Blockchain and audit evidence intersect in a genuinely useful way only when the distributed ledger is the actual system of record for a transaction and the auditor has direct, verifiable read access to it — in that narrow case, the immutability and timestamping of entries can reduce the risk of after-the-fact alteration; outside that case, a client merely mentioning blockchain changes nothing about how evidence needs to be gathered.
The distinction that does all the work
'The client uses blockchain' and 'the blockchain is the system of record for this transaction class' are very different claims, and conflating them is the most common error in evaluating a blockchain-related audit claim. Many systems described as blockchain-based in marketing material actually store the authoritative record in a conventional database and only periodically hash or anchor a summary to a public or private chain — in which case the chain is a tamper-evidence layer on top of a normal database, not itself the record an auditor should rely on.
Where it genuinely changes evidence gathering
- Confirming that a transaction occurred at a specific time, where a public chain's timestamp is independently verifiable rather than attested only by the client.
- Confirming a transaction has not been altered after the fact, where the chain's structure makes silent retroactive edits detectable rather than merely asserted.
- Tracing a chain of custody for an asset represented entirely on-ledger, such as a token, where ownership transfer history is itself the primary evidence.
Where it changes nothing
- Any transaction where the chain only records a hash of data that lives elsewhere — the auditor still has to evidence the underlying data's accuracy and completeness through normal means.
- Smart contract logic that executes correctly on-chain but was fed incorrect or manipulated off-chain input — the chain faithfully records a bad input as if it were good.
- Private, permissioned ledgers controlled entirely by the client or a small consortium, where the auditor's access and the client's ability to influence what's written are no different in substance from a conventional database with good controls.
- Valuation of any crypto-asset — the ledger can confirm a holding exists and whose it is; it says nothing about what that holding is worth.
A smart contract that executed exactly as coded is not the same as a smart contract that executed correctly for the business. 'Garbage in, immutably out' is the specific failure mode auditors need to test for separately from the ledger's integrity.
| Question | Why it matters |
|---|---|
| Is this ledger the actual system of record, or a hash anchor over a conventional database? | Determines whether chain integrity says anything about the underlying data at all |
| Does the auditor have direct, independent read access, or only the client's own report of what's on-chain? | Independent access is what gives the evidence its strength; a client-supplied printout does not |
| Who controls what gets written, and under what governance? | A permissioned chain controlled by the client offers no more assurance than a well-controlled database |
How we think about this
Lekhya's view is that blockchain-related evidence should be evaluated with the same scepticism as any client-supplied system — ask what's actually the system of record, who can write to it, and whether the auditor has independent access — rather than treating the word blockchain itself as a quality signal.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Audit documentationAudit evidence: what makes it sufficient, appropriate and traceableSufficiency and appropriateness without the textbook circularity, a reliability hierarchy for Indian practice, and what has to be recorded for evidence to be traceable.
- Audit workflow & automationManaging audit evidence across hundreds of client documentsRequesting documents so they arrive usable, classifying what comes in, keeping versions straight, and always knowing what is still outstanding.
- Technology, data & AI in auditData analytics in audit: what full-population testing changesThe rare but material exceptions full-population testing surfaces that sampling cannot, and the judgement about what an exception means that no tool replaces.
- Technology, data & AI in auditAI in audit: the risks and limitations auditors should knowHallucination on numeric tasks, where client data actually goes when it reaches a model, and why junior staff over-relying on fluent output is the risk firms underrate most.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.