoins at $360 in April 2014 and sold them for $645 on June 9, you’d have to declare that gain as a taxable event in 2015. Fair enough. But did you have to account for swings in the value if you used your bitcoin to purchase a vacation on Expedia or to order a pizza? The IRS’s move seemed to undermine bitcoin’s potential for use as a currency." Vigna, Paul. The Age of Cryptocurrency: How Bitcoin and Digital Money Are Challenging the Global Economic Order (p. 260). St. Martin's Press. Kindle Edition. 

However, the key regulatory action against Bitcoin came from the FDIC and DOJ:

"bitcoiners would report that agents from the Federal Deposit Insurance Corporation, the body charged with cleaning up failed banks so that insured depositors can be kept whole, were pressuring bank compliance officers not to work with bitcoiners. It’s hard to verify this claim. The FDIC had long communicated its concerns to bankers over supposedly high-risk categories of merchants, and bitcoin businesses were told by bank compliance officers they were included in those groups...

The U.S. Department of Justice, too, sent banks messages that contradicted FinCEN’s accommodating message. In 2013, the DOJ launched an initiative known as Operation Choke Point, in which it investigated banks dealing with merchants in businesses that weren’t necessarily illegal but were considered high fraud risks. Miami-based lawyer Andrew Ittleman, who has become something of an accidental expert on the subject, told us that Operation Choke Point now occupied most of his time and that primarily his clients were legal providers of bitcoin services and medical marijuana, along with a few pornographers and gun dealers. The law was having a chilling effect: banks might not be breaking the law by servicing such businesses, but the risk of an audit from the DOJ was enough to dissuade them from doing so. Ittleman fought hard for his clients, who were denied a vital instrument of financial access, but it was an uphill battle. The matter, he said, should be taken up to the Supreme Court by civil rights activists such as the American Civil Liberties Union." (ibid p. 258-259)

Why are governments so worried about Bitcoin?

The WSJ article cited above gives a clue:

"Beijing’s crackdown on bitcoin is part of a broader effort to root out risks to the country’s financial system. Officials earlier this year circulated a draft of anti-money-laundering rules for bitcoin exchanges, a powerful warning, even though the regulations were never formalized, according to people familiar with the matter...Virtual currencies in theory allow holders to bypass China’s traditional banking system to move money outside its capital-controlled borders. That could make it more difficult for Chinese regulators to maintain a tight grip on the yuan." [Emphasis added]

Cryptocurrency has its roots in the anarchist activists and others who saw Bitcoin as a way to challenge the power of banking sector. Given that Bitcoin had its debut during the Financial Crisis, it may have been reasonable to believe that there would be sufficient groundswell to believe that the cryptocurrency would gain popularity.

However, popularity in the realm of currency and capital is not sufficient to change institutional realities of societies. 

The reality of societies today is that financial institutions, and corporations more broadly, represent institutions that keep the society together. Since they hold the keys of the society, ultimately they will control the change that will proliferate through society. And something that undermines the ability of the society's today to control capital flows is pretty much a national security issue - and can expect a response that reflects that reality. In other words, it was reasonable to expect the Empire to Strike Back as they did. 

Can we ever expect a corporate-sponsored cryptocurrency? 

Given the way power works, the only one that can really challenge banks hegemony are other corporations. For example, Walmart teams up with generic drug makers (in competition with expensive brand-name alternatives) to reduce the healthcare benefits they pay to their employees.

On requirement would be to have direct access to customers so they can actually convert their cash into that digital currency. For example, online realtors are dependent on banks and their electronic payment networks to essentially get cash into the system. 

So likely a retailer alliance could be something that poses a challenge to banks and their networks. 

Amazon already has Amazon Coin, but I think that if they teamed up with Walmart you would have something that basically has wide acceptance. And that's when the games will begin.

Retailers also have an incentive to cut-out the banks and save those credit card fees. However, for this to have user acceptance the retailers would need to give their consumers a cut. 

But would this be a true cryptocurrency? 

Such a currency would likely take a permissioned or private blockchain route. Essentially, there will be a need for 'independent verifiers' (instead of miners) that will ensure that the transactions are properly accounted for. This is likely cheaper than using miners which are costly in terms of the energy costs that have to be paid

Although I think external auditors could play the role of the independent verifier, these systems can be highly automated and an assurance model can be developed where you have real-time assurance as the source documents would be digital. This is assuming that the cryptographic keys can be relied on for such a purpose and auditors are able to get "effortless" access to such evidence and systems. So it may lead to a renaissance in the audit but may help auditors realize their potential within the field of audit data analytics and more broadly as data scientists. 

This speaks to one of the key aspects of automated audits that I raised on this post. As promised, my plan is to delve deeper on this topic, where we can look at how blockchain can facilitate AI or automated audits. 

Ultimately, banks play a critical role in extending credit which essentially makes them gatekeepers of the consumer economy. However, other companies, largely the tech sector, are hoarding cash:

Courtesy of Business Insider

So the question is whether these non-banks could move into bank territory. For example, Rogers Wireless (cell phone provider) is also a bank. That being said, it likely won't be a revolution but could be something that evolves over time that steadily erodes bank power. However, that would mean that the banks would take this lying down and I don't think that the Empire will go out without a fight. 

Monday, September 11, 2017

Serendipity: Beyond the reach of Robot Professionals?

Came across a story about how Dr. Behfar Ehdaie at Memorial Sloan Kettering Cancer Center was figuring out how to deal with the emotions that come with a discovery of prostate cancer. His novel solution gives may give us some insights into the limits of robots in the professional world.

What he found was that his patients opted for radical treatments, such as surgery or chemotherapy, that resulted in side-effects that actually ended up being more harmful. To use a cliche, the cure was worse than the cancer.

For such patients, "the medical consensus is that active surveillance often is the appropriate treatment for small early tumors". Of course, such an approach is not risk-free, but the problem is that "despite the data showing that this approach is safe, about 50% of eligible men don’t get it either because they turn it down or their physicians don’t embrace it. Medical experts say many men have been overtreated, as their cancers probably posed little immediate danger."

What was his solution?

Negotiate with patients.

As noted in the WSJ article referenced above, he contacted Harvard professor Deepak Malhotra who had authored an article on the topic to develop strategies on negotiating with the patient. Leveraging lessons from behavioral economics was to make monitoring the anchor instead of surgery or chemo. Dr. Ehdaie and professor Malhotra devised a lecture that was delivered to doctors to help them learn from Dr. Ehdaie's successes with this approach.

But what does this have to do with limits of robot-professionals or robopros?

When it comes to cancer treatment and robots, one can't complete the conversation without mentioning IBM's Watson "Oncology Edition". In fact, IBM has a partnership with the same Memorial Sloan Kettering Cancer Center that Dr. Ehdaie works at. Here is a promo-video that speaks to the promise of Watson:

The key to understanding the limits to robot-professionals is the backstory on how Dr. Ehdaie first decided to explore negotiations a way to deal with the issue.

This is where serendipity comes to play.

He was exposed to such concepts with discussions with his wife who is an MBA. Meaning that he went beyond the cancer treatment journals and then discovered a non-standard approach to dealing with a problem. Robots are not good at this. Machine-learning and AI is only good as what you teach it. Even "simple" tasks require thousands of man-hours to train such algos. Perhaps this can be overcome, but currently, it is a real limitation of AI.

Does this make humans indispensable?
Really depends on the objectives that govern the profession and the organizations that hire them.

If it's about cost-cutting and making the process efficient and streamlined, robots are perfect creating a fossilized bureaucracy that is resistant to change. Think about how financial institutions have yet to overhaul their ancient banking systems coded in COBOL:

"In the United States, the financial sector, major corporations, and parts of the federal government still largely rely on it because it underpins powerful systems that were built in the 70s or 80s and never fully replaced."

Similarly, if Dr. Watson replaces a large component of the diagnostic process it would become hard to dislodge it from the cancer treatment process.

On the other hand, if organizations recognize the value of human beings in being important to overall objectives of the profession - patient care, audit quality, etc. - then human judgment must be hardwired into the organization's DNA to avoid the development of such an inflexible system.

Author: Malik Datardina, CPA, CA, CISA. Malik works at Auvenir as a GRC Strategist that is working to transform the way we do financial audits. The opinions expressed here do not necessarily represent UWCISA, UW, Auvenir, Deloitte's or anyone else.

Saturday, September 9, 2017

AI and the Audit: What does a robot need to audit your numbers?

In the previous post, we examined the value propositions that Appzen's AI brings to auditing expense reports.

In this post, we analyze what insights we can extract from Appzen when it comes more broadly to applying AI to the external financial audit.

The following gives a refresher on how the Appzen AI audit works:

Based on this we look at a number of factors that exist in this process to develop

Standardized process:
The expense report process that has been fairly standardized for over a decade: employees submit a digitized report of what they spent, expense codes, commentary and all the supporting documentation (e.g. receipts, invoices, etc.).  This is similar to how factories needed an assembly line before they could be automated.

Standardized capture and presentation of audit evidence:
I think this is a key piece: the actual audit evidence (i.e. receipts) must also be included in what's submitted to the auditor. As the evidence is provided in a standardized format, it enables machines to analyze these digitized source documents to run the necessary correlative models to run the risk scores and enables the automated analysis.

Audit evidence retains its chain of custody through the digitization process:
The auditor does not need to expend additional resources verifying that the evidence actually relates to the item being audited, nor do they have to expend additional resources ensuring that the independence of the evidence wasn't lost through digitization process. For example, when receiving a bank confirmation the auditor needs to ensure that this received directly from the bank and not the client.

Evidence provider identity is verified and contractually obligated to follow-up with the auditor:
The party submitting the audit evidence, the employee, has been verified in the system through the employee onboarding process. The implication of this is that the auditor doesn't have to expend audit resources confirming the identity of the evidence provider. Secondly, and perhaps more importantly, the auditor doesn't have to expend significant resources following up with the evidence provider. For example, not all customers will respond to accounts receivable confirms and then auditor will have to perform alternate procedures.

Evidence provider has incentives to produce the proper evidence: 
The previous point is closely related to the issue of incentives: if the employee fails to provide evidence then they will not be reimbursed. This puts a strong incentive on the employee to provide the evidence in a timely manner.

Provider of the evidence is trained on providing evidence:
The employee has been trained to provide complete, accurate and valid evidence. They also have access to help if they have issues with submitting expense receipts or understanding whether that evidence will be accepted.

Violations can be clearly defined and examples of violations can be taught to the system:
For fraud or errors to be flagged there needs to be rules that can be fed into the system to identify whether the item submitted needs further review or audit. For example, if the amount on the receipt doesn't match this would be flagged and has a high likelihood of error. But more importantly,  the examples of violations identified can be fed into the system to teach the system (via machine learning) what to look for.

In a future post, we will use these factors to look at how easily (or not) AI can automate financial audits.

Author: Malik Datardina, CPA, CA, CISA. Malik works at Auvenir as a GRC Strategist that is working to transform the way we do financial audits. The opinions expressed here do not necessarily represent UWCISA, UW, Auvenir, Deloitte's or anyone else. 

Tuesday, September 5, 2017

AI and the Audit: Why hire a Robot as your Auditor?

On this blog, we've covered the topic of exponential change and how audit/accounting is prone to such forces.

Despite this, I am tempted to say financial auditing is different. It's not like factory work or more controversially like the pharmacist profession where AI claims to offer a safer alternative to dispensing medication.

But does that make me just one of the people who think that their profession is unique because they are in the midst of seismic change but refuse to see the writing on the wall?

At the same time, I don't want to come across as an alarmist claiming that the world is going to end when it really isn't.

It's the challenge of nuance.

While trying to figure out how to tackle this challenge, I came across AppZen; an app that uses artificial intelligence to audit expense report. It was identified in this post as being one of the game-changers in the fintech scene and was also featured in Accounting Today.

According to the company's website, the application "combines computer vision, deep learning, and natural language processing to understand the full context of expenses, not just amounts, dates, and merchant names. ReceiptIQ detects unauthorized charges in real-time from receipt images, boarding passes, travel documents, cell phone bills and any other expense documentation. Cross-checks expenses in real-time against thousands of external and social sources to determine if they are legitimate and accurate... Real-time identification of unauthorized upgrades in airlines, hotels and car rentals as well as out of policy claims for hotel laundry, alcohol purchases, cell phone charges and more."

Reviewing the company's video, I was able to extract the following value propositions:
  • "100% Testing":  I put it in quotes on purpose because the idea is that the whole population is analyzed but only the high-risk ones are further analyzed. That is, this is still "examining on a test basis" but uses a risk based approach to identify what reports should be further examined. This is in contrast to the manual approach of sampling.  
  • Automated exception analysis: Closely connected to the previous point, but to emphasize that there is an automated review of the population.
  • Real-time analysis: Reports can be analyzed instantaneously. Although not explicitly identified in the video, this could have real world savings. Faster reviews - leading to faster reimbursement to employees - could reduce the overall amount owing on corporate credit cards thereby offering more favourable position with the credit card companies. 
  • Seamless integration into existing processes: Add-on to an existing process is a much easier sell than an app that requires replacing the existing app you may have just bought.  
  • Use of external data: The app uses 100s of external data sources to develop. It seems that this assists in building an expectation of whether the expense needs further analysis. 
  • Limited false positives: Not explicitly stated, but it is strongly implied that the number of reports that need to be reviewed is few - meaning it's not flagging reports that are valid.   
  • Reduction of audit costs and fraud: Finally, the app promises greater efficiency in the use of audit resources deployed and greater effectiveness in catching fraud. 
When looking at these benefits of AI-enabled automation, they are based on certain assumptions that may exist in the expense report realm but not in the external audit realm. For example, accounting records at a company are not normally accompanied by a digitized copy of the source document (e.g. invoice, receipt, etc.) that provides evidence of its validity, accuracy, etc. of that accounting entry. 

So which of these assumptions applies in the world of external financial audits? 

This will be the topic of the next post where I will develop a list of factors that enabled expense report to by automated by AI and see if they apply to our world. 

Author: Malik Datardina, CPA, CA, CISA. Malik works at Auvenir as a GRC Strategist that is working to transform the way we do financial audits. The opinions expressed here do not necessarily represent UWCISA, UW, Auvenir, Deloitte's or anyone else. 

Tuesday, August 22, 2017

Did artificial intelligence kill the BlackBerry? It did for me.

Recently, Globe and Mail noted in their political briefing newsletter that Samsung's Knox software is deemed to be as secure as the traditional BlackBerry:

"Shared Services Canada, the department in charge of overseeing IT for the federal government, is set to offer alternatives to bureaucrats over the next 18 months as part of “a new approach to mobile service to better serve its clients, use new technology and adapt to changes in the marketplace.” Samsung and its line of Android-powered smartphones was the first to be approved by Shared Services, but only after two years and several tests showed that Samsung’s phones passed military-grade requirements."

In this blog, we've covered Blackberry's steady fall into oblivion. For me, BlackBerry was my first smartphone. I even got excited about the Torch, thinking it was the perfect compromise between the touch screen and the classic keyboard. However, that feeling faded quite quickly after using the device. It was so underpowered and underwhelming compared to the competition.

When looking at the Porter 5 forces that surrounded this once mighty Canadian tech giant, we could say that both Apple's iOS and Android offer better substitute's: better devices, more power, better apps, etc. Essentially, these devices has evolved so much that they bring the power of the PC into the palm of one's head (Samsung's Note 8 is expected to have 6GB of RAM!).   This alone doesn't explain why BlackBerry was ultimately displaced from corporate IT - well before Samsung's Knox became equal-to-BlackBerry in terms of security.

I think there were two key developments that enabled BlackBerry's decline.

The more well known one is the "consumerization of IT" phenomenon: users wanted to use their latest iPhone or Android device instead of the BlackBerry in the corporate environment. Going back to Porter 5 forces this speaks to "bargaining power of buyers": the people no longer wanted to be limited to the "one trick pony" of email and BB Messenger. And they were willing to lobby their corporate IT departments to bring on the Android and Apple devices.

This leads to the second less well known factor.

What allowed consumerization to take place was that Microsoft took an open approach to licensing it Exchange Active Sync. This move paved the way for iPhone and Android to connect their devices to the corporate email server. Microsoft open attitude essentially transferred the power from BlackBerry to the consumer.

But for me it was a little different. Of course I like the apps and GPS that my Android and iPhone bring to me: the ability to read the Kindle, listen to audio books and podcasts without having to carry multiple devices is definitely a productivity. But really it was one particular app that made me able to switch: SwiftKey.

And that's where we get to the artificial intelligence.

I was a big fan of the Blackberry,  primarily because I thought I couldn't live without the physical QWERTY keyboard. But friends who were encouraging me to switch mentioned that Android sported the SwiftKey keyboard which is powered by artificial intelligence. This keyboard is much better for me in terms of learning the words I use when I type than the predictive text feature in its iOS counterpart (which I use for work).

A little while ago, I tried a colleague's BlackBerry and the irony is that my hands hurt. And that's probably because I type a lot less specifically because of the AI approach taken by SwiftKey. As per the native analytics tracker (see graphic below) in my app I have been saved myself over 350,000 taps and am 28% more efficient

Today, over a quarter billion people use SwiftKey on their mobile devices. Although a little hidden from the view of analysts and academics, advances in artificial intelligence enabled SwiftKey (now owned by Microsoft) to offer a substitute for the once dominant BlackBerry physical keyboard. And for me personally it was this little piece of exponential technology (along with the relatively giant landscape of the Samsung Note 1) that convinced me it was time to switch.

And like I said, I can never go back.

Author: Malik Datardina, CPA, CA, CISA. Malik works at Auvenir as a GRC Strategist that is working to transform the way we do financial audits. The opinions expressed here do not necessarily represent UWCISA, UW, Auvenir, Deloitte's or anyone else. 

Sunday, June 18, 2017

"Bitcoin process flow": Accountant's guide to risk & controls around the blockchain

For the past year, I have been following blockchain to assess how this exponential technology will impact financial auditing.

Unlike artificial intelligence, quantum computing, or virtual reality, this technology addresses the heart of accounting profession: it is an innovation in the process of recording and accounting for transactions. Furthermore, it captures "proof of interaction" by leveraging digital signatures as the basis for executing exchanges. Both these features speaks to the core of what we do as accountants and auditors.

But before we get ahead of ourselves, it is important to look at blockchain in a nuanced way. On the one hand, technologists should be careful about how the blockchain will impact the audit. However, at the same time, the audit profession can't afford to ignore it. To do so would invite the profession to repeat the mistakes of Kodak who, despite inventing the digital camera in 1975, were ultimately disrupted by that very same technology.

Part of the problem was understanding that digital technology was changing at a linear pace instead of an exponential pace. In this post, Peter Diamandis talks about how "30 exponential steps" compares to "30 exponential steps" (and talks more broadly about linear vs exponential thinking). Ray Kurzweil, the infamous Googler, talks about the infamous story of how the inventor of chess requested an exponential amount of rice (and is rumored to have lost his head).

Going back to looking at this as an auditor, I think a useful starting point to understand the topic of blockchain is one of "professional skepticism". Specifically,:

Why would people trust this?

It's been quite the task in trying to understand how the public blockchain, specifically bitcoin, works in disintermediating centralized authorities, such as banks, to settle transactions between two parties that don't know each other. In a sense, a retailer, like, only needs to receive a string of digits, such as: and be satisfied that the purchaser has bitcoins required to buy the merchandise and hasn't already spent them. That is, they have "assurance" from the above string of digits and characters that the sender has not already spent the bitcoin or has simultaneously sent the bitcoins to someone else.

Part 1: Background on the process flow

Before going through the walk through, it is important to watch these videos first to get some background on how Bitcoin works.

The following video illustrates the peer-to-peer nature of the ledger:

This video gives a good 5-minute summary delving more into the technical details of bitcoin. If you need more, check out this 22-minute video by the same author.

The following video by Andreas Antonpolous, is especially helpful in understanding how the blockchain works at a deeper level. Encourage watching the whole video, but if you want to get to the meat of how the Proof of Work, SHA hash function works, skip to this point in the video .

As noted in these videos, when you send or receive bitcoins there's no exchange of actual digital code. Rather, it merely updates on the ledgers across the bitcoin network. It's quite ironic for us accountants - the way to bitcoin holdings are really just the sum of the person's bitcoin transactions.

Part 2: Walk-through of a Bitcoin Transaction

I originally mapped out this "walk-through" of a bitcoin transaction in PowerPoint. The transaction is largely based on the book, Mastering Bitcoin, by Andreas Antonopolous (same individual in the video above). He has been nice enough to make a number of the chapters online, including chapter 2, 5 and 8 that I used to develop this flow.

The bitcoin transaction that I used to perform the walk-through is the same one used in the book and it belongs to block #277298. As per the book, Alice sends 0.015 bitcoins to Bob's cafe to buy a coffee.

Step 1: Get a bitcoin wallet and some bitcoin.

For those bold enough to transact in bitcoin, they need to set-up a bitcoin wallet on their computer or mobile phone. Most important of all this needs to be secured as it holds your private key that is used to sign the transactions and send over to others. If this key is compromised, lost, etc. - you will lose all your bitcoins! And unlike credit cards, there is no central authority to complain to if this happens.

If you live in Toronto, you can actually buy the bitcoins at Deloitte at Bay and Adelaide (but you will need to set-up your digital wallet before doing this).

It cannot be overstated enough that this is where the bulk of security issues occur and makes bitcoin prone to hacking. As noted in this article, the August 2016 hack of Bitfinex had to do with the way that the actual wallets are secured using multi-signature wallets where multiple parties (user, Bitfinex, and Bitgo) held the keys. It should be clear, however, that it's not the actual ledger that is being hacked or more accurately being modified. Instead, it's the encryption keys that are being stolen by the attackers.

How did the thieves access the funds given that the ledger is reporting all transactions publicly?

This article from the Verge gives some insights on how bitcoins can be effectively laundered out of the blockchain.

Step 2: Send bitcoins to the recipient.

Process: In this example, Alice is sending the bitcoins to Bob's public key "1Cdid9KFAaatwczBwBttQcw XYCpvK8h7FK", which is also known as his bitcoin address.

If you want to wade into the details as to how the transaction is set-up and transmitted check out these two posts (here and here) by Google engineer, Ken Shirrif.

Risks:  Unauthorized recipient is sent the bitcoin. Unauthorized user modifies the payments.

Controls: Public key-cryptography: As noted in the process, Alice must send the bitcoin to Bob's bitcoin address or his public key. As long as she is 100% sure that it is actually Bob's address then only Bob will be able to access those bitcoins. In this scenario, Alice will likely scan Bob's QR since she is buying the coffee from him. However, if this were an online transaction then she would need to use an alternative method to verify that she is sending her bitcoins to the right address. PKI also ensures that the message can't be altered.

Step 3: Generate the transaction ID

Process:After the bitcoins are sent to the recipient a transaction identification number is generated, which in this case is “7957a35fe64f80d234d76d83a2a8f1a0d8149a41d81de548f0a65a8a999f6f18”.

Risks: Transaction will not be properly identified.

Control: Each bitcoin transaction is uniquely identified by transaction identification.

Step 4: Perform checks at the node

Process: Transaction is captured by the initial node. Risk:Transaction will be invalid, incomplete, incorrectly formatted, or violate other rules within the bitcoin protocol. See below for how these controls would be classified as “input edit controls” or data validation routine.

Risks: Inaccurate, invalid or incomplete transaction or transaction details will be posted to the blockchain.

Controls: The following list of controls are taken verbatim from chapter 8 Antonopolous's book mentioned earlier (or click here to see "Independent Verification of Transactions" in chapter 8)

Validity checks.The real genius of bitcoin is that it ensures that the person sending you the bitcoin already has them. In other words, it’s provide comfort on the existence assertion – to potential vendor or other person that will receive those bitcoins. With respect to data validations, it provides the following checks:· None of the inputs have hash=0, N=–1 (coinbase transactions should not be relayed).
  • A matching transaction in the pool, or in a block in the main branch, must exist.
  • For each input, if the referenced output exists in any other transaction in the pool, the transaction must be rejected.
  • For each input, look in the main branch and the transaction pool to find the referenced output transaction. If the output transaction is missing for any input, this will be an orphan transaction. Add to the orphan transactions pool, if a matching transaction is not already in the pool.
  • For each input, if the referenced output transaction is a coinbase output, it must have at least COINBASE_MATURITY (100) confirmations.
  • For each input, the referenced output must exist and cannot already be spent.
  • Reject if transaction fee would be too low to get into an empty block.
  • The unlocking scripts for each input must validate against the corresponding output locking scripts.
System-based validation. The following is a general data validation that ensures that the transaction is formatted per the bitcoin rules. As per Ken Shirrif’s post, noted in step 2, Bitcoin is very unforgiving when it comes to processing transactions: any inconsistencies with the protocol will result in the transaction being rejected.
  • The transaction’s syntax and data structure must be correct. 
Completeness check. The following data validation ensure that the transaction is complete:
  • Neither lists of inputs or outputs are empty.
Limit checks. The following data validation rules ensure that transaction submitted for processing do not exceed the limit set by the Bitcoin protocol:·
  • The transaction size in bytes is less than MAX_BLOCK_SIZE.
  • The transaction size in bytes is greater than or equal to 100.
  • The number of signature operations contained in the transaction is less than the signature operation limit
Logical relationship checks. The following data validation routines ensure that values match. The second one is similar to the idea that underpins accounting of where the debit equals the credit.

  • The unlocking script (scriptSig) can only push numbers on the stack, and the locking script (scriptPubkey) must match isStandard forms (this rejects "nonstandard" transactions)
  • Reject if the sum of input values is less than sum of output values.

Range checks. The following controls ensure that the values submitted are within an acceptable range. The last one is what prohibits the mining of coins beyond the 21 million limit set by the protocol:
  • nLockTime is less than or equal to INT_MAX.
  • Each output value, as well as the total, must be within the allowed range of values (less than 21m coins, more than 0).
  • Using the referenced output transactions to get input values, check that each input value, as well as the sum, are in the allowed range of values (less than 21m coins, more than 0).

Step 5: Accept or reject the transaction 

Process: If the transaction meets the criteria then it is passed on to the miners to be mined in a block. Otherwise the transaction is rejected.

Risk/Control: this is a flow through from the previous step.

Step 6: Send transaction to be mined

Process: The transaction is then sent to a pool to be mined. The protocol looks to have the transaction mined within 10 minutes. When the sender submits the transaction to the recipient, they can add fees to be paid to the miners. However, those do not give fees are of a lower priority than the people that actually paying to have their transactions processed. Right now this is not critical as the main reward is getting awarded 12.5 bitcoins for mining (i.e. guessing the correct nonce which is discussed below).  When bitcoins run out in 2040, however, it is these transaction fees that will become the main “remuneration” for the miners. 

Risk: Miners incentives will not be aligned with verifying transactions. 

Control: The economic incentives give the miners a reason not to counterfeit. It is less work to actually mine the coin then try to counterfeit the coin by amassing the necessary computer power. Also, the problem for profit-seeking criminals is that once they counterfeit the coins (e.g. through the 51% attack) then the community would lose faith in the bitcoin making it worthless. However, this does not stop non-profit seeking parties who are looking for a challenge or to destroy the bitcoin platform. 

Step 7: Pool the transaction with other transactions to be mined.

Process: As you can see from this list of transactions, transaction ID "7957a35fe64f80d..." is just one of the many transactions that are pooled together to be mined (i.e. checked) and then added to the blockchain ledger. You can try to find the transaction by going to the link, hitting ctrl-F and pasting in the first few digits of the transaction.

Risk and Controls: NA

Step 8: Protocol uses Merkel-Tree structure to hash transactions

Process: What I found challenging was to understand how the header hash (i.e. this) links to the actual transaction (i.e. this). And that’s where my journey took me to Merkle Tree structures. What Merkle trees allow you to do is recursive hashing that combines transactions recursively into the root hash as follows:

(Taken from: here)

Risk: Any node can verify the integrity of the blockchain by downloading the full blockchain ledger and ensuring that one block is linked to the previous block. However, to do this you need about 100 GB and a few days to download the blockchain. Consequently, there is a potential risk that mobile devices - which are used by most to execute bitcoin transactions - is unable to do this verification because it lacks the storage capacity and processing power to verify the blockchain.

Control: The use of Merkle Roots enables the verification of bitcoin transactions on small devices such as smartphones. Unlike a computer that has sufficient storage, these devices can simply use merkle paths to verify the transactions instead. Using Simplified Payment Verification, the bitcoin protocol, enables you to verify that the transaction is part of this root in order to get comfort that it is part of the block that has been checked and added to the blockchain. This structure also protects the pseudonymity of the other transactions as it doesn't require decrypting the other transaction in the tree structure. This control, however, relies ultimately the overall blockchain is being verified by network and does not standalone.

Step 9: Combining the hash transactions with previous block

Process: Miners need to generate the header of the blockhash, which consists of the previous hash, the merkle root of the current set of transactions, as well as the nonce (see step 10 and 11)

Risk: Transactions will be modified in an unauthorized manner.

Control: This is what effectively puts the "chain" in blockchain. It’s ultimately this structure that prevents transactions that have been added to the ledger from being modified. So let’s say you want to alter transactions that were added 1 hour ago (remember: it takes 10 minutes to add a block of transactions) you have to change the following:
- Merkle root of the hash of that transaction that was added 60 minutes ago.
- The header hash of the transaction of the block that was added 50 minutes ago.
- The header hash of the transaction of the block that was added 40 minutes ago.
- The header hash of the transaction of the block that was added 30 minutes ago.
- The header hash of the transaction of the block that was added 20 minutes ago.
- The header hash of the transaction of the block that was added 10 minutes ago.


Because each hash is based on the hash of that transaction that was added an hour ago. Any modification of that hash alters each of the 5 blocks that comes after that. Each block of the 5 block’s data structure depends on that hash-value of that transaction you want to modify.

Step 10: Setting the Difficulty/Target to identify the nonce

Process: The difficulty is actually set by the peer-to-peer system itself reviewing that the average time for the last 2016 blocks was 10 minutes on average. If not, then the difficulty will be adjusted up or down to get to the 10 minute average.

Risk: Transactions will be mined in an untimely manner; i.e. more or less than 10 minutes.

Control: The difficulty/target effectively as a throttle to ensure that the blocks mined takes 10 minutes regardless the number the miners or the computers involved(i.e. which will continually fluctuate). What the target determines is the level of guessing that the miners have to do find the "nonce" (see next step). The lower the target the more difficult it is to guess that number because there are possibilities of the answer being correct.

Antonopoulos, in Mastering Bitcoin, gives the following analogy:

"To give a simple analogy, imagine a game where players throw a pair of dice repeatedly, trying to throw less than a specified target. In the first round, the target is 12. Unless you throw double-six, you win. In the next round the target is 11. Players must throw 10 or less to win, again an easy task. Let’s say a few rounds later the target is down to 5. Now, more than half the dice throws will add up to more than 5 and therefore be invalid. It takes exponentially more dice throws to win, the lower the target gets. Eventually, when the target is 2 (the minimum possible), only one throw out of every 36, or 2% of them, will produce a winning result."

Step 11: Produce the header hash, i.e. the proof of work

Process: The miners "brute force" (rapidly guess) what the right value of the nonce is to get the hash. The miners keep iterating the nonce, producing the hash, and checking if it matches the desired header hash. The series flows above is meant to illustrate the iterative process the miner goes through. If the miner guesses the right hash, they will be awarded the Block Award of 12.5 bitcoins. This reward halves every 4 years and there will only be 21 million bitcoins issued. The last bitcoin will be mined in 2140.  

  1. Malicious actor controlling 51% of the network could authorize fraudulent transactions.
  2. People will not sign up to be miner without sufficient reward for their effort
  3. Infinite supply of bitcoins would expose the currency to inflation risks, i.e. if a bitcoins are mined endlessly the exiting bitcoins would decrease in value. 

Mitigating Risk 1: As noted in the process above, the miners have to brute-force the nonce and therefore expend energy. In fact, "electricity makes up between 90 and 95 percent of bitcoin mining costs". That means miners have to invest capital, effort and energy to actually mine the bitcoin. As noted earlier, this investment ties the miner to the success of bitcoin. That is, they won't want to hack bitcoin as it would drive the value down. On the capital side, miners buy specialized equipment called "rigs" to mine bitcoin:

Mitigating Risks 2 & 3: The bitcoin reward provides the incentives to the miners to create the header hash that has the necessary elements. While the 21 million cap on bitcoins, actually makes the currency deflationary. As bitcoins get deleted or become inaccessible because some can't remember the password to their digital wallet - those bitcoins are gone forever. Consequently, the total amount of bitcoin in circulation will be less than 21 million. 

Step 12: The block is time stamped 

Process: Timestamps are embedded in every calculation involved in generating the block. This makes the blockchain “immutable” as malicious actors can’t change previous blocks, especially after 6 blocks have been added to that block (i.e. which is why online retailers wait 60 minutes before accepting payment)

Risk & Control:  As noted in Step 9,  the blockchain concept of linking one blockchain to another is a sequence is one of the key controls to ensure that transactions will be modified in an unauthorized manner. Such a control is dependent on the timestamp as noted in the process section.

Step 13: Block is propagated across the network.

Process: Other nodes check the hash by running it through the SHA-256 hash function and confirm that the miner has properly checked the transaction. If more the 51% agree, then it is accepted as valid and added to shared blockchain ledger and it will become part of the immutable record.

Risk: If miners added the block to themselves, they would have both access to gaining the asset (i.e. the bitcoin) and access to the ledger itself. 

Control: The bitcoin network effectively segregates incompatible functions by requiring 51% of the network to agree that the work performed was valid. That is, a block cannot become part of the blockchain ledger until the majority of the network reviews the work performed by the miners. 

Hopefully, this has clarified some of the nagging questions you've had about how the bitcoin blockchain enables trust through a decentralized peer-to-peer network.  That being said, the above flowchart has been quite the labour of love for the past few months. So there will be quite a few gaps! Special thanks to Andreas Antonopoulos, who although I have never met, has made this journey a lot easier by making his work available online.

Please email me at  malik [at] if you have any comments, questions, or notice any gaps.

Author: Malik Datardina, CPA, CA, CISA. Malik works at Auvenir as a GRC Strategist that is working to transform the way we do financial audits. The opinions expressed here do not necessarily represent UWCISA, UW, Auvenir, Deloitte's or anyone else. 

Wednesday, May 17, 2017

Will auditors go the way of horses?

In late 2015, MIT Professors Erik Brynjolfsson and Andrew Mcafee penned an article entitled, will "Humans go the way of horse labour?"

The article explores how the mechanization of farm labour serves as a model of exploring the automation of knowledge work citing the work of Nobel Prize-winning economist Wassily Leontief. They state:

"In 1983, the Nobel Prize-winning economist Wassily Leontief brought the debate into sharp relief through a clever comparison of humans and horses. For many decades, horse labor appeared impervious to technological change. Even as the telegraph supplanted the Pony Express and railroads replaced the stagecoach and the Conestoga wagon, the U.S. equine population grew seemingly without end, increasing sixfold between 1840 and 1900 to more than 21 million horses and mules. The animals were vital not only on farms but also in the country’s rapidly growing urban centers.

But then, with the introduction and spread of the internal combustion engine, the trend rapidly reversed. As engines found their way into automobiles in the city and tractors in the countryside, horses became largely irrelevant. By 1960, the U.S. counted just 3 million horses, a decline of nearly 88 percent in just over half a century. If there had been a debate in the early 1900s about the fate of the horse in the face of new industrial technologies, someone might have formulated a “lump of equine labor fallacy,” based on the animal’s resilience up till then. But the fallacy itself would soon be proved false: Once the right technology came along, most horses were doomed as labor."

The MIT Professors are not alone in sounding the alarm when it comes to how automation can impact labour. Others includes Thomas Piketty, Douglas Rushkoff, Martin Ford and Nick Carr. 

If the techno-distopians are right, then there will need to be a fundamental alteration of the way the economic system is structured to address the unemployed masses. Such masses are not likely going to take such things lying down. For example, in response to the Great Depression there were mass demonstrations in Washington DC where thousands protested their plight. In January 1932, Cox's Army of 25,000 assembled in the capital to protest their poverty. Later that year, the Bonus Army of 43,000 marched on Washington in the summer to demand the US government pay the bonus promised early:

Alternatively, if the techno-utopians are right, such as Peter Diamandis and others at Singularity university, then such  protests won't be necessary: the system will make changes proactively to ensure that the gains made from exponential technologies are made available to the majority.

The point is that either way actions must occur at the political level to make the changes necessary to  address the deeply embedded economic architecture.

Consequently, working within the status quo leads to one actionable option: "Race with the Machine".

Prior to penning the article I cited above, MIT Professors Erik Brynjolfsson And Andrew Mcafee proposed that the path forward requires "man and machine" to work together:

This is essentially how IBM's cognitive system, Watson, was positioned when it comes to doctors and medicine: doctors delegate the task treatment research to Watson, while they determine what is the right treatment for their cancer patients. For example, doctors and Watson were able to work together and determine what the correct treatment was for a 60 year old Japanese patient

How can this be applied to financial audit? 

Firstly, the scope of the audit is driven by optimizing the cost-benefit curve. Consequently, there is a potential to get greater assurance for the same amount of resources allocated. Keep in mind that if auditors had to audit all transactions,  the organization could go bankrupt just trying pay the audit bill. Consequently, auditors only look at transaction on a test basis.

However, with the increased datafication of an organization's interactions with stakeholders, there is an opportunity - that didn't previously exist - to analyze these interactions for audit insights.

Take for example a Business to Consumer (B2C) company, like Dell, that interacts with its customers via social media. In 2005, there was an infamous spat between a CUNY journalism professor, Jeff Jarvis, and Dell computers (original post here). Jarvis was irate over the customer service and has been an Apple customer since. Such conversations can be mined for potential audit implications. In this particular instance, it could be a means to assess the adequacy of the sales returns allowance - developing a model based on how many other customers have complained via blogs, twitter or other social media about the B2C company and then assessing whether the provision is adequate.

Previously, such an analysis would be cost prohibitive and wouldn't make sense for the auditor to even considering such a thing. For example, the B2C company would need to record all conversations and then have auditor listen to thousands of hours of conversations to see whether such an issue actually exists.

This is not to say that it is currently feasible to run such an analysis.  Tools that aggregate, standardize and analyze such unstructured text could be argued to be in their infancy. However, datafication combined with further advances in social analytic tools (see video below for an example) in is the first step to a world where such analysis could be feasible.

The second separate but related issue is the role of the regulators in opening or closing the gate on innovation.

Some may mistakenly believe that this due to the regulated nature of audit. However, audit is not the only arena where innovation is shaped by the “regulator”. In fact, the success or failure of innovation  depends on how the incumbents who govern the landscape make way for the new technology (or not).

Take for example the rise of the iPhone in the corporate environment. What allowed consumerization to take place (i.e. allowing users to connect their favourite smartphone devices to the network instead of the corporate devices) was that Microsoft took an open approach to licensing it Exchange Active Sync. They could have created a walled garden that allowed Windows Phone only to connect to their email server, however, they paved the way for iPhone and Android to connect their devices to the corporate email server. Microsoft as the "regulator" of which mobile device can connect to its mail server enabled the iPhone and Android to displace our beloved BlackBerries from the corporate environment. Had Microsoft saw more profit in walling off the market for its own devices the ability for Apple iDevice to disrupt corporate IT would have been stifled if not suffocated.

On the opposite side, David Sarnoff of RCA squashed FM radio in order to protect his AM Radio technology and pave the way for television. The inventor, Edwin Armstrong, who initially was Sarnoff's friend, had mistakenly shared his technological innovations with him only to be betrayed by him. FM Radio technology had the potential to share data, such as faxes, back in the 1930s. One can only imagine the state of the wireless technology had RCA allowed this technology to flourish. 

Similarly, in 1934, AT&T blocked the answering machine for fear that it would undermine their business because "ability to record voice would cause business people to shun the telephone for fear of having their conversations recorded". So although much innovation came out of AT&T's Bell labs, the point is that it was effectively acting as the "regulator" which determined which innovations were permitted in the telecommunications industry and which ones were not. 

Consequently, the regulators (e.g. SEC, PCAOB, AICPA, etc.) will have a significant role to play on how innovation will unfold with the arena of audit. It is ultimately they who are going to weigh and assess what constitutes reasonable assurance actually is.  

Where are the regulators currently at? 

Well it seems that they are looking to technology to actually improve audit quality. In a May 2017 speech, PCAOB Board Member Jeanette M. Franzel noted in the section "Impact of Technology on Audit" that:

"If managed and implemented properly, these developments have the potential to enhance the value of the audit process and increase audit quality." [emphasis added]

To be sure it's not all rainbows and unicorns. Board Member Franzel did see "potentially disruptive changes will present challenges and threats across the auditing profession". However, at least there is an appetite to explore how such technologies can improve audit quality, expand what more can be done within audits and enable auditors to race with the machine.

Author: Malik Datardina, CPA, CA, CISA. Malik works at Auvenir as a GRC Strategist that is working to transform the way we do financial audits. The opinions expressed here do not necessarily represent UWCISA, UW, Auvenir, Deloitte's or anyone else.