KPMG Blockchain Technology Risk Assessment

Sector: Tertiary sector · Industry: Auditing and tax consulting · Organisation: KPMG · Maturity level: Production

KPMG has developed a specialized assessment solution that helps companies understand and evaluate the complex security and technology risks associated with blockchain implementations. The solution analyzes ten key risk categories such as consensus mechanism, cryptography, key management, and governance using a standardized five-level maturity scale. Based on this assessment, companies receive concrete recommendations for developing effective controls and addressing identified vulnerabilities.

Documentation status

Project status: Production
Evidence: Evidence medium
Editorial review: Ufuk Avci, 15 April 2026

Description

KPMG, as one of the Big Four audit firms, has developed a structured framework for assessing Blockchain risks. With the increasing use of Blockchain in companies, a new audit field is emerging: auditors must be able to assess Blockchain-based systems and assets.

Blockchain risks differ fundamentally from classic IT risks: (1) Smart contract risks: code errors in immutable smart contracts cannot simply be patched — the 2016 DAO hack lost 60 million USD due to a smart contract bug. (2) Private key risks: loss of the private key means loss of all Blockchain-secured assets — no password reset possible. (3) Governance risks: decentralised systems have no central control — who decides in disputes? (4) Regulatory risks: MiCA (EU), GDPR, AML/KYC requirements. KPMG Blockchain Risk Assessment systematically addresses all these dimensions and provides companies with a structured basis for audit, compliance and strategic decision-making. KPMG Australia had OriginsNext as a Blockchain product spin-off — evidence of deep internal Blockchain expertise. The Big Four (KPMG, Deloitte, EY, PwC) have all built dedicated Blockchain practices.

Perspectives

B2B — organisations perspective

Companies using Blockchain can systematically assess their risks with the KPMG framework — as a basis for board decisions, insurance coverage and regulatory compliance.

Employees perspective

Risk managers and IT officers receive a professional tool for systematic Blockchain assessment that structures their work and expands their expertise. The standardised methodology facilitates communication of risks to management.

Benefits

General

Companies receive a standardised and quantifiable method for assessing Blockchain implementations.
The systematic analysis of ten key risk categories ensures comprehensive risk assessment.
Concrete recommendations for action enable targeted improvement of control mechanisms.

B2B — organisations

The structured risk assessment reduces uncertainty in Blockchain investments and enables informed business decisions.

Employees

Risk managers receive a professional tool that systematically and clearly assesses complex Blockchain risks.

Challenges

General

The assessment requires comprehensive technical knowledge and detailed information about the Blockchain implementation.
The complexity of Blockchain technology makes a complete risk assessment resource-intensive.

B2B — organisations

Companies must be prepared to disclose sensitive technical and operational information for the assessment.

Employees

Employees need training to correctly interpret and implement the assessment results.

Technology foundation

The solution uses proven risk management frameworks and digital assessment tools for the systematic analysis of blockchain implementations. It is technology-independent and can evaluate various types of blockchains such as public, private, or hybrid blockchains.

Implementation examples

KPMG Chain Fusion for Crypto Companies

Crypto companies and traditional companies with crypto assets require specialised audit procedures for their financial statements. Conventional audit methods are insufficient for the specific characteristics of blockchain-based assets.

KPMG developed Chain Fusion as a technology solution to support the audit of financial statements for crypto companies.

KPMG Chain Fusion is a specialised technology solution that supports the audit of financial statements for crypto companies and companies with crypto positions in their balance sheets. The solution complements KPMG's blockchain risk assessment offering and demonstrates the practical application of the developed assessment methodology. Chain Fusion shows how systematic risk assessment can be translated into concrete audit procedures.

The solution addresses the complex audit requirements for crypto assets and blockchain technologies. It ensures that the specific risks and control mechanisms are adequately considered in the financial statement audit.

Sources