Audit vs attestation vs verification: three words that mean different things
Audit vs attestation vs verification: three words that mean different things
In crypto and private credit, three words get used as if they were interchangeable: audit, attestation, and verification. They aren't. Each comes from a different kind of firm, covers a different scope, and carries a different legal weight. Knowing which one you're looking at tells you how much it's actually worth.
Audit
A financial statement audit is performed by a licensed public accounting firm under a formal standard (GAAS or PCAOB standards in the US, ISA internationally). The auditor tests the company's books, samples transactions, checks controls, and issues an opinion on whether the financial statements are fairly presented.
An audit covers a period, usually a year, and arrives months after that period ends. It's the heaviest form of assurance, and the auditor carries professional liability for it.
What it doesn't do: confirm what's happening today. A clean audit for last December says nothing about this morning.
Attestation
An attestation is narrower. An accounting firm examines a specific claim made by management, such as "we hold reserves of X at date Y", and reports on whether that claim holds. Most "proof of reserves" reports from stablecoin issuers and exchanges are attestations, not audits.
Attestations come in levels. An examination gives reasonable assurance. A review gives limited assurance. An agreed-upon procedures report gives no assurance at all; it just lists what was checked and what was found.
What it doesn't do: cover anything outside the claim. A reserves attestation at month-end tells you nothing about liabilities, about the day after, or about whether the assets were borrowed for the snapshot.
Verification
Verification, in the sense used across tokenized finance, means checking data against its primary sources, continuously or on a set cycle, and making the result checkable by others. Bank balances get matched to bank feeds. Loan payments get matched to servicer records. Lien filings get matched to the public registry.
Verification is usually done by technology rather than by a licensed audit firm, so it doesn't carry an audit opinion. What it adds is frequency and reproducibility. Instead of a yearly opinion, you get a running record of whether the data still matches its sources, often fingerprinted so anyone can confirm it hasn't been edited (see What is a cryptographic hash?).
How they fit together
| Who does it | Scope | Frequency | Legal weight
Audit | Licensed audit firm | Full financial statements | Annual | Formal opinion
Attestation | Accounting firm | One management claim | Point in time | Depends on level
Verification | Technology layer | Data vs primary sources | Continuous or periodic | No audit opinion
None of these replaces the others. The audit gives you formal assurance on the year. The attestation answers a specific question on a specific date. Verification fills the months between and makes changes visible as they happen.
The test for any report is to ask three questions. Who signed it? What exactly does it cover? As of when? If the answers are vague, the assurance is too.
For how Rekord fits into this picture, see Is Rekord an auditor?