Bitcoin internal controls are the policies and procedures that make sure every Bitcoin transaction is authorised, recorded accurately and reported correctly. They follow the same principles as controls over cash or investments. The difference is that Bitcoin transfers are generally irreversible and are authorised by private keys rather than bank mandates, so preventive controls carry more weight.
Our audit readiness checklist sets out what auditors will ask for. This article goes a step earlier: how to design the control framework itself, process by process, so that the evidence exists when it is needed.
Start with the processes, not the controls
A control framework is easiest to build by walking through each process that touches Bitcoin and asking what could go wrong. For most corporate holders, there are six processes.
- Trade initiation and execution. Deciding to buy or sell, selecting a counterparty and agreeing a price.
- Settlement. Exchanging cash for Bitcoin, or the reverse, and confirming receipt.
- Custody and transfers. Moving Bitcoin between accounts, wallets and counterparties.
- Valuation. Measuring the holding at each reporting date.
- Reconciliation. Agreeing records to custodian statements, on-chain balances and the general ledger.
- Financial reporting. Posting journal entries and preparing disclosures.
Each process has its own risks and needs its own controls. A strong custody setup does not compensate for a weak reconciliation, and the reverse is also true.
A risk and control matrix for Bitcoin internal controls
The matrix below gives a starting point. It should be tailored to the company's size, custody model and frequency of trading.
| Process | Key risk | Example control | Type |
|---|---|---|---|
| Trade execution | Unauthorised or off-policy trade | Trades require approval within limits set in the board-approved policy | Preventive |
| Trade execution | Poor or unverified price | Price checked against an independent reference at execution; execution report reviewed | Detective |
| Settlement | Cash paid but Bitcoin not received | Settlement method agreed in advance; receipt confirmed on-chain or by custodian before closing the trade | Preventive |
| Transfers | Bitcoin sent to the wrong or a malicious address | Address whitelisting with a waiting period; multi-person approval for each withdrawal | Preventive |
| Custody access | Former staff retain signing rights | Leaver process removes access on the last day; quarterly signer list review | Preventive and detective |
| Valuation | Wrong price or cut-off time | Price captured per written policy and independently reviewed | Detective |
| Reconciliation | Missing or duplicated transactions | Monthly reconciliation of lot register, custodian statement, on-chain balance and ledger, signed by a reviewer | Detective |
| Reporting | Incorrect entries or disclosures | Journal entries reviewed; roll-forward tied to the ledger | Detective |
Every control in the matrix should have a named owner, a frequency and a defined piece of evidence. A control without evidence cannot be tested, and an auditor will treat it as if it did not operate.
Segregation of duties
The central principle is that no single person should be able to move Bitcoin and record the movement.
A workable split for a small finance team:
- Treasury initiates trades and transfer requests.
- A second approver, such as the CFO or a designated director, approves within limits.
- Signers in the custody arrangement execute approved transfers. Signing rights should be held by more than one person, with a quorum required.
- Accounting records transactions and performs reconciliations, with no signing rights.
- An independent reviewer signs off reconciliations and the period-end price.
Where the team is too small for a full split, compensating controls such as board-level review of monthly reconciliations can fill the gap. Document the compensating control explicitly. See key management and signing policies for the signing side.
CFO tip: test your transfer controls with a small amount before your first large transaction. Send a minor test transfer through the full approval chain, then reconcile it end to end. If any step needs a workaround, fix the design before real size goes through it.
Relying on service organisations
Most companies use third parties for execution and custody. Their controls form part of your control environment.
- Controls reports. Obtain the custodian's independent controls report, often a SOC 1 Type 2 report, each year. Read the opinion, the period covered and any exceptions.
- Bridge letters. Where the report period does not cover your year-end, obtain a bridge letter confirming no significant changes.
- Complementary user entity controls. Every controls report lists controls the provider assumes its customers operate, such as reviewing statements and managing their own user access. If you do not operate them, you cannot rely on the report.
- Subservice organisations. Check whether the provider relies on others, such as cloud hosting or key storage providers, and whether those are covered.
For providers without a controls report, the company must design its own procedures to gain comfort. See counterparty due diligence for Bitcoin providers.
IT general controls
The systems that record and report Bitcoin need the same IT general controls as other financial systems.
- Access management for custody platforms, trading interfaces and accounting tools, including multi-factor authentication.
- Change management for any spreadsheet or system that calculates fair value, cost basis or disclosures.
- Data integrity controls over imports of trade data and prices.
- Backup and recovery procedures for records and, where relevant, key material.
Spreadsheets deserve attention. Many companies run their lot register in one. It should be locked, version-controlled and reviewed, like any other key spreadsheet. Wider cyber risks are covered in cybersecurity for finance teams holding Bitcoin.
Monitoring and review
Controls degrade without oversight. Build in:
- A quarterly review of the control matrix by the CFO or controller.
- A report to the audit committee on exceptions, access changes and reconciliation results.
- An annual reassessment when policies, custody arrangements or volumes change.
- Internal audit coverage, where the company has an internal audit function.
Companies should take their own accounting, audit and legal advice on the design of their controls.
How The Bitcoin World helps
We help finance teams design the control framework around a Bitcoin position, including approval workflows, custody architecture and execution reporting that produce clean evidence. Execution and custody are carried out by licensed third-party institutions. See our custody architecture and board advisory services.