Audit vs Attestation vs Assurance: What Crypto Reports Prove
Quick answer. Assurance is the umbrella: a practitioner's conclusion raising confidence in information. An audit gives an opinion on financial statements. An attestation covers someone else's claim, like reserves on a date. Smart contract audits are code reviews, not assurance.
Video transcript
Plenty of crypto reports say audit. Few are audits in the accounting sense, and each one proves something different.
Assurance is the umbrella: a practitioner's conclusion that raises confidence in information. An audit is assurance on financial statements. An attestation covers someone else's claim, like reserves on a date.
Circle's statements are audited by Deloitte, and its monthly USDC reports are examinations. BDO gives Tether's reserves report reasonable assurance, for one date only. Agreed-upon procedures give findings, with no assurance.
A smart contract audit is a security review of code at one commit, outside these standards. It lists findings and gives no opinion, and ethereum.org warns audits won't catch every bug.
Match the report to the question. Audited financials show what a company owns and owes. Reserve reports cover set dates. Code audits cover one commit. Merkle proofs miss other liabilities.
Read the signed report, not the headline. Watch for reserves called audited when they are not, no stated assurance level, one date shown as continuous backing, or a code audit cited as backing.
Reserve reports leave the code to someone else. Guardian's diligence reads the deployed code, checks it matches what was reviewed, and maps who can upgrade, pause or drain. Monitoring then moves the score when upgrades or new signers land.
Read the full guide for every report type, or talk to Guardian about the code behind the reports you rely on.
Crypto firms publish many reports with "audit" in the name. Few are audits in the accounting sense.
A reserve report signed by an accounting firm, a code review by a security firm and an exchange's Merkle tree answer different questions.
This guide sets out what each term means under professional standards, who signs each report and what it proves, using Tether's and Circle's own reports.
Three Words, Three Meanings
Accounting standard setters define these words precisely. The IAASB's assurance framework is the clearest map.
- Assurance: a practitioner gathers evidence and gives a conclusion that raises users' confidence in information.
- Audit: assurance on historical financial statements, under auditing standards, ending in an opinion.
- Attestation: assurance on information someone else prepared, such as management's claim about reserves.
So every audit is an assurance engagement, and an attestation is one kind of assurance. In the US, the AICPA's attestation standards also cover agreed-upon procedures, which give no assurance.
Reasonable and limited assurance
ISAE 3000 (Revised) sets two levels:
- Reasonable assurance: risk cut to an acceptably low level; the practitioner gives an opinion.
- Limited assurance: more risk accepted; the conclusion says whether anything suggests a material misstatement.
Agreed-upon procedures sit outside both. ISAE 3000 lists them among engagements that are not assurance engagements.
Financial Audits and Attestations
Financial statement audits
An audit covers a full set of financial statements for a period, liabilities as well as assets.
Circle's 2025 audit shows the form. Deloitte & Touche LLP, registered with the PCAOB, audited under PCAOB standards and reported on March 9, 2026.
Its opinion: the statements "present fairly, in all material respects, the financial position of the Company."
Tether's reserves report says Tether International's 2025 financial statements were audited. It does not name the auditor.
AICPA attestations
US accountants perform attestations under the AICPA's Statements on Standards for Attestation Engagements (SSAEs). There are three levels:
- Examination: reasonable assurance, and an opinion.
- Review: limited assurance, and a conclusion.
- Agreed-upon procedures: findings only, with no opinion or conclusion.
Circle's monthly USDC reports are examinations. Deloitte examined management's assertion that USDC reserves were "equal to or greater than" USDC in circulation.
Its October 26, 2026 opinion covers two moments, September 4 and September 30, 2026. Circle's criteria define circulation, leaving out frozen tokens, unissued tokens and pending burns.
A SOC 2 is also an AICPA examination, of controls at a service organization. Our SOC 2 guide covers what it tests.
ISAE 3000 and ISAE 3402
Internationally, ISAE 3000 (Revised) covers assurance engagements other than audits or reviews of historical financial information.
Tether's reserves report is assured under it. BDO Advisory Services, in Milan, gave reasonable assurance that Tether International's reserves report for September 30, 2026 is "fairly presented" against its stated criteria.
BDO limits that to one point in time and gives no assurance on the report's notes. Tether's report says it "does not represent the financial statements of the Company."
ISAE 3402 builds on ISAE 3000 for reports on controls at a service organization that matter to its customers' financial reporting.
Our guides to USDT and USDC cover the rest of each issuer's report.
Who can sign
ISAE 3000 assumes an independent practitioner bound by the IESBA ethics code, in a firm with quality control rules, or rules at least as demanding.
A practitioner outside public accounting may claim compliance, but those premises still apply.
Why Smart Contract Audits Differ
A smart contract audit shares the word, not the framework.
It is a security review of code at a fixed commit. Ethereum.org calls it "one way of conducting an independent code review."
None of the standards above governs it. The report lists findings by severity with recommended fixes, and gives no opinion that anything is fairly stated.
Ethereum.org also warns that audits "won't catch every bug."
A code audit says nothing about reserves or liabilities. In turn, neither BDO's listed procedures nor Deloitte's criteria include a review of token contracts or mint controls.
The IAASB framework tells practitioners that a report which is not assurance should avoid "inappropriately using the words 'assurance,' 'audit' or 'review.'" Code auditors work outside that framework.
Our guide to what a smart contract audit is covers scope and deliverables.
Which Report Answers Which Question
| Question | Report to ask for | Its limit |
|---|---|---|
| What does the company own and owe? | Audited financial statements | Annual; reported after year end |
| Do reserves cover tokens on a date? | Reserve examination or ISAE 3000 report | Only the report dates |
| Are a provider's controls sound? | SOC 2; ISAE 3402 for financial reporting | Only the controls and period in scope |
| Is the contract code secure? | Smart contract audit | One commit; no guarantee |
| Is my balance counted? | Merkle proof of reserves | One snapshot; misses other liabilities |
Report Types in Crypto
| Report | Standard | Signed by | Gives |
|---|---|---|---|
| Financial statement audit (Circle) | Auditing standards (PCAOB, ISAs) | Independent auditor | Opinion |
| Reserve examination (Circle) | AICPA SSAEs | CPA firm | Opinion, reasonable assurance |
| Reserve assurance report (Tether) | ISAE 3000 (Revised) | Accounting firm | Opinion, reasonable assurance |
| Agreed-upon procedures (Mazars, 2022) | AUP standards | Accounting firm | Findings only |
| Controls report | SOC 2 or ISAE 3402 | Accounting firm | Opinion on controls |
| Smart contract audit | None | Security firm | Findings by severity |
| Merkle proof of reserves | None | The exchange | A check you run yourself |
Red Flags in Report Marketing
Read the signed report, not the headline. Watch for:
- "Audited" reserves, when the report is an attestation or agreed-upon procedures.
- No stated level: reasonable assurance, limited assurance or none.
- A dashboard or press release with no signed report behind it.
- One date presented as continuous backing.
- Key sections outside scope, like the notes in Tether's report.
- Criteria the issuer wrote, read without checking what they count or exclude.
- A code audit cited as proof of backing, or reserves cited as proof of safe code.
- An unnamed signer, or one that is not an accounting firm.
Mazars shows why labels matter. In December 2022 it paused proof of reserves work for crypto clients, citing "the way these reports are understood by the public."
Its reports, it said, did "not constitute either an assurance or an audit opinion."
In March 2023, PCAOB staff warned that proof of reserve reports "do not provide any meaningful assurance" and likely do not address liabilities.
Our guide to verifying proof of reserves shows what you can check yourself.
How Guardian Helps
Reserve reports leave the code and who controls it to someone else. That is the side Guardian works on.
For capital allocators, Guardian's diligence reads the deployed code, checks it matches what was reviewed, and maps who can upgrade, pause or drain.
Monitoring then moves a position's score when upgrades, new signers or swapped oracles land.
Frequently Asked Questions
What is the difference between an audit and an attestation?
An audit gives an opinion on a full set of financial statements. An attestation reports on a specific claim someone else prepared, such as management's assertion that reserves cover tokens on a date. An examination-level attestation also gives reasonable assurance.
Is a proof of reserves an audit?
No. PCAOB staff warned in 2023 that proof of reserve reports are not audits and likely do not address liabilities. Some reserve reports are reasonable assurance attestations, like Circle's and Tether's; others are agreed-upon procedures with findings only.
Is a smart contract audit an assurance engagement?
No. It is a security review of code at a fixed commit, done outside accounting assurance standards. It lists findings and fixes, gives no opinion that anything is fairly stated, and ethereum.org notes audits won't catch every bug.
Is Tether audited?
BDO gives reasonable assurance on Tether International's quarterly reserves report under ISAE 3000 (Revised), a standard for engagements other than audits. The report says Tether International's 2025 financial statements were audited, but does not name the auditor.
Sources
- IAASB (IFAC): ISAE 3000 (Revised), International Framework for Assurance Engagements and Related Conforming Amendments, including ISAE 3402 (final pronouncement, December 2013)
- Journal of Accountancy: More flexibility for agreed-upon procedures (September 1, 2020)
- AICPA and CIMA: SOC 2, Reporting on an Examination of Controls at a Service Organization (read November 6, 2026)
- SEC: Circle Internet Group, Inc. Form 10-K for 2025, report of Deloitte & Touche LLP (March 9, 2026)
- Circle: Transparency and Stability (read November 6, 2026)
- Deloitte & Touche LLP: Independent Accountants' Report on the USDC Reserve Report, September 2026 (October 26, 2026)
- BDO Advisory Services: Assurance Report according to ISAE 3000R on Tether International's Financial Figures and Reserves Report as of September 30, 2026 (October 30, 2026)
- ethereum.org: Smart contract security (updated October 22, 2026)
- CNBC: Mazars suspends all work with crypto clients, including Binance and Crypto.com (December 16, 2022)
- DLA Piper: PCAOB staff warns investors (and auditors) about proof of crypto reserve reports (March 13, 2023, on the PCAOB advisory of March 8, 2023)
- Guardian: What Is a Smart Contract Audit? Process and Deliverables
Check the code behind the report
Reserve reports stop at the balance sheet; Guardian reads the deployed code and who controls it before you allocate.