GoldmanSachs on Blockchain: Insights into Audit & Accounting Automation

As noted in this Business Insider article, Goldman Sachs (GS) published a report on blockchain that identifies a number of scenarios where the technology can save billions. The BI article extracted the following use cases from the 88 page report:

• Better authentication of individuals partaking in the sharing economy: Leveraging the "smart identity" functionality of the blockchain, peer-to-peer sharing businesses sites (e.g. Airbnb) can give both the customer (e.g. the renter) and the supplier (e.g. the home owner) greater assurance that the customer is really who they say they are. The GS report also links the identity to smart contracts that facilitates automated performance based payments 
• Accounting system for renewable energy power generation: Where individual homeowners are generating wind or solar power, the blockchain can be the natural accounting system to manage the "debits and credits" transferred back and forth between the energy producer and the network. It also enables payment transfers as well. 
• Reducing back end administration for title insurance: The actual GS report notes how the vast majority of the cost associated with title insurance can be reduced by about 30% using blockchain to manage the underlying property records. Other interesting notes is that they attribute part of the decline to improved actuarial risk calculations due to "greater historical transparency". 
• Improving accuracy and timeliness of trading various securities: The financial services industry usage of the blockchain is quite straightforward - replace the chaotic world of spreadsheet accounting with the streamlined world of blockchain - it is a database technology after all. NASDAQ use of Linq was featured in this DUPress article and can also be found here. The GS report goes into much more granular detail as to the different scenarios on how the back-end system can be improved resulting in less verification issues and improved trading times.  
• Better authentication of customers aka KYC (Know-Your-Customer): As noted in the BI article, "Like with the Airbnb example, Goldman envisions identity data stored on a blockchain that could help finance firms easily and quickly check new customers as part of "know your customer" regulation — a bit like a digital passport."

I went through the long report and extracted the following accounting automation insights:

• Blockchains can reduce spreadsheet funk. Sharing spreadsheets has become the norm in the financial world for being a flexible way to send quantitative information along with context and some formulas here and there; it's how we auditors often get data from the client when asking for a breakdown of an account we are looking into as a part of the audit. It's also error prone. Blockchain, in a sense, is a "napster-esque" way of sharing financial information that ensures a common data structure between the sender and the receiver thereby eliminating the manual verification/handling of spreadsheets (see pages 3 and 10).
• Blockchain can enhance "assurance", where it's not feasible for auditors to do so. On page 16 the report discusses the role of smart identities in assisting the sharing economy. It talks about how required digitally signed user reviews will have greater data integrity as it could reduce the risk of self-inflated reviews. Although people rely on such reviews to buy books, rent hotels, etc., there is risk of fraud where the seller will inflate reviews or pay people to do so. However, with a blockchain enabled smart identity there's a higher level of assurance that the end-user can place on the reviews as it harder for the site owner to fake the reviews due to fact the review is digitally signed. Of course no audit firm would have audited such reviews. But I think that's the point: the blockchain technology fills an an assurance need that auditors couldn't, simply because the delivery of such a service wouldn't be profitable. 
• Blockchain automation will reduce the need for back-end clerical staff (aka accountants): When looking at the application of blockchain to the title insurance industry (see pages 33-39), it notes how 75% of the industry premiums relate to headcount costs. GS puts the reduction in clerical staff by 30% and a 20% reduction in variable expenses (e.g. commissions, marketing, etc.). Blockchain - without AI enhancements - will automate accounting work as part of the automating knowledge work trend. This is of course more clerical tasks, but blockchain will likely result in less headcount within the finance department. 
• Role for third party assurance reports in a permissioned blockchain: The consensus mechanism in the permissioned blockchain is quite different than it's public counterpart, which relies on the proof of work (POW). (See the Khan Academy video, below for the POW and the blockchain section in this post) This is not the case for permissioned system which require the consortium who set-up the blockchain to determine how they will work with each other. This could require auditors to provide assurance over the implementation of blockchain similar to what the SOC report does for cloud computing companies. The report discusses how (see page 29) on how the blockchain will enable "Smart Grid Blockchains" to essentially acts as the record keeping and payment system of energy exchanged by the household owner who has windmills, solar panels to the power grid. But how do we ensure that this being calculated properly? Well, that's where the Processing Integrity Principle of the SOC3 assurance report comes in. It could provide assurance that the blockchain-accounting-payment system is processing the data in complete, accurate and timely manner.  
• Greater visibility, means greater opportunity for audit analytics. One area of cost savings associated with a blockchain enabled title insurance industry is that actuaries will be better able to assess risk  because of "greater historical transparency and immutability into the property registration system" (see page 38). Consequently, where a material amount of transactions are on a blockchain auditors will have (1) easier access to the data (not a trivial matter by any means!) and (2) can run better analytics to identify irregular transactions and (3) enable better ways to assess estimates. 
• Value versus hourly billing: In a number of the use cases identified (e.g. title insurance, settling equities, KYC; see pages 38, 51, 75) noted how the gains (read: headcount reduction) from blockchain enabled automation are expected to be passed on to the customer. Why is this relevant to audit? Audit firms could be expected to hand over automation windfalls to the client and further reduce fees. On the one hand, the more automated the audit, the potentially less fees that audit will capture. On the other hand, regulators may want the auditors to do more with the budget that has been freed up. So the revenue, profitability of highly automated audits will depend on how the regulators re-draw scope in light of such advances. 

Despite having the reputation as a great-vampire-squid, the GS report is quite useful for those working in the blockchain space in identifying the potential for this exponential technology.

Author: Malik Datardina, CPA, CA, CISA. Malik works at Auvenir as a GRC Strategist that is working to transform the engagement experience for accounting firms and their clients. The opinions expressed here do not necessarily represent UWCISA, UW, Auvenir (or its affiliates), CPA Canada or anyone else

BNY Mellon Software Glitch: Time to make SysTrust mandatory?

As was widely reported in the business press, BNY Mellon experienced a technical glitch that affected its ability to price mutual funds accurately. Based on the press release from one of the affected funds, the problems started on Monday August 24th, where one of BNY Mellon's system "InvestOne" managed by SunGard was pricing about 800 mutual funds inaccurately.

So what was the cause of this fiasco?

According to CNN, "BNY Mellon outage occurred after a SunGard accounting system it uses became "corrupted" following an upgrade. A back-up also failed."

Normally, this type of thing will force the party experiencing the breach intense scrutiny over what went wrong. However, as I went through the timeline posted by the company, I found (reading between the lines) that they did a number of things right, such as:

• Incident Management Communication Plan: One of the aspects of incident management is communicating to the public and making them aware of the issue. As it can be seen, the company posted details on estimates as to when the system would be ready as well as what was the source of the delay when they didn't meet their estimated deadline. 
• Contingency planning: BNY Mellon was able to get the Net Asset Values (NAVs) "using a secondary and more manual process" to the clients without the production system. According to WSJ, this involved "mobilizing more than 100 accountants to manually calculate the values of thousands of fund securities". The secondary procedure was not perfect as small differences were noted between the fund and, as reported the WSJ, this could expose the bank to "potential liability from the resolution of trades that may have been made during the pricing fog".  
• Effective Service Level Agreement (SLA) with SunGard: Based on the close coordination with SunGard, it appears that they were able to get SunGard to eventually rebuild the system "from scratch". 

That being said, there is always room for improvement. When I was reflecting on this, I speculated that this was another case of inadequate testing of the system upgrade. However, according to SunGard, this was not the case. As they noted on their website:

"The issue appears to have been caused by an unforeseen complication resulting from an operating system change performed by SunGard on Saturday, August 22nd. This maintenance was successfully performed in a test environment, per our standard operating procedure, and then replicated in SunGard’s U.S. production environment for BNY Mellon. This change had also been previously implemented, without any issues, in other InvestOne environments. Unfortunately, in the process of applying this change to the SunGard production environment of InvestOne supporting BNY Mellon’s U.S. fund accounting clients, that environment became corrupted. Additionally, the back-up environment hosted by SunGard, supporting BNY Mellon’s U.S. fund accounting clients, was concurrently corrupted, thus impeding automatic failover. Because of the unusual nature of the event, we are confident this was an isolated incident due to the physical/logical system environment and not an application issue with InvestOne itself."

Given my background as a CA, CPA and CISA, I have always thought it is an odd contradiction that we expect infrastructure (road, dams, bridges, etc.) to be certified by engineers to be in working order (key word is expect, as John Oliver notes in the video below, this is not exactly up to snuff!), but do not have the same expectations for the technology that runs the Information Age.

And that's where I have always proposed that it is necessary to have a framework like SysTrust (now SOC2 and SOC3) in place that requires companies to ensure that their systems are reliable: secure, available, and able to process information without messing it up.

Based on the experience between SunGard and BNY Mellon, I think it actually proves the case. Although companies, like SunGard, likely have such controls in place it is beneficial to others to have a second set of eyes on those controls, ensuring that they are in place, are designed effectively and are operating effectively. The reason is that with such mandatory audits in place, it will allow for the circulation of best practices through such audits. This occurs in the financial auditing world through "management letter points".

One other area that we should explore is the total impact of this error, as it will give insights into the "total impact of failed IT controls". This will be the topic of the next blogpost.

Auditing the Algorithm: Is it time for AlgoTrust?

This is the third instalment of a multi-part exploration of the audit, assurance, compliance and related concepts brought up in the book,  Big Data: A Revolution That Will Transform How We Live, Work, and Think (the book is also available as an audiobook and hey while I am at it, here's the link to the e-book ).  In the last two posts we explored the more tactical examples of how big data can assist auditors in executing audits resulting in a more efficient and effective audit. The book, however, also examines the societal implications of big data. In this instalment, we look explore the role of the algorithmist.

Why do we need to audit the "secret sauce"?
When it comes to big data analytics, the decisions and conclusions the analyst will make hinges greatly on the underlying actual algorithm.  Consequently, as big data analytics become more and more part of the drivers of actions in companies and societal institutions (e.g. schools, government, non-profit organizations, etc.), the more dependent society becomes on the "secret sauce" that powers these analytics. The term "secret sauce" is quite apt because it highlights the underlying technical opaqueness that is commonplace with such things: the common person likely will not be able to understand how the big data analytic arrived at a specific conclusion. We discussed this in our previous post as the challenge of explainability, but the nuance here is that is how do you explain algorithms to external parties, such as customers, suppliers, and others.

To be sure this is not the only book  that points to the importance of the role of algorithms in society. Another example is "Automate This: How Algorithms Came to Rule Our World" by Chris Steiner, which (as you can see by the title) explains how algorithms are currently dominating our society. The book bring ups common examples the "flash crash" and the role that "algos" are playing on Wall Street in the banking sector as well as how NASA used these alogrithms to assess personality types for its flight missions. It also goes into the arts. For example, it discusses how there's an algorithm that can predict the next hit song and hit screenplay as well as how algorithms can generate classical music that impresses aficionados - until they find out it is an algorithm that generated it! The author, Chris Steiner, discusses this trend in the follow TedX talk:



So what Mayer-Schönberger and Cukier suggest is the need for a new profession which they term as "algorithmists". According to them:

"These new professionals would be experts in the areas of computer science, mathematics, and statistics; they would act as reviewers of big-data analyses and predictions. Algorithmists would take a vow of impartiality and confidentiality, much as accountants and certain other professionals do now. They would evaluate the selection of data sources, the choice of analytical and predictive tools, including algorithms and models, and the interpretation of results. In the event of a dispute, they would have access to the algorithms, statistical approaches, and datasets that produced a given decision."

The also extrapolate this thinking to an "external algorithmist": who would "act as impartial auditors to review the accuracy or validity of big-data predictions whenever the government required it, such as under court order or regulation. They also can take on big-data companies as clients, performing audits for firms that wanted expert support. And they may certify the soundness of big-data applications like anti-fraud techniques or stock-trading systems. Finally, external algorithmists are prepared to consult with government agencies on how best to use big data in the public sector.

As in medicine, law, and other occupations, we envision that this new profession regulates itself with a code of conduct. The algorithmists’ impartiality, confidentiality, competence, and professionalism is enforced by tough liability rules; if they failed to adhere to these standards, they’d be open to lawsuits. They can also be called on to serve as expert witnesses in trials, or to act as “court masters”, which are experts appointed by judges to assist them in technical matters on particularly complex cases.

Moreover, people who believe they’ve been harmed by big-data predictions—a patient rejected for surgery, an inmate denied parole, a loan applicant denied a mortgage—can look to algorithmists much as they already look to lawyers for help in understanding and appealing those decisions."

They also envision such professionals would work also work internally within companies, much the way internal auditors do today.

WebTrust for Certification Authorities: A model for AlgoTrust?
The authors bring up a good point: how would you go about auditing an algo? Although auditors lack the technical skills of algoritmists, it doesn't prevent them from auditing algorithms. The WebTrust for Certification Authorities (WebTrust for CAs) could be a model where assurance practitioners develop a standard in conjunction with algorithmists and enable audits to be performed against the standard. Why is WebTrust for CAs a model? WebTrust for CAs is a technical standard where an audit firm would "assess the adequacy and effectiveness of the controls employed by Certification Authorities (CAs)". That is, although the cryptographic key generation process is something that goes beyond the technical discipline of a regular CPA, it did not prevent the assurance firms from issuing an opinion.

So is it time for CPA Canada and the AICPA to put together a draft of "AlgoTrust"?

Maybe.

Although the commercial viability for such a service would be hard to predict, it would help at least start the discussion around of how society can achieve the outcomes Mayer-Schönberger and Cukier describe above. Furthermore, some of the ground work for such a service is already established. Fundamentally, an algorithm takes data inputs, processes it and then delivers a certain output or decision. Therefore, one aspect of such a service is to understand whether the algo has "processing integrity" (i.e. as the authors put it, to attest to the "accuracy or validity of big-data predictions"), which is something the profession established a while back through its SysTrust offering. To be sure this framework would have to be adapted. For example, algos are used to make decisions so there needs to be some thinking around how we would identify materiality in terms of  total number of "wrong" decisions as well as defining "wrong" in an objective and is auditable manner.

AlgoTrust, as a concept, illustrates not only a new area where auditors can move its assurance skill set into an emerging area but also how the profession can add thought leadership around the issue of dealing with opaqueness of algorithms - just as it did with financial statements nearly a century ago.