Blockchain and Risk

Blockchain is a linear, tamper-resistant data structure first used by Bitcoin to maintain a growing transaction record without relying on a trusted third party. It enables distributed ledgers: shared transaction records replicated across multiple locations and organizations, where updates propagate quickly and access and change rights are controlled through cryptographic keys, signatures, and agreed rules. Distributed ledgers promise lower operating costs, faster publication of authorized changes, stronger integrity protection, and new applications such as smart contracts, but the report stresses that benefits must be validated against realistic risks.

Bitcoin achieves trustworthiness by combining cryptographic signing, block aggregation, and “proof of work,” where participants solve computational puzzles to validate blocks and earn rewards. This approach introduces practical issues: participant identities are obscured, keys may be lost or stolen (making assets irretrievable), and proof of work is inefficient and limits scalability. The report distinguishes ledger types (traditional single, private shared, community shared, public shared, and potential off-ledger mechanisms) and links them to three assurance-oriented use cases: assured information (registers), assured control (fraud-resistant transaction integrity), and assured rules (programmable enforcement, e.g., smart contracts). Ethereum extends blockchain by embedding programs in transactions to execute agreements autonomously and transparently.

Risk management is framed around hazard, control, and opportunity risks. Blockchain mitigates some hazards (unauthorized changes, certain data leakage scenarios, reduced reliance on trusted third parties, and improved availability), but introduces or reshapes policy/compliance, technical, and legal risks. Critical risks center on software platform integrity and operational security; important risks emphasize governance and compliance; longer-term risks include cryptographic durability. The report recommends a structured action plan: identify opportunities, quantify benefits and risks, choose an appropriate architecture/platform, and implement ongoing assurance and risk controls.

• Blockchain was invented to support the Bitcoin digital currency.
• Bitcoin’s key objectives included pseudo-anonymity for owners and trustworthiness without trusted third parties.
• Bitcoin transactions are signed using private keys and can be verified using the sender’s public key.
• Bitcoin groups transactions into blocks and uses a “proof of work” competition to validate new blocks.
• The first participant to publish a proof-of-work answer confirmed as correct wins 25 Bitcoins.
• The Bitcoin network is estimated to use around 1 gigawatt of energy, mostly devoted to proof of work.
• Bitcoin currently supports around 7 transactions per second.
• Current card payment systems support tens of thousands of transactions per second.
• With Bitcoin, maximum assurance can take up to one hour (or 6 blocks) due to verification latency.
• Ethereum raised $18.4 million through crowdfunding.

• “A blockchain is a data structure, originally used by bitcoin, that maintains a growing list of transaction records in a way that is extremely resistant to tampering.”
• “The constant challenge is to identify and quantify the real potential benefits and balance these against a realistic view of the potential risks.”
• “The primary value provided by a ledger is assurance.”
• “Blockchain provides a mechanism to establish trust without the need for a trusted third party.”
• “Risk is not an event; however, an event may crystallize a risk.”
• “More importantly many risks result from chains of events rather than individual ones.”
• “Blockchain technology provides an alternative approach that removes the need for certain kinds of controls.”
• “Non adopters risk losing existing market share as well as missing the new opportunities.”
• “The integrity of a distributed ledger is determined by the software platform upon which it runs.”
• “If these requirements are necessary, it is essential that they are designed into the Distributed Ledger application from the outset.”