SOC 1 and ICFR controls for crypto: what auditors actually test

Wallet access, pricing, completeness, reconciliations and change management, plus the user controls a custodian's SOC 1 report assumes you run.

2026-10-17 · 4 min read

If your financial statements include material crypto, your auditor will test the controls around it, and a custodian's SOC 1 report only covers part of the picture. The rest is controls your own team must design, run and evidence.

Two kinds of report, one control system

A SOC 1 report is an examination of controls at a service organization that are likely to matter to its customers' internal control over financial reporting [1]. It is written for two readers: the customers (user entities) and the auditors of those customers [1]. The AICPA publishes a dedicated guide for these engagements, including how a user auditor relies on a type 1 or type 2 report and how subservice organizations are shown using the inclusive or carve-out method [2].

The difference between the two types matters. A type 1 report covers whether controls were suitably designed and in place as of a single date; a type 2 adds testing of operating effectiveness over a period, typically 6 to 12 months, and describes the tests and their results [3]. For year-end reliance, a type 1 tells you much less.

Every SOC 1 description also lists complementary user entity controls (CUECs) and complementary subservice organization controls [3]. These are controls the provider assumes its customers, or its own vendors, operate. If you do not run the CUECs, the provider's controls may not achieve their stated objectives for you.

What inspectors have found

The PCAOB's target team reviewed 11 public company audits with crypto activity in 2023 and found deficiencies in five of them [4]. The findings read like a checklist of controls a finance team should expect to evidence [4]:

• Controls over the existence of, and rights to, crypto held in cold storage.
• Configuration settings that enforce the company's authorization policy for crypto transactions.
• Management review controls that netted variances instead of reviewing them on an absolute basis, as the control description required.
• The accuracy and completeness of the list of authorized wallet addresses used by an automated monitoring control.
• IT general controls over change management and user access in the accounting or finance system.
• The completeness of the populations used for testing, such as transfers out of cold storage.

The same publication notes that auditors of companies using third-party custodians evaluated the custodian's controls report, including the relevant CUECs, and that the risks differed from self-custody: key safeguarding, employee access, matching company records to the custodian's, and indemnification [4]. In four of the 11 audits, auditors identified significant risks around loss, destruction or theft of private keys [4].

Five control areas to design for

Wallet and key access. Document who can initiate, approve and sign transactions, how keys or key shares were generated (the PCAOB describes key ceremonies, including for MPC wallets), and how the list of authorized addresses is maintained and reviewed [4]. Access reviews need a complete, accurate user listing; inspectors flagged auditors who did not test the listing itself [4].

Pricing. Under ASU 2023-08, in-scope assets are carried at fair value and holdings disclosures include cost basis and fair value for each significant asset [5]. You need a documented price source, timestamp convention and review of exceptions. The AICPA practice aid, updated in January 2025 for the new standard, is a useful reference for scope questions such as wrapped tokens and transaction costs [6].

Completeness. One observation describes an auditor who tested only transactions already in the subledger, which could not show that the wallet system captured everything on chain [4]. Your control should start from the blockchain or custodian record and work toward the ledger, not the other way round.

Reconciliations. Automatic reconciliations of the subledger to third-party data count as controls only if you understand which errors they catch and how exceptions are resolved before approval [4]. Review breaks at gross amounts, not netted.

Change management. Changes to accounting or finance systems should be tested before release into production, with evidence [4]. That includes changes to classification rules, price feeds and chart-of-accounts mappings in your subledger.

Mapping CUECs in practice

Read each custodian or exchange SOC 1 report and list every CUEC. Typical examples ask customers to restrict who can approve withdrawals, keep authorized-signer lists current and review statements promptly, though the exact list varies by provider. For each one, name the control owner, the frequency and the evidence. Check that the report period covers your fiscal year, read the opinion and any exceptions, and note carved-out subservice organizations, since their controls are not tested in the report [2][3].

What to do

• Obtain type 2 SOC 1 reports from every custodian, exchange and critical service provider, and track their coverage periods.
• Build a CUEC matrix: each complementary control, your owner, frequency and evidence.
• Run completeness from the chain or custodian record to the ledger, and keep the population evidence.
• Review reconciliation breaks gross, with documented resolution before sign-off.
• Test and approve changes to subledger rules, price sources and account mappings before they go live.
• Perform periodic access reviews from a validated user and signer listing.

Sources

1. SOC 1® - SOC for Service Organizations: ICFR (AICPA & CIMA)
2. Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting (SOC 1®) (2025) (AICPA & CIMA)
3. Providing Assurance through SOC Reports (Deloitte)
4. Spotlight: Observations From the Target Team's 2023 Inspections (PCAOB)
5. 6.3 Disclosures About Crypto Assets Within the Scope of ASU 2023-08 (Roadmap: Digital Assets) (Deloitte DART)
6. Update: Digital assets practice aid addresses new FASB standards (Journal of Accountancy (AICPA))

General information for finance teams, current as of publication. Not legal, tax or accounting advice.

All Newsroom explainers