Chapter 9 — Web3, blockchain and cryptoasset security: leadership and assurance

Lesson map

Lesson 09 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Leading assurance"]
  N2["9.2 Commissioning independent review"]
  N3["9.3 Reporting to governing bodies"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Leading assurance"]
  N2["9.2 Commissioning independent review"]
  N3["9.3 Reporting to governing bodies"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX041"]

[Learning outcomes]
    |
    v
[9.1 Leading assurance]
    |
    v
[9.2 Commissioning independent review]
    |
    v
[9.3 Reporting to governing bodies]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) lead assurance across partners; (2) commission independent review; (3) report assurance to governing bodies.

9.1 Leading assurance

Nadia leads an assurance plan for the pilot. It defines what must be assured: contract correctness, key control, validator resilience, operational procedures and data protection. For each area it names the evidence: external review reports, key ceremony records, availability data, drill results and data maps. Leadership means coordinating partners who have different priorities and making sure assurance work is done and shared, not duplicated or missed. She chairs a monthly assurance meeting and keeps a shared evidence register that all three institutions can read and contribute to.

9.2 Commissioning independent review

The partners commission an external review of the settlement contract against an agreed EthTrust level. Nadia writes the scope: contract code, deployment configuration and privileged roles, but not partner networks. She asks reviewers to report findings with severity and evidence and to retest fixes. The review finds two medium findings and one low, all fixed and retested before go-live. She notes the EthTrust caution that no review guarantees the absence of weaknesses, and explains it to the committee so they understand what the review does and does not provide.

9.3 Reporting to governing bodies

Nadia reports assurance quarterly to each institution's board risk committee. The report summarises status by area, open findings, incidents and near misses, and key metrics such as availability and sign-off detection. It states residual risks and asks for decisions where needed. Each report uses the same structure, so trends are visible. Boards appreciate concise reports that separate facts from judgements. Professor Tanaka notes that assurance reporting is ultimately about enabling governance: boards cannot oversee risks they do not understand, and the report's job is to make them understandable.

Worked example

Nadia's assurance plan covers five areas, the external review's two medium and one low findings are fixed before go-live, and boards get quarterly reports.

Synthetic case. The assurance plan, review and reports are synthetic; EEA EthTrust is a real source.

Errors and limits

Presenting an external review as a guarantee overstates what assurance provides.

Exercises

• EX041 — Assurance areas. Name one assurance area.
  Show marking criteria

  Rubric: 3 = validator resilience;; 2 = key control;; 1 = marketing;; 0 = none.
• EX042 — Review scope exclusion. What is excluded from the review scope?
  Show marking criteria

  Rubric: 3 = partner networks;; 2 = networks;; 1 = contract code;; 0 = none.
• EX043 — Review findings. What did the external review find?
  Show marking criteria

  Rubric: 3 = two medium and one low;; 2 = three findings;; 1 = vague;; 0 = none.
• EX044 — Reporting rhythm. How often are boards briefed?
  Show marking criteria

  Rubric: 3 = quarterly;; 2 = every quarter;; 1 = yearly;; 0 = none.
• EX045 — Report purpose. What is assurance reporting ultimately for?
  Show marking criteria

  Rubric: 3 = enabling governance;; 2 = oversight;; 1 = decoration;; 0 = none.

Synthesis

Coordinated assurance, scoped independent review and clear reporting enable governance.

Continue studying — chapter 09 of 12

← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →