Conducting business with Bitcoin

I am not an auditor. Let me just preface with that. And this blog post isn’t too thought out, it’s a stream of thoughts that just hit me at 1 in the morning last night.

But regardless… Bitcoin and audits. Bitcoin sucks from a controls standpoint. A company holding bitcoin on their balance sheet has no way to demonstrate that they alone have control of their private key, and that no one else does. Compared to an organizations bank accounts, where a company can show exactly who has signatory authority over their funds.

Even if an organization transfers its  coins to a new address, there will exist the question of if that address is exclusively under their control. What program was used to generate that address? Who can vouch for the both the hardware and software generators used to generate the private key associated with that address. Can the network or systems administrator be trusted to have not left a backdoor open?

The list could go on and on…

Whereas a business with a checking account can designate privileges for that account (Alice can sign checks up to $5,000. Bob or Carol needs to sign checks for $5,001 to $10,000, and both Bob AND Carol’s signatures need to be present for checks over $10,000), that method breaks down with bitcoin, as well. Yes, there are multi-signature (“multisig”) addresses, but Bob and Carol can’t get 100% assurance that the system administrator, Alice (she wears multiple hats at her job) didn’t get both keys. Is there?

Spending also becomes an issue; an the CFO of a company, or its auditors, can examine Alice’s actions by looking at the checks she’s signed. Are the payee’s named the entities that the auditor is expecting to see? Easy enough to resolve. But with each Bitcoin transaction supposed to be sent to a new, unique address, the amount of work an auditor would need to perform to be certain that all of the spending that Alice initiated was indeed authorized and sent to the correct payee becomes a much larger task.

Not to mention the varying exchange rate at the time of each transaction and accompanying capital gain or loss that will have occurred…

Consumer-to-Business? Works great, especially if the company uses an intermediary like Bitpay or Coinbase to instantly convert the proceeds of each sale to dollars, prior to those dollars being received by the business itself.  That way, no exchange risk is created, nor is there any headache of tax-lots, LIFO or FIFO, in regards to the company’s “currency”.

But for a businesses internal spending? There just seem to be too many gotchas involved to make it seem feasible for a medium or large sized organization.

Relevant news