Nearly every developed economy's law rests on one simple safeguard: a large public company must hire an independent outside auditor once a year, and that auditor must publicly sign off that the numbers are honest. It's the single line of defense between you — a shareholder, a bondholder, a pension-fund saver — and whatever the company says about itself. That sounds like solid insurance. Until you look at how many firms are actually available to provide that signature.
There are four: Deloitte, PwC, EY, KPMG. Between them, they audit the overwhelming majority of the world's largest public companies — by various estimates, something like 80–90% of S&P 500 revenue in the US, and a comparable share of the UK's largest listed firms, carries the signature of one of these four names. Not ten competitors, not twenty — four. And this isn't a minor bureaucratic formality. It's the one profession whose entire job is legally defined as "independent verification," and it has been reduced to a four-name oligopoly.
Eight, then six, then four
It wasn't always this narrow. As recently as the 1980s the market ran on a "Big Eight" of accounting networks. A wave of mergers through the late '80s and '90s pared that down to a "Big Six," then a "Big Five." The final blow came not from the market but from a single scandal: when the energy giant Enron collapsed in 2001–2002, its auditor, Arthur Andersen, went down with it. The firm was charged with destroying documents related to the Enron engagement and convicted of obstruction of justice — a conviction the US Supreme Court later overturned, but by then the reputational damage had already killed the firm's public-company audit practice faster than any appeal could move. That's how "five" became "four" — and four is where it has stayed ever since.
Notice what that means structurally. The market is concentrated enough that the failure of any one of the four isn't one competitor's bankruptcy among many — it's a systemic shock to global corporate reporting itself. Regulators know this: the UK's Competition and Markets Authority has spent years publicly discussing the risks of the oligopoly and has floated reforms like mandatory joint audits splitting large engagements between a Big Four firm and a smaller challenger. The market, meanwhile, remains what it became in 2002: four items on a menu that used to have eight.
Two hats, one head
Here is where the real conflict of interest starts — not just a question of scale. The same firms that sign the audit opinion have, for years, simultaneously sold consulting services to the same clients: systems implementation, tax structuring, strategy work, internal-audit outsourcing. Often the consulting contract dwarfed the audit fee. That was exactly the shape of Arthur Andersen's relationship with Enron — consulting revenue reportedly exceeded what the firm earned from the audit itself, handing the auditor a direct financial incentive not to upset a client that valuable by pushing back on the numbers.
After Enron, the Sarbanes-Oxley Act (2002) banned auditors in the US from providing certain services to their own audit clients — bookkeeping, designing a client's financial systems, and similar categories. But the ban wasn't exhaustive: tax advisory and a wide range of other consulting work remained legal even for a firm's own audit clients. In the UK, after the 2018 collapse of the construction and outsourcing giant Carillion — a company that had received a clean audit opinion from KPMG mere months before it went under — the regulator went further, ordering the Big Four to operationally separate their audit and consulting practices within the country. That reform has moved slowly and remains contested. Nowhere has the two-hats-one-head arrangement been fully undone.
When the seal failed
The conflict-of-interest theory is one thing. The record is another, and it's recent. In 2020, the German fintech Wirecard collapsed after it emerged that roughly €1.9 billion the company had reported for years as cash held in trustee accounts in the Philippines simply didn't exist. EY had audited Wirecard for years and kept issuing clean opinions right up to the collapse; subsequent investigations suggested basic account-confirmation procedures apparently weren't carried out with adequate rigor. EY faced lawsuits and regulatory proceedings in Germany over the failure.
Carillion in the UK followed a similar arc — nineteen years of KPMG audits, clean opinions almost until the end, and a massive pension shortfall that only came to light after the company folded. The UK regulator later fined KPMG and banned several partners from practice. Neither case is an outlier. The US regulator built specifically to inspect audit quality — the PCAOB, created by the same Sarbanes-Oxley Act — publishes annual inspection reports in which a meaningful share of the Big Four audits reviewed draw substantive findings. For a profession whose entire product is assurance, that's an uncomfortable statistic to keep producing year after year.
A watchman with no lock on his own door
So who actually watches the Big Four? In the US, the PCAOB. In the UK, a regulator that's been slated for replacement by a stronger body since the Carillion fallout — a reform that has been announced for years and has yet to fully land. Before the PCAOB existed, the profession largely policed itself in America, and that self-policing is precisely what failed to catch Enron coming. Today's oversight bodies are formally independent, but their budgets and staff are a fraction of the size of the networks they're supposed to inspect, and there's a steady flow of people moving between regulators and the Big Four in both directions — partners leaving for regulatory posts, regulatory inspectors later hired by the firms they used to examine. The fines that do get issued tend to run into the millions, against networks whose combined annual revenue runs into the tens of billions.
Our record: in Maat's vocabulary, writing and the exact tally belong to Thoth — the god whose pen records the weight of the heart at judgment, whose word has to be flawlessly accurate precisely because a verdict hangs on it. An audit opinion is that same function transplanted into money: the official record the whole system agrees to trust without re-checking it, because re-checking every company independently isn't possible at scale. Shadow Thoth is the pen that keeps writing in a perfect hand — but writes what pays the bill, not what it actually sees. Wirecard and Carillion aren't isolated technical failures. They're Shadow Thoth in plain view: a record that looks like truth right up until the day the truth can no longer save anyone.
There's no mustache-twirling villain in this story — there's a structure where honesty costs more than the contract, and the system quietly rewards whoever stays quiet about it. Four firms have been handed the job of being the world's memory and its conscience at the same time, and they operate inside incentives that steadily wear down both — not because the people inside are bad, but because that's how the arrangement is built. You don't have to trust every signature blindly, and you don't have to wait for the next Wirecard to ask the question out loud: whose signature is this, who's paying for it, and who, exactly, checks the check. Asking is no longer passive.