Can you provide a list of good auditors for crypto-related products. The list may be split by different aspects: smart contracts, financial, legal, game-theoretic aspects etc... Additionally, can you say what you are looking for when evaluating an auditor. I'm also interested in any material that can help me make a better decision when selecting an auditor. (The analysis may be extended to non-crypto for other readers, but I'm mostly interested in crypto-related)
I'm going to focus mainly on traditional audit, as in CPA services. For crypto native audit you have Certik, OpenZeppelin, Peckshield, Halborn, Chaos Labs, Trail of Bits, Quantstamp, Slowmist, Hacken, Spearbit, among others. We are Halborn and Chaos Labs investors so I have a preference for those naturally. To a certain extent, these crypto native audit firms are somewhat fungible, although they may have different focus areas. Some focus on crypto-economic design whereas others focus on pure code audit. I would go for references here. I think what's trickier is evaluating a crypto-native CPA firm (as in, traditional audit and assurances).
The first distinction would be defining “good auditors.” Depending on your circumstances, “good” might mean different things.
For example, the Big 4 accountancy have the people, process, and technology, to perform extremely comprehensive audits and attestations. They have huge national offices, with thousands of partners, quality control personnel to ensure the quality of the audits are “good.” However, the flipside of this is that B4 audits can be extremely invasive, time consuming, extremely expensive and often perceived as “overkill,” especially if you are a startup. There are also mid-tier firms, and smaller boutique shops, all with their pros and cons depending on your specific list of considerations.
So, if you were looking for a “good firm” for a FS audit, I would consider the following
As you go through the Request for Proposal process, you will have an opportunity to learn about your prospective auditor’s approach to these considerations. During these introductory calls and throughout the process, I would:
In the US, the Accounting firm industry has been slow to service the space. However, as time goes on, more and more firms are building up the expertise and risk-tolerance to service the space.
From an audit perspective, these firms are audit either public companies, issuing public attestations (a la stablecoins) or are known to service the space in an audit capacity in some shape or form. This is not a comprehensive list, but should help you get started:
B4: Deloitte (USDC/Coinbase), EY (EY I consider very technically competent but as with all of the Big 4 they are politically constrained from doing crypto stuff)
MidTier: Grant Thornton (previously Coinbase), Marcum (which merged in Friedman – a few miners, Withum (Paxos), Aprio, Mazars, BPM, RSM, Cohen & Company
Smaller/Boutique: The Network Firm, Prescient Assurance
I know the principals at The Network Firm and trust them. They have a ton of experience given their history with crypto-native audit at Armanino.
From an international perspective, this a lot more challenging. Firms can operate as independent entities, even though they are under the same “name.” for example, KPMG UK may operate largely independently from KPMG Malta. The latter may service the space, but the former may not depending on their office/national offices approach to the industry.
(thanks to Jeremy Nau for his feedback on this answer)