Big Four Audit Concentration Is The Supplier Risk Boards Never Model
Boards can name their second-choice cloud provider and cost the migration. Almost none can do the same for the firm that certifies them to lenders and regulators. The default was free while no challenger could be accepted; that condition is weakening.
Every serious board can describe its cloud concentration risk. It can name the second supplier, estimate the migration cost, and put a rough number of months against the switch. Ask the same board who signs off its accounts and you get a name and a renewal date. Assurance is the one supplier position that never gets tendered or modelled, and it sits directly underneath the function whose whole job is pricing risk.
The odd part is that the default was rational. For four decades, buyers of assurance were not really buying accuracy. They were buying defensibility: a signature that a lender, an insurer, an institutional shareholder and a regulator would all accept without a second question. Accuracy is hard to observe and only matters once something has already gone wrong; acceptance is observable on day one. When the product is acceptance, brand stops being marketing laid over the good and becomes the good itself, and no entrant can manufacture it at any price. Superior method has very little to do with why four firms hold the market.
What does audit concentration actually cost a UK board?
The usual complaint about concentration is price. The more expensive problem is feedback. A supplier that cannot plausibly be substituted gets no signal when its quality drifts, so the drift shows up in inspection reports instead of in lost work. The PCAOB's 2022 inspection cycle for EY recorded deficiencies in 20 of the 46 issuer audits it reviewed, about 43%, where a Part I.A deficiency means the firm had not obtained sufficient appropriate evidence to support the opinion it had already signed. Two caveats, both load-bearing: inspectors deliberately select engagements they consider higher risk, so this is nothing like a defect rate across all audits, and one firm in one cycle is a single observation. What survives the caveats is the character of the failure: a gap where the evidence the whole exercise exists to produce should have been.
Tenure makes the same point without any statistics. Deloitte and its predecessor firms audited BCE Inc. from 1880, and the firm announced it would resign after the 2024 audit specifically because of the length of the relationship. A hundred and forty-four years. No scandal forced the exit; the relationship had simply become impossible to defend on its face. The binding constraint was optics, not a rival bid.
Why the advisory arm was always the point
Audit is the smaller business. Aggregating the four networks' published FY2023 figures gives roughly US$95bn of consulting and advisory revenue against about US$66bn for audit and assurance. Treat the number as indicative: it stitches together different fiscal years and different service-line labels, and no regulator publishes it. The ratio still describes the economics honestly. Audit buys the relationship and the boardroom access; advisory earns the margin.
None of this is new arithmetic. Enron's own proxy statement disclosed US$25m in principal-auditor fees and US$27m in all other fees paid to Arthur Andersen for 2000, though that second bucket covered tax, due diligence and other work rather than consulting alone. The split matters less than the standing incentive it creates: the organisation certifying the system also sells the design of it. Read as a governance lapse, that looks like an aberration. Read as a business model, it looks like the point.
The same structure explains why confidential client information has internal value. Australia's parliamentary joint committee found that former PwC partner Peter-John Collins intentionally disclosed confidential Treasury material to PwC personnel in Australia and overseas, with parliamentary material recording three confidentiality agreements and circulation reaching at least 53 people inside the firm. PwC subsequently sold its Australian government consulting business for A$1. Fifty-three recipients is a distribution list, and a distribution list is what confidential information turns into inside an organisation that monetises insight.
The moat was labour, and labour is repricing
Strip away the brand and the scale advantage was people: large cohorts of very capable graduates doing document review, data extraction and reconciliation at volumes a twelve-person firm could never staff. The talent funnel was real enough. The Harvard Crimson's voluntary survey of the class of 2022 put 23% of respondents into consulting, 18% into finance and 17% into technology, though that is respondents rather than the full cohort. The direction of the pipeline is not in doubt.
Document-heavy work is the first thing automation commoditises. A boutique with six former partners and decent tooling can now produce output that used to need forty juniors and a floor of a building. My estimate is that the pricing effect lands well before the quality effect, because clients will test a cheap bid on scoped, low-stakes work long before they move a statutory audit. Whether any of it holds depends on human accountability sitting on top of the automation, the same problem as every other deployment where a machine drafts and a named person is answerable.
Get that wrong and the assurance layer stops assuring anything. Deloitte was paid A$440,000 by Australia's Department of Employment and Workplace Relations for a welfare-compliance systems review that contained references to work that did not exist and a fabricated quotation attributed to a Federal Court judgment; the firm agreed to refund the contract's final instalment, later identified in parliamentary evidence as A$98,000. Ignore the refund, which is rounding. The department bought verification, received unverified output, and remains the party answerable for having relied on it.
The thing nobody wants to say about a clean opinion
Here I part company with the popular version of the argument. The critique usually runs that auditors are failing to catch what they are paid to catch, and that overstates what an audit has ever been. When Tesco announced an overstatement of expected profit of about £250m in September 2014, the FRC's investigation record treats it as the company's reporting failure, arising principally from accelerated recognition of commercial income and delayed accrual of costs. The auditor was in the frame. The overstatement belonged to the client. Boards have spent years reading a warranty into a document that never contained one, and that misreading is worth more to the incumbents than any technical advantage they hold, because it lets a signature carry a weight of comfort the underlying engagement cannot support.
What would change my mind? The acceptance test. A boutique opinion is worthless if the lender's credit committee will not take it, and that call sits with people paid to be conservative. If, three years from now, syndicated lending covenants still name the four firms by implication and insurers still price cover off the auditor's identity, then the collapse in labour cost will not have reached buyers at all, and concentration survives the technology intact. Watch the covenant language rather than the fee quotes.
Regulatory pressure is also softer than the headlines imply. The FRC confirmed that the Big Four completed the transition to operational separation of their audit practices by the 2024 deadline, under a voluntary principles regime introduced in 2020 and supervised by the regulator. Ring-fencing, then. Anyone briefing a board that the firms have been broken up is wrong in an expensive direction.
Turning a renewal into a tender
The practical move is dull procurement discipline. Write down how many years the incumbent has held the engagement, and what proportion of your non-audit professional spend goes to the same network or its close peers. Work out which deliverables you accept without independent challenge, and who inside the business could actually falsify them. Then ask a boutique or an independent former partner to bid on one scoped, non-statutory piece and compare the output line by line, because an alternative you have never tested is not an alternative. This is the concentration analysis you would apply to any single-supplier dependency; the fact that nobody has run it here is itself the finding.
The asymmetry is what makes it worth an afternoon. Run a genuine tender, stay with the incumbent, and you have spent some management time and had one awkward conversation. Skip it, then discover that a document you certified to your regulator rested on work nobody checked, and you are looking at a restatement and a repriced credit line. Those outcomes are not the same size, and only one of them is on anybody's risk register.
Questions people ask
Does operational separation mean the Big Four have been broken up in the UK?
No. The FRC confirmed the four firms completed a three-year transition to operational separation of their audit practices by the 2024 deadline, but this was a voluntary, regulator-supervised principles regime introduced in 2020. It ring-fences audit governance and remuneration inside the same network. It is not a statutory corporate breakup, and the two halves remain part of one organisation.
Does a clean audit opinion mean a company's accounts are correct?
It means the auditor obtained what it judged to be sufficient appropriate evidence to support an opinion on the financial statements. Primary responsibility for the accounts sits with the company. In the Tesco matter, the roughly £250m overstatement announced in 2014 is recorded by the FRC as the company's reporting failure, arising from how commercial income and costs were recognised. Treating a signature as a guarantee of accuracy is the most common misreading of what an audit buys.
How do you start assessing auditor concentration risk without launching a full tender?
Three numbers get you most of the way: the incumbent's tenure in years, the share of your total professional services spend going to that network, and the proportion of assurance deliverables your own team could independently falsify if asked. Then commission one small, scoped piece of non-statutory work from a challenger firm and compare it directly. That gives you a price benchmark and a quality reference point without disturbing the statutory engagement.
Related
- How AI Makes Bad Bosses Worse: The Agreeability Machine in the Corner Office
- IPO Lock-Up Expiry Hits Employee Shares Before It Hits the Share Price
- Is Stock-Based Compensation a Real Expense? How to Read an AI Lab's Losses
- Digital Business
Written by an AI editorial persona of Abyshire's proprietary editorial system and reviewed by our team.