Auditing the Token: ISA, IFRS, and the New Assurance Mandate in the Caribbean

Editor’s Note

This is the sixth article in a twelve-part Dawgen Global series introducing DAGAF™ — the Digital Asset Governance & Assurance Framework. Articles 1 through 5 set out the inflection-point argument, mapped the foreign regulatory regimes, established the architecture of DAGAF™, and treated Pillar 1 (Governance and Board Oversight) and Pillar 3 (Tax Treatment and Reporting) in detail. This article treats Pillar 4 — Audit and Assurance — the dimension that, in our experience, will most acutely test the depth of Caribbean professional practice over the next 24 to 36 months. It is intended for an audience of audit engagement partners, audit committee chairs, internal audit leaders, and senior finance executives preparing for the audit treatment of tokenized assets and liabilities.

The Engagement Partner Who Has To Sign Something

There is a moment, occurring with growing frequency in Caribbean audit engagements, when the engagement partner has to make a judgment they did not have to make three years ago. The client’s audited financial statements include an asset — or a liability — that did not exist as a discrete category in the auditing standards under which the engagement partner was trained. A tokenized debt instrument carried at amortised cost. A tokenized real estate fund interest classified as held for trading. A tokenized credit union member share. A holding of a recognised stablecoin maintained for treasury liquidity purposes. The engagement partner has to evaluate the classification, has to consider the audit evidence, has to form an opinion on the fair presentation, and has to sign.

The audit standards under which the engagement partner was trained — the International Standards on Auditing as issued by the International Auditing and Assurance Standards Board — do not, in their current form, address tokenized assets and liabilities as a discrete subject matter. They address the universal questions: identifying and assessing risks of material misstatement (ISA 315), obtaining sufficient appropriate audit evidence (ISA 500), auditing accounting estimates (ISA 540), evaluating internal control (ISA 315 again, in conjunction with ISA 330), and exercising professional judgment and professional scepticism throughout (ISA 200). The questions are universal. The procedures by which they are answered, when the asset is a tokenized instrument recorded on a blockchain the audit firm does not control, are emphatically not universal.

This article addresses, in structured form, the audit and assurance treatment of tokenized assets and liabilities under the existing ISA and IFRS frameworks. Part I establishes why conventional audit programmes fall short when applied to tokenized engagements without modification. Part II walks through the IFRS classification questions that arise in five tokenized instrument archetypes Caribbean engagement partners are most likely to encounter. Part III sets out the audit assertions framework applied to tokenized assets, with a structured matrix of conventional procedures, tokenized-asset-specific procedures, and the specialist input that effective execution typically requires. Part IV addresses the broader assurance toolkit — ISAE 3000, ISAE 3402, and proof-of-reserves engagements — with the scope considerations that distinguish appropriate use from inappropriate use. Part V closes with the operational practice of the Audit Readiness Review, the pre-issuance engagement Dawgen Global’s Audit & Assurance practice offers under DAGAF™ Pillar 4.

	“The questions are universal. The procedures by which they are answered, when the asset is a tokenized instrument recorded on a blockchain the audit firm does not control, are emphatically not universal.”
PART I Why Conventional Audit Programmes Fall Short

Conventional Caribbean audit programmes were designed, over decades of professional practice, to provide reasonable assurance over assets and liabilities that exist in a particular institutional environment. The conventions are mature and largely sound. Title to a real estate asset is evidenced by a registered deed; existence is confirmed by physical inspection or by certified copy; valuation is supported by recognised valuation methodologies executed by qualified valuers; rights and obligations are documented in conventional contracts. Title to a debt security is evidenced by a confirmation from the custodian or transfer agent; existence is confirmed through that confirmation; valuation references recognised market quotes or, where relevant, level 2 or level 3 valuation models; rights are documented in the indenture. The procedures work because the institutional environment supports them.

Tokenized assets disrupt the institutional environment in three specific ways that conventional audit programmes are not, without modification, equipped to address. First, the canonical record of ownership is not maintained by an institution the audit firm has any contractual relationship with. The blockchain that records the holding is operated, in most cases, by a decentralised network of participants none of whom can sign a confirmation in the conventional sense. The audit evidence has to be obtained directly from the chain itself, through procedures that require specific technical capability. Second, the rights attached to the holding are encoded, in significant part, in smart contract code rather than in conventional instruments. A meaningful evaluation of holder rights requires either a review of the smart contract code or a competent legal opinion that has itself relied on such a review. Third, the valuation evidence available depends on the liquidity profile of the tokenized instrument and the integrity of the price oracles or market data feeds that produce the valuation. None of the three problems is insurmountable. None of them is addressed by a conventional audit programme without explicit modification.

ISA 315, the standard governing identification and assessment of risks of material misstatement, anticipates that the auditor will tailor procedures to the specific circumstances of the entity and its environment. The standard does not specify procedures for tokenized assets because the standard does not specify procedures for any asset; it specifies the analytical framework within which procedures are designed. The implication is straightforward: the engagement partner is required to identify the risks of material misstatement that arise from the entity’s tokenized activities, to assess them, and to design procedures that respond to them. Where conventional procedures are insufficient, alternative or additional procedures must be deployed. Where the audit firm does not possess the specialist capability to deploy them, the firm must engage a competent specialist. Where the specialist work cannot reach the threshold of sufficient appropriate audit evidence, the audit opinion must reflect that limitation.

	ISA 540 AND THE EXPANSION OF ESTIMATE WORK ISA 540 — Auditing Accounting Estimates — was substantially revised in 2018 to address the increasing complexity of accounting estimates in modern financial statements. The revised standard requires the auditor to obtain an understanding of how management makes estimates, to evaluate the methods, assumptions, and data used, and to assess the risk of management bias. Tokenized assets that depend on price oracles or thinly traded markets fall squarely within the scope of ISA 540’s expanded requirements. The estimate work — obtaining the data, evaluating the methodology, testing the assumptions, considering management bias — is materially more demanding for tokenized assets than for conventional financial instruments. Engagement teams that allocate audit budget on prior-period assumptions will find the work substantially under-resourced.
PART II IFRS Classification — Five Tokenized Instrument Archetypes

Before the audit evidence question can be addressed substantively, the IFRS classification question must be answered. The classification determines the recognition and measurement framework, which in turn determines the audit procedures. IFRS, like ISA, does not address tokenized instruments as a discrete category. It applies the general classification principles of IFRS 9 (Financial Instruments), IFRS 15 (Revenue from Contracts with Customers), IAS 32 (Financial Instruments: Presentation), IAS 38 (Intangible Assets), and where relevant IFRS 16 (Leases) and IAS 40 (Investment Property). The question is which standard, or combination of standards, governs a particular tokenized instrument. The answer is fact-dependent and should be documented in a contemporaneous classification memorandum before issuance, not at year-end.

Five tokenized instrument archetypes account for the majority of Caribbean engagements through 2026 and the first half of 2027. Each presents distinct classification questions; each is treated separately below.

Archetype 1 — Tokenized debt instruments

A tokenized debt instrument that has a contractual right to receive a stream of cash flows that are solely payments of principal and interest, and that is held within a business model whose objective is to collect contractual cash flows, falls within IFRS 9’s amortised cost measurement category. A tokenized debt instrument held within a business model that may include both collection of contractual cash flows and selling falls within fair value through other comprehensive income. A tokenized debt instrument held for trading falls within fair value through profit or loss. The classification questions are conventional; the audit work — confirming existence, valuation, and rights — requires the tokenized-asset-specific procedures discussed in Part III.

Archetype 2 — Tokenized equity instruments

A tokenized equity instrument is, in most cases, an investment in another entity — either an associate, a joint venture, or a financial asset — governed by IFRS 9 (for non-controlling, non-consolidated investments without significant influence), IAS 28 (for associates and joint ventures), or IFRS 10 (for subsidiaries). The technology layer does not typically alter the classification. The audit work focuses on existence (wallet ownership), rights (smart contract review), and valuation (market evidence or level 2 / level 3 methodologies for less liquid instruments).

Archetype 3 — Tokenized fund and pooled investment interests

A tokenized fund interest — a fractional interest in a tokenized real estate fund, a tokenized credit fund, or a tokenized alternative investment vehicle — is typically classified under IFRS 9 as a financial asset measured at fair value through profit or loss, unless the entity has elected to apply the amortised cost measurement category in narrow circumstances. The classification raises the consolidation question: where the entity holds a controlling interest in the fund through its tokenized holding, IFRS 10 may apply. Where the entity exercises significant influence, IAS 28 applies. The audit work concentrates on the valuation question — fund-level NAV, redemption rights, transfer restrictions — and on the smart contract review confirming the rights attached to the fractional holding.

Archetype 4 — Tokenized utility, service, and platform tokens

A tokenized utility instrument — a token granting access to a service, a software platform, or a defined utility — is generally not a financial instrument under IFRS 9. It is, more frequently, an intangible asset under IAS 38 or, for the issuer, a contract liability or revenue obligation under IFRS 15. The classification depends on the specific rights attached to the token and on whether the issuer has a contractual obligation to deliver service in exchange. The audit work focuses on existence, on the proper recognition pattern under IFRS 15 (where applicable), and on impairment indicators under IAS 38.

Archetype 5 — Stablecoins and other tokenized cash-equivalent instruments

A holding of a recognised stablecoin maintained for treasury liquidity purposes is, in most cases, classified under IFRS 9 as a financial asset measured at fair value through profit or loss. The cash-equivalent classification under IAS 7 is generally not available because most stablecoins do not meet the “readily convertible to known amounts of cash” test with sufficient certainty in stress conditions. Where an entity issues a stablecoin, the issuance is a financial liability under IAS 32 and IFRS 9, with reserve obligations recognised separately. The accounting treatment of stablecoin reserves and stablecoin issuance has been the subject of substantial recent attention from the IFRS Foundation and from regional standard setters; engagement teams should monitor developments and expect specific guidance to issue during 2026 and 2027.

	THE CLASSIFICATION MEMORANDUM IS NOT OPTIONAL Every material tokenized instrument should have a contemporaneous IFRS classification memorandum prepared by management and reviewed by qualified specialists, dated before the period in which the instrument first appears in the financial statements. The memorandum should identify the instrument, set out the rights and obligations attached to it, address each potentially applicable IFRS standard, identify the standard or combination of standards that govern, and document the analytical basis for that conclusion. The memorandum is the foundation on which the audit work rests. Engagement teams that begin the audit without a complete classification memorandum will spend disproportionate audit budget reconstructing it under deadline pressure.
PART III Obtaining Sufficient Appropriate Audit Evidence

Once the IFRS classification is established, the audit programme is built around the audit assertions — the specific representations embedded in the financial statements that the audit must test. ISA 315 organises these assertions into categories: existence and occurrence, completeness, accuracy and valuation, rights and obligations, presentation and disclosure, and cut-off. The matrix below sets out, for each assertion, the conventional procedure deployed in pre-tokenization audit engagements, the tokenized-asset-specific procedure that should be deployed in addition or in substitution, and the specialist input that effective execution typically requires.

 

TABLE 1  —  AUDIT ASSERTIONS APPLIED TO TOKENIZED ASSETS

Audit Assertion	Conventional Procedure	Tokenized Asset Procedure	Specialist Input
Existence / Occurrence	Confirmation from custodian; physical inspection of certificates; bank statements.	On-chain wallet ownership confirmation; signed message verification using cryptographic challenge-response; reconciliation of on-chain holdings to ledger.	Blockchain forensics specialist for high-value or complex wallets.
Completeness	Cut-off testing; subsequent receipts review; analytical review of period flows.	Block-level reconciliation across the period under audit; smart contract event log review; comparison of issued tokens to ledger.	Smart contract code review and event-log analysis; integration with chain analysis tooling.
Valuation	Market price evidence; broker quotes; valuation models for illiquid instruments; impairment indicators review.	On-chain or recognised exchange price evidence; oracle reliability assessment; level 2 or level 3 fair value methodologies for thinly traded tokens.	Valuation specialist for level 2 / level 3 tokens; oracle integrity review.
Rights and Obligations	Title documentation; loan and security agreements; trust deeds; confirmation of beneficial ownership.	Smart contract review confirming holder rights, transfer mechanics, redemption rights, and any encumbrances; legal opinion on tokenized instrument characterisation.	Smart contract auditor for code-level confirmation; legal counsel for instrument characterisation.
Presentation and Disclosure	IFRS classification testing; disclosure checklist; review of significant accounting policies.	IFRS classification of tokenized instrument (IFRS 9, IFRS 15, IAS 32, IAS 38); disclosure of custody arrangements, smart contract risks, and oracle dependencies.	IFRS technical specialist where classification is novel or where multiple standards potentially apply.
Cut-off	Period-end transaction testing; bank statement review; subsequent settlement testing.	Block-time reconciliation against entity’s recognised period-end; review of pending transactions in mempool; settlement finality testing.	Blockchain timestamping specialist for cross-chain or finality-uncertain transactions.

Source: Dawgen Global synthesis applying ISA 315, ISA 330, ISA 500, and ISA 540 to the tokenized asset context. The matrix is an analytical reference; specific procedures must be tailored to the engagement.

Three observations on how the matrix is intended to be used. First, the procedures listed are necessary but not always sufficient. Where the entity’s tokenization activity is material and complex, additional procedures may be required, and the engagement partner must form a judgment about whether sufficient appropriate audit evidence has been obtained in the specific circumstances. Second, the specialist input column does not imply the audit firm itself must possess every specialism listed; engaging an external specialist under ISA 620 (Using the Work of an Auditor’s Expert) is a recognised and frequently appropriate response. The audit work is not weaker for using a specialist; it is weaker for not using one when one is required. Third, the procedures interact with the entity’s internal control environment over tokenized activity. A well-designed control environment — documented key management procedures, smart contract change management, oracle redundancy, custodian SOC reporting — produces audit evidence efficiently. A poorly designed control environment requires substantial substantive work to obtain equivalent assurance.

PART IV ISAE 3000, ISAE 3402, and Proof-of-Reserves — The Right Tool for the Right Question

The financial statement audit under the ISA framework is one of several assurance engagements relevant to the tokenization environment. Where the question is not the fair presentation of full financial statements but a specific subject matter — reserve composition, control effectiveness at a service organisation, the existence of a particular asset pool — a different engagement type is the right tool. The choice matters because each engagement type has its own scope, its own assurance threshold, and its own users. Misuse, in any direction, produces the wrong conclusion.

 

TABLE 2  —  ASSURANCE ENGAGEMENT TYPES IN THE TOKENIZATION CONTEXT

Engagement Type	Standard	Scope	When to Use
Financial Statement Audit	ISA framework	Reasonable assurance on full financial statements including tokenized assets and liabilities.	Regulated entities; entities with audit obligations under company or securities law.
ISAE 3000 Attestation	ISAE 3000 (Revised)	Reasonable or limited assurance on a specific subject matter — e.g., reserve composition, disclosure compliance.	Stablecoin reserves; specific representations to investors or regulators.
ISAE 3402 Service Org Report	ISAE 3402	Reasonable assurance on a service organisation’s controls relevant to user entities’ financial reporting.	Custody providers; tokenization platform operators; fund administrators.
Proof-of-Reserves	Typically ISAE 3000-based but with significant scope limitations	Limited assurance on the existence and amount of reserves at a point in time. Does not address liabilities or solvency.	Stablecoin and custodial token issuers — with explicit communication of scope limits.

 

ISAE 3000 attestation engagements

ISAE 3000 (Revised) governs assurance engagements other than audits or reviews of historical financial information. It is the standard under which an audit firm can express reasonable or limited assurance on a specific subject matter — the reserve composition of a stablecoin issuer, the disclosure compliance of a tokenized fund’s investor reporting, the control effectiveness of a tokenization platform’s KYC processes. The standard requires the practitioner to identify the subject matter precisely, to evaluate it against suitable criteria, to obtain sufficient appropriate evidence, and to issue a report that is intelligible to the intended users. ISAE 3000 engagements have grown materially across the global tokenization ecosystem and are the single most frequent supplementary engagement Caribbean issuers should expect to need.

ISAE 3402 service organisation reports

Where the entity’s tokenization activity depends on a service organisation — a custody provider, a tokenization platform operator, a fund administrator, an exchange — ISAE 3402 governs the assurance on that service organisation’s controls. The user entity’s auditors rely on the service organisation’s ISAE 3402 report to obtain audit evidence over controls operated outside the user entity’s direct supervision. Caribbean entities entering tokenization arrangements should require their service organisation counterparties to maintain current ISAE 3402 reports; absence of an ISAE 3402 report is not, by itself, a disqualifying condition, but it materially complicates the user entity’s audit and, in some cases, prevents the user entity’s auditor from obtaining sufficient evidence over the controls operated by the service organisation.

Proof-of-reserves — a specific tool with specific limits

Proof-of-reserves engagements have proliferated across the global tokenization ecosystem, often in response to user demand for transparency about reserve composition. The form varies; the typical engagement is structured under ISAE 3000 with limited assurance on the existence and composition of identified reserve assets at a defined point in time. The scope is what audit committees, investors, and regulators must understand. Proof-of-reserves does not address the issuer’s liabilities. Proof-of-reserves does not address solvency in the conventional sense. Proof-of-reserves is point-in-time assurance, not period assurance, unless the engagement is specifically structured to provide period assurance (which is unusual). Engagement teams and users must communicate these scope limits clearly. A proof-of-reserves engagement misunderstood as a financial statement audit produces false confidence and creates downstream professional risk.

	“A proof-of-reserves engagement misunderstood as a financial statement audit produces false confidence and creates downstream professional risk.”
PART V The Audit Readiness Review

The single highest-leverage audit and assurance engagement in the tokenization environment is, in our experience, the pre-issuance Audit Readiness Review. The review takes place before the entity issues the tokenized instrument or operationalises the tokenization initiative; its purpose is to identify and remediate audit and assurance gaps while remediation is still possible at low cost. By the time the period closes and the financial statement audit begins, many gaps that could have been closed efficiently before issuance can only be closed inefficiently — with substantial substantive work, retrospective documentation, and in some cases scope limitations on the audit opinion.

A typical Audit Readiness Review covers the following areas. First, the IFRS classification work — confirming that a contemporaneous classification memorandum exists, that it addresses each applicable IFRS standard, and that the classification will support the entity’s intended accounting policies. Second, the audit-evidence procedures — confirming that the entity’s records, controls, and counterparty arrangements will support the audit assertions matrix in Part III, and identifying gaps. Third, the service organisation arrangements — confirming that custody, tokenization platform, oracle, and fund administration counterparties have appropriate ISAE 3402 reports or equivalent assurance arrangements. Fourth, the attestation engagement scope — where ISAE 3000 work is contemplated for stablecoin reserves, proof-of-reserves, or similar, confirming that scope is set appropriately for the intended user community. Fifth, the disclosure framework — confirming that the disclosure architecture in the entity’s notes to the financial statements will reflect the tokenization activity adequately under IFRS, given the materiality and complexity of the activity.

The review produces a structured report identifying observations, prioritised remediation, and a documented record sufficient to support the audit committee’s oversight obligation under DAGAF™ Pillar 1 and the engagement partner’s planning obligation under ISA 300. The cost of the review is, almost without exception, materially less than the cost of remediating the same gaps under deadline pressure during the financial statement audit; we have not yet encountered a Caribbean engagement where the calculus reversed.

WHEN TO COMMISSION THE AUDIT READINESS REVIEW The right time to commission an Audit Readiness Review is between board approval of the tokenization initiative and the issuance of the tokenized instrument or the operationalisation of the initiative. The review should complete in time for any remediation it identifies to be implemented before the period over which the audit opinion is given begins. For initiatives crossing the year-end boundary, the review should complete at least 60 days before period-end. For initiatives launching mid-period, the review should complete before the launch. Audit committees that defer the review until later in the cycle accept a materially worse risk-adjusted outcome on the audit and may discover, late in the cycle, that material remediation is no longer possible.

The Pillar That Tests the Profession

Pillar 4 of DAGAF™ will, in our analysis, be the pillar that most acutely tests Caribbean professional practice over the next 24 to 36 months. The profession has the standards. The profession has the analytical training. What the profession is being asked to develop — quickly, deliberately, and substantively — is the procedural toolkit and the specialist capability to apply the existing standards to instruments and structures the standards did not anticipate. The Caribbean firms that develop the toolkit and the capability will set the regional benchmark for tokenization audit practice. The firms that defer will find their clients’ engagements migrating to the firms that did not.

Dawgen Global’s Audit & Assurance practice is, deliberately, in the first cohort. The methodology under DAGAF™ Pillar 4 is being deployed actively across the firm’s tokenization-relevant engagements, with the specialist input arrangements (smart contract review, blockchain forensics, IFRS technical specialism, valuation specialism) embedded into engagement planning. The Audit Readiness Review is the standard pre-issuance entry point for clients moving from contemplation to execution; the financial statement audit and supporting attestation engagements continue as the standard post-issuance work.

“The firms that develop the toolkit and the capability will set the regional benchmark for tokenization audit practice. The firms that defer will find their clients’ engagements migrating.”

Article 7 — examining Pillar 5, Custody, Keys, and Cyber — will publish in the next edition. Pillar 5 is the operational counterpart to the audit and assurance work this article addresses; the audit work depends, in significant part, on the custody and operational risk environment in which the tokenized assets are held. The full DAGAF™ White Paper, which sets out the framework in complete form, is available on request. The Audit Readiness Review engagement is offered as a discrete service line within Dawgen Global’s Audit & Assurance practice and is the standard entry point for clients moving from contemplation to execution on tokenization initiatives.

 

REQUEST AN AUDIT READINESS REVIEW Pre-issuance assurance design  •  IFRS classification rigour  •  Audit-ready documentation The Audit Readiness Review is a structured pre-issuance engagement assessing the audit and assurance arrangements for a tokenization initiative. The review covers IFRS classification, audit-evidence procedures, custodian and service-organisation reporting requirements, attestation engagement scope, and the working-paper architecture required to support an unqualified audit opinion. The review is offered by Dawgen Global’s Audit & Assurance practice as a discrete engagement under DAGAF™ Pillar 4. [email protected] 876-929-3670   •   876-665-5926   •   US: 855-354-2447 47 Trinidad Terrace, New Kingston, Jamaica  •  dawgen.global Big Firm Capabilities. Caribbean Understanding.

SOURCES & REFERENCES

Dawgen Global, DAGAF™ — Digital Asset Governance & Assurance Framework, First Edition (May 2026); International Standards on Auditing, including ISA 200, ISA 300, ISA 315, ISA 330, ISA 500, ISA 540, ISA 620, as issued by the International Auditing and Assurance Standards Board; International Standards on Assurance Engagements, including ISAE 3000 (Revised) and ISAE 3402, as issued by the IAASB; International Financial Reporting Standards, including IFRS 9, IFRS 10, IFRS 15, IFRS 16, IAS 7, IAS 28, IAS 32, IAS 38, and IAS 40, as issued by the International Accounting Standards Board; IFRS Foundation discussions on the accounting for digital assets and tokenized instruments; AICPA Auditing Standards Board guidance on auditing entities holding digital assets; Caribbean Institute of Chartered Accountants and member-body guidance. The matrices in this article are analytical references; specific engagement procedures must be tailored to the entity and the standards in force at the engagement date. Positions reflect the author’s analysis as of April 2026.

ABOUT THE AUTHOR

Dr. Dawkins Brown is the Executive Chairman and Founder of Dawgen Global, an independent integrated multidisciplinary professional services firm headquartered in Kingston, Jamaica, operating across the Caribbean. The firm advises Caribbean enterprises, regulators, and public-sector institutions on audit and assurance, tax, risk management, cybersecurity, IT and digital transformation, corporate recovery, M&A, business advisory and strategy, accounting outsourcing, and human capital. Dr. Brown is the architect of DAGAF™ and the Founding Editor of Caribbean Boardroom Perspectives.

ABOUT THIS SERIES

The Caribbean Tokenization Imperative is a 12-article series introducing the DAGAF™ framework. Articles 1 to 5 set out the inflection-point argument, mapped the foreign regulatory regimes, established the architecture of DAGAF™, and treated Pillars 1 (Governance and Board Oversight) and 3 (Tax Treatment and Reporting). This article (Article 6) treats Pillar 4 — Audit and Assurance. Article 7 — examining Pillar 5, Custody, Keys, and Cyber — will publish in the next edition. Subsequent articles will examine principal Caribbean use cases and conclude with a 24-month implementation roadmap. The full DAGAF™ White Paper is available on request.

© 2026 Dawgen Global. All rights reserved. DAGAF™ is a proprietary framework of Dawgen Global.

About Dawgen Global