CURRENT ISSUES IN AUDITING American Accounting Association Vol. 15, No. 1 DOI: 10.2308/CIIA-2019-509 Spring 2021 pp. A57–A71 Evaluating Blockchain Using COSO Nishani Edirisinghe Vincent The University of Tennessee at Chattanooga Reza Barkhi Virginia Polytechnic Institute and State University SUMMARY: As companies begin to explore and develop technology solutions based on blockchain and smart contracts, there is a need to understand the impact of blockchain and smart contracts on the assessment of internal controls and enterprise risk. Especially since the distributed ledger and smart contracts blur the system boundaries between trading partners, there is a need to understand whether internal control assessments based on a single company approach is adequate in an integrated and collaborative environment. This paper provides an overview of smart contracts for practitioners and describes the associated risks of engaging in a blockchain consortium. We also list potential questions related to internal controls that may be considered when either engaging in a consortium or executing a smart contract. We then discuss whether current frameworks, specifically the Committee of Sponsoring Organizations’ (COSO) integrated and COSO’s Enterprise Risk Management (ERM) frameworks, adequately address a collaborative supply chain ecosystem. Keywords: blockchain; COSO integrated framework; COSO ERM; blockchain internal controls; internal controls. I. INTRODUCTION T echnology design, development, implementation, operations, maintenance, and risk assessment, to date, consider one company and its relationship to other parties that transact with the company such as customers and vendors. Therefore, when assessing the internal controls of a firm and its information systems using an established framework, management and auditors can focus on a system boundary that is fairly aligned with the company boundary. Even though electronic data interchange (EDI) and vendor managed inventory systems have enabled the integration of systems within a supply chain, these technologies enable companies to adequately identify the system boundary. Nishani Edirisinghe Vincent, The University of Tennessee at Chattanooga, Rollins College of Business, Department of Accounting, Chattanooga, TN, USA; Reza Barkhi, Virginia Polytechnic Institute and State University, Pamplin College of Business, Department of Accounting and Information Systems, Blacksburg, VA, USA. Editor’s note: Accepted by Lisa Milici Gaynor. Submitted: December 2019 Accepted: July 2020 Published Online: September 2020 A57 Downloaded from http://publications.aaahq.org/cia/article-pdf/15/1/A57/56287/i1936-1270-15-1-a57.pdf by guest on 16 February 2023