Three lines model paradigm shift: a blockchain-based control framework

3.1 BBCF overview

Within BBCF, blockchain is used as a support for the internal control system. Its purpose is not to replace an existing Enterprise Information System (EIS) nor the internal control in place; instead, it provides an additional component that will support the current systems and practice in place. BBCF should be implemented to exist alongside and be interfaced with existing legacy and EIS. The main objectives of the framework are to:

1. Monitor processes;

2. Automatically and systematically record on a blockchain a trace of each control performed (automatic and manual controls) and its results (passed or failed), as well as its remediation if any, and to provide easier access to the transaction underlying the evidence (potential audit trail);

3. Provide a single and real-time view of process advancement and control results to the different lines, which should help in building stronger linkages and more robust engagement between lines, especially between the first and second lines;

4. Propose embedded controls on a blockchain in the form of smart contracts for those companies wishing to redesign or shift some of their processes and related controls;

5. Notify process deviation or control failure for investigation and correction;

6. Provide meaningful and timely reporting to the management and the board.

To fulfill these objectives, BBCF relies on the design graphically presented in Figure 3. Each component is described in Appendix 1 – BBCF Presentation.

BBCF consists of three layers. The top layer provides an interface to allow end users to interact with the framework services of the middle layer.

The middle layer exposes a set of services for business-oriented activities that need to rely on blockchain through the underlying abstraction layer. Two main services, “Track & Trace” and “Monitoring & Notification,” are proposed and briefly described below.

The lower layer serves as a technology agnostic blockchain abstraction providing an interface to different blockchain-based platforms through connectors.

The two main services proposed by BBCF are “Track & Trace” (T&T), a conformance checker, and “Monitoring & Notification” (M&N), a notification service. T&T's goal is to verify integrity in the execution of registered processes, and the conditions associated with controls and standard tasks. M&N focusses on execution of actions and notifications. In practice, each time a process execution is subject to update, T&T:

1. Proceeds to the update of the process execution state if both the integrity of the process and the conditions of controls are verified.

2. Records a trace on a blockchain, whose content is the context related to process execution and the results of the verification (related to process integrity, control conditions as well as underlying evidence if needed).

3. Informs the M&N service of the results of the operations carried out so that M&N can:

   • Execute the appropriate actions specified for the control or standard task concerned with the update request. These actions can be executed either independently as the result of the checks, or in the case of success only, or in the case of problem only.

   • Send automatic notification when a violation of the model has been detected or at least one condition has failed, independently of the actions entered when the process was created and handled in (a).

   • If specified in the setup, stop the process so that no further steps can occur until a manual intervention is performed to correct the violation (e.g., for critical processes, super key controls, or when a key control does not have a compensating control).

To enforce strong integrity of operations and data, and thus to avoid scenarios involving malfunctions or fraud, T&T records traces on blockchain-based platforms when a process is created or deactivated, or when a process execution is activated, terminated, or canceled.

Ultimately, each trace can act as audit evidence because it allows the verification of the integrity of the original resources used to perform an update of a process execution or describe a process model or a process execution itself. In addition, thanks to audit traces registered by the BBCF itself, anyone can verify that there are as many traces reflecting the different service calls made to the API than traces reflecting the execution results of the aforesaid services. Thus, it is possible to verify the completeness of traces for processes, but also process executions and their progress. This could be particularly useful for L3 and L4 to spot issues and assess risky areas.

Depending on the company's governance, technology maturity levels, and its internal control requirements, BBCF can be deployed with an active or a passive use of service, and different levels of blockchain use. There are three predefined levels for the possible deployment of BBCF: Level I – passive use of both blockchain and services; Level II – passive use of blockchain and active use of services; and Level III – active use of both blockchain and services.

1. Level I (Passive use of both blockchain and services): Trace only

In level I, T&T is used to save (a) provided data on a data custodian and (b) an associated trace containing the fingerprint of the data on a blockchain. It is also used to verify the integrity of the data being stored on data custodians. An internal mapping between the stored data and the trace is registered within the platform to allow retrieval of both at any time. In general, the data would reflect the execution result of tasks performed either manually or within an IT system such as an ERP. In practice, this level ensures the integrity of stored information thanks to the traces recorded on a blockchain. Such information can later be used by appropriate parties to perform audit procedures. At the control level, the way BBCF works can be represented in the operation flow below (Figure 4).

1. Level II (Passive use of blockchain, active use of services): Trace and Execution Rules

Within this level, controls are still performed off-chain. However, control data is provided to T&T to perform appropriate verifications. Such verifications include validation of process integrity and of control conditions or standard tasks that have been performed and for which progress should be recorded. At the control level, the way BBCF works can be represented in the high-level operation flow below (Figure 5).

1. Level III (Active use of both blockchain and services):Smart contracts

Here, controls are performed on-chain through the use of smart contracts. At the control level, the way BBCF works using smart contracts can be represented in the operation flow below (Figure 6).

BBCF can be deployed either within a single company where the different departments and even the different subsidiaries can share near real-time data and access them (i.e., for transfer pricing) or by a consortium where external parties involved in a given process share data. In the following section, we use the product warranty process where several companies are involved as a use case to illustrate how BBCF works.

3.2 Use case – product warranty

We now present a hypothetical case where BBCF is deployed by a watch company to manage its warranty claim process. Claim processes usually exist in companies that produce goods and devices. It involves several participants:

1. The manufacturer (in our case it owns BBCF), makes watches, issues, and manages the product warranty process (including repair, replacement, or reimbursement for a product). This process poses several issues: It is time consuming and costly as it implies both sharing information and coordinating with several internal departments – including production, warehousing, logistics, or finance – which can result in data entry errors, and sharing of information and coordination with external parties such as transporters, customers, etc. It is prone to fraudulent claims that can be authorized and result in additional charges for the manufacturers.

2. The transporter, who collects products from clients and delivers repaired or new products.

3. The customer.

The flowchart below shows how the warranty process would run within BBCF (Figure 7).

In this case, the use of BBCF Level III – active use of both services and blockchain – would standardize and accelerate the process. As soon as the customer provides the required information online via a questionnaire, conditions set into the warranty contract and translated into a smart contract are verified. If they are met, the process is automatically executed (inform the transporter to collect the watch, ensure the availability of the parts to allow the repair, inform the repair/production department, book the accounting entry, inform finance, etc.). The automation of the process would reduce human intervention and therefore limit the risk of data error or data redundancy, increasing data accuracy. This would therefore provide shared trust in the data especially as they are immutable, transparent, and accessible to all the parties involved. It would also positively impact the different lines at the manufacturer level. L1 would keep track of the number of claims and their related costs on a real time basis. L2 would easily assess the data to evaluate the financial impact. L3 could more easily assess the effectiveness of the process as flaws would be automatically identified by T&T and reported in a timely way by M&N. L4 could easily verify the amount reported in the financial statements. Overall, the process of completion would be more efficient, and the different parties would have up-to-date and trustworthy information.

4.1 The positive impact of BBCF's

Several interviewees highlighted that one of BBCF's values is to provide one source of information. BBCF allows the assertion of process steps and control executions, and it allows all blockchain participants to retrieve information on an as-needed basis, including evidence of transaction and control details (results and supporting data) while having access to the audit trail.

Many interviewees also noted that as controls saved on blockchain are time-stamped and signed, it allows them, when cross-checked with the segregation of duties matrix, to quickly identify anomalies and deviations, and therefore to investigate them specifically to assess whether they are justified deviations or true exceptions. Thanks to this functionality, several interviewees think that some of the audit procedures should change. Thus, auditors should be able to focus on understanding the spotted deviations instead of performing random tests of details. Level II of deployment seems to be particularly interesting for most of the interviewees, who explained that this level provides more confidence in the reliability of the internal control system (“data are accurate and real”), as it can spot and report anomalies in a timely manner, or it can even stop processes from moving forward in case of a major violation of process execution or control execution rules. In this context, many interviewees think that auditors will have to do more IT general controls to assess whether the framework is reliable. They also expect that if BBCF works as intended, the number of tests of details should decrease.

Several EAs also reported that with the use of BBCF, they expect journal entry (JE) testing for detecting fraud to change significantly. Indeed, if the platform is reliable, and if BBCF is audited in the first year and then reviewed for changes year over year, the risk of fraud should decrease. Consequently, the auditors will be able to define more relevant tests to detect fraud rather than testing fifty JEs when thousands of them are registered during the year and when the parameters for selecting those JE, as explained by one financial audit manager, are not always relevant nor well understood by auditors. Many interviewed auditors expect that if their clients were to use BBCF, they would most probably move toward a continuous audit practice as they would be able to access reliable data at any time and from anywhere. Several of them speculated that some audit procedures will no longer be performed, leaving room for them to focus on higher value-added work where their professional judgment is required.

A few interviewees highlighted that the use of smart contracts is the ultimate control setup because, if properly coded, no deviation or exception is possible. Indeed, if the entity decides to use smart contracts (Level III of deployment) to execute controls, human intervention is minimized, which limits the risk of error and increases the reliability and security of the controls. In such a set-up, BBCF could become an element in a fraud prevention system where mechanisms are put in place to stop fraud or anomalies from occurring (Estévez et al., 2006).

Some interviewees also noted that the immutability of the data is a real benefit of BBCF. Once saved onto a blockchain, information cannot be modified. Therefore, in the context of BBCF, once controls and processes are executed and a trace of those controls and processes have been saved onto a blockchain, auditors have the guarantee that no change has happened since their execution. The interviewees explained that getting irrefutable records from BBCF increases their confidence in the audited data. This finding confirms the results summarized in Sargent's structured literature review (2022) on blockchain within the audit environment.

Some interviewees think that BBCF will bring efficiency within the internal control system in several ways. First, T&T ensures process integrity by monitoring both the order of execution for the different steps and the performance of planned controls according to their execution rules. Any deviation is therefore reported on a real-time basis and can be corrected in a timelier way. Second, T&T helps to systemize processes and controls, increasing control efficiency. Lastly, the possibility of creating exception reports using near real-time data tailored to meet each line's specific needs as part of a dedicated value-added service increases the agility of the business environment.

Some interviewees also think that BBCF should bring efficiency to their work, which is aligned with what other researchers have reported (Sargent, 2022). Thus, some of them expect that in the first year of BBCF deployment the IT audit workload will increase as they will have to audit the whole architecture. However, in the following years, they expect a decrease of the overall workload as the IT auditors will only have to ensure that the platform has not changed, allowing the EAs to rely on the information it provides, which will ultimately decrease the number of tests of details performed.

As presented above, the interviewees expect several positive impacts from BBCF; however, they also pointed out several limitations as discussed below.

4.2 The limits of BBCF

Almost all interviewees reported that BBCF brings a high level of rigidity whereas systems, processes, and controls change quite often. We noted that, on the one hand, many EA are in favor of this rigidity. Indeed, it should systematize processes and controls and therefore facilitate their work while increasing the confidence in the data and the assurance they provide. On the other hand, almost all the internal auditors (IA) warned that, even though enforcing processes and controls can be appreciable for the “controllers” (L2, L3, L4), it is inefficient for the “doers” (L1) as their activity could potentially stop several times; one of BBCF's functionalities is to stop the process in case of a major violation until a manual intervention is performed to correct it. According to the IA interviewed, the L1 teams would suffer this rigidity, and it could even decrease the overall productivity of the business.

Many interviewees also highlighted the fact that BBCF requires a high level of maintenance because controls and processes must be documented and up to date. This raised two concerns: First, it seems that BBCF is suitable for larger organizations where most controls are already documented and automatic. Some interviewees even think that BBCF is best for companies in highly regulated industries – such as pharmaceuticals or companies that need to comply with the Sarbanes–Oxley law. Second, BBCF seems to be an expensive solution to maintain but also complex to integrate within the existing IT environment.

Furthermore, some participants emphasized that BBCF requires the implementation of additional sets of controls to address new risks. The data provided to BBCF or retrieved by one of the services proposed by the platform will have to be verified to ensure its integrity and validity. These additional controls are key, especially as the blockchain is not intended to validate the incoming data but to preserve its integrity once recorded. As expressed by some of the interviewees, IT auditors will need to assess the information systems that generate the flow of data drawing on BBCF. Some interviewees noted that although several security elements are enforced, it is essential to have a set of controls and measures in place to ensure the ongoing integrity of the platform and its modules. A controlled, monitored, and restricted access environment would provide greater confidence in the operations performed and the results obtained for audit and control purposes. This is even more important in an environment where blockchain is used to share data with stakeholders outside the company such as suppliers and customers. Drawing on this point, some interviewees pointed out that data management could be another type of issue as BBCF is intended to handle a large amount of data. Thus, they were concerned by the data sharing implied using blockchain technology especially when it is used as a consortium, and more particularly by the confidentiality of the data that would be saved onto a blockchain, which indeed seems to be a problem as shown by Wang et al. (2019). Some participants also pointed out that most companies want to provide their EAs only with the minimum necessary data that have been reviewed and internally validated beforehand; however, if granted access to BBCF, EAs could potentially access not only data that would not have been internally validated beforehand but also access the entire set of data. This last point, as a few interviewees explained, represents the risk that auditors find more anomalies. Their point is that if EAs were granted access to BBCF they could look at any kind of data and they would necessarily find more issues. Moreover, in this set-up the auditees would lose some controls over their data as they would not be able to restrict access by the auditors because, to perform their duty, auditors are supposed to have access to all information – books/records/minutes of meetings and requested information from officer – relevant to their audits.

In addition, a few interviewees pointed out that the possibility of using smart contracts represents a risk. They are immutable programs, so if they contain an error and start to produce undesirable or wrong output, there is no way back. Therefore, it seems crucial to ensure that a smart contract does what it is intended to do before implementing it. In particular, the auditors mentioned that smart contracts should be audited prior to their inclusion on a blockchain to reduce such risk.

A few interviewees pointed out that the current functionalities of BBCF do not allow tracing a transaction to the financial statements. They asked whether such a reconciliation (from the control going through BBCF to the financial statements) would be possible as it would facilitate the completeness test and the fraud risk assessment. All transactions that go through BBCF should end up in a booking entry and therefore in the accounting balances, and it should be possible for all transactions making up the accounting balances to trace back to a trace of control saved onto a blockchain.

Based on the analysis of the interviewees' assessment of BBCF, we can also infer that the deployment of this framework would impact the TLM in several ways as described below.

4.3 BBCF's potential impacts on the TLM

The design and characteristics of BBCF should enforce a proper implementation of the TLM, allow a better distribution of the workload between the different lines of defense as reported by a few interviewees, and as such help to solve some of the problems identified within this model. Indeed, as the framework is based on blockchain, it inherently creates distributed trust within the different lines, allowing management to focus on building stronger linkages, and more robust engagement especially between the first and second lines (Hoefer et al., 2020). Moreover, as the same data are accessible at any time by the different lines and as exceptions are automatically reported on a near real-time basis, it enables a “collaborative compliance” (Morin, 2014) where each line is aware of the inherent check mechanism. As a result, each line does what it is expected to do, which increases each line's accountability and motivation to perform its duties and facilitates coordination. In turn, this results in a more efficient internal control system with effective processes and proper reporting in place.

Furthermore, the combination of T&T and M&N modules support L1 in its duty of establishing and maintaining appropriate structures and processes for the management of operations and risks. However, it seems that, as highlighted by several interviewees, BBCF is not suitable for smaller organizations where most controls are manual. In such a context, L1 would have to log the controls manually and save the supporting documents into BBCF. This extra step could be cumbersome and, demotivating, and could be a source of errors. As such, BBCF deployment would most probably require some process reengineering to automatize controls, properly identify the controls and tasks that need to be recorded into a blockchain and properly identify the super key controls that would necessitate the process to be stopped when major anomalies or deviations are detected.

Using near real-time information on process flows and control results, L1 will be able to assess the organization's compliance with internal and external policies and laws, adjust operations in a timely way when necessary, and assess the processes' effectiveness. In addition, the fact that control owners, control doers, control reviewers, and process owners are clearly identified increases each employee's accountability, which in turn positively impacts the entity's processes and controls effectiveness. L1, L2, L3, and the BOD have access to the same data and to the same reports, which promotes transparency and deeper conversations on the entity's monitoring and strategy.

Furthermore, as BBCF provides near real-time information on operations' compliance with the entity's processes and on internal control outcomes (pass or fail), L2 can monitor and assess the adequacy and effectiveness of the risk mitigation practice within the organization more easily and in a more timely way. BBCF allows L2 to understand better where the failures are coming from – that is, by identifying the processes that are not performed properly, the employees who do not perform their tasks properly, or the controls that fail on a recurring basis. It also allows L2 to analyze the reasons for these failures, and therefore look for ways to avoid them and improve the entity's processes and controls.

BBCF enhances L3's work in several ways. First, it facilitates the IAs' evaluation of the internal control environment by pinpointing deficient processes and deficient controls. IAs can focus on areas where the achievement of organizational objectives is at risk – for example, a loss of efficiency and/or effectiveness, a deviation from internal policy or even laws, or potential reporting errors, and reduce random tests of details, and thus focus their efforts on providing management and the BOD with best practices and recommendations for improvement. Second, IAs can perform their reviews and audits more rapidly as information is readily available. Indeed, they can directly access the data without asking L1 for information, which increases their independence from management. Moreover, the fact that the data is less likely to be lost when entered or aggregated within a common and comprehensive digital ledger increases visibility and offers evidence of provenance with an audit trail. The traces guarantee the authenticity and immutability of audit evidence. The near real-time characteristic of the information helps the auditor perform their work in a timelier way and to assess whether recommendations have been put in place. These attributes allow L3 to assume a central role in the risk management system which was already put forward by Vinnari and Skærbæk (2014) as with the use of BBCF they can report up-to-date information to the BOD and management on the adequacy and effectiveness of governance and risk management, including internal control.

We assume that to ease the access to information and therefore increase the efficiency of the auditing process while maintaining the auditors' independence, EAs are granted read-only access to BBCF on a need-to-be basis.

Most of the EAs interviewed explained that the overall risk rating of a client using a blockchain based internal control system would rise significantly. In fact, blockchain is a new and complex technology for which there is no auditing protocol. As such, the deployment of BBCF would most probably increase the IT audit workload as the IT auditors would have to understand and audit it to assess the reliability of the systems (including both the interfaces connecting BBCF with existing systems, and the blockchains integrated within the framework) and determine whether they can rely on the information provided. BBCF would therefore impact the overall audit approach in several ways. First, as part of a risk-based financial audit, the auditors must obtain an understanding of the client's business environment and its internal control to assess the entity's audit risk (c.f. International Standard of Auditing 315), therefore, the audit team will need to include EAs who understand the blockchain and IT auditors who have the experience of auditing it. Second, as the auditors will be able to access the different processes saved into BBCF and obtain several kinds of reports (e.g., summary of all controls performed, summary of all failed controls and possible remediation, summary of all process deviations, L3 reports), they will quickly assess the overall operating effectiveness of the control environment, determine the risky areas, and identify controls that need to be investigated further. This should reduce the amount of substantive work performed by the EAs who will be able to focus their tests of details on risky accounts and transactions. Thus, BBCF would most probably decrease the amount of work performed by EAs, but increase the work performed by the IT auditors and increase temporarily the overall audit fees as the audit teams would require special skill sets.