Clients of Goldman Sachs’ wealth management division, hedge fund manager Man Group and global property developer Tishman Speyer have been identified among those affected by a significant data breach at EY.

The incident involved unauthorised access to a third-party software platform used by the Big Four audit firm, exposing personal and financial information held in connection with its tax services.

According to reporting by the Financial Times, individuals associated with the three companies received notifications after their information was compromised in the incident, which occurred between 28 March and 12 April 2026.

The disclosures expand the publicly identified group of affected clients several months after EY first notified US regulators of the breach.

Personal and Financial Information Exposed

The attack exploited a vulnerability in software supplied by Checkmarx, a cybersecurity technology provider whose platform was used by EY.

According to breach notifications sent to affected individuals, an unauthorised third party accessed the platform and downloaded documents relating to EY clients.

The exposed information included names, addresses, email addresses, tax identification numbers and financial information.

EY reported the incident to the California Attorney General on 15 July 2026. Notifications were also made to authorities in Texas, Massachusetts and Vermont.

The firm subsequently notified additional affected individuals, including clients of organisations that used EY’s tax services.

Goldman Sachs and Man Group Respond

Goldman Sachs told its wealth management clients that EY had engaged an independent cybersecurity firm to verify that the affected systems were secure.

The bank said its own technology risk team was independently assessing EY’s remediation efforts and seeking evidence that the measures were effective.

Goldman Sachs emphasised that its internal systems had not been compromised and that client assets held by the bank remained safe.

Man Group similarly confirmed that the incident involved third-party software used by EY rather than its own systems.

Tishman Speyer had previously disclosed that information relating to its investors might have been affected. Its internal systems were also not compromised.

EY Faces US Class-Action Litigation

The data breach has also prompted proposed class-action litigation in the United States.

As Big4News reported in July, Illinois resident Markishi Wyatt filed a lawsuit against EY in the US District Court for the Southern District of New York, seeking to represent individuals whose information was compromised.

The complaint alleges that EY failed to implement adequate cybersecurity safeguards to protect sensitive tax, financial and personal information, leaving affected individuals exposed to increased risks of identity theft and financial fraud.

The allegations have not been established in court, and EY has not admitted liability.

Investigation and Remediation

Cybercriminal group ShinyHunters claimed responsibility for the breach in July. The claim has been reported publicly but does not, by itself, establish responsibility for the attack.

EY said it had conducted a comprehensive review of the affected information and was communicating the results directly to clients as its investigation approached completion.

The firm also offered affected individuals credit monitoring and identity protection services.

An EY spokesperson said the incident had not affected the firm’s broader enterprise systems and did not threaten its continuing operations.

The breach highlights the risks associated with sensitive client information processed through third-party technology platforms, particularly for professional services firms handling financial and tax records across multiple organisations.

Trying to keep up with technology at Deloitte, PwC, EY and KPMG? Start here →

https://www.big4news.com/t/technology-and-ai

About the author: Claudine Cassar is the founder and editor of Big4News, covering audit, consulting, regulation and governance across Deloitte, PwC, EY and KPMG.

The total value of Australian Commonwealth government contracts awarded to KPMG nearly doubled to A$58.7 million in the 2025–26 financial year, up from approximately A$32 million the previous year, according to newly released figures compiled by the Parliamentary Library from government procurement records.

The increase comes despite a scandal involving the misuse of confidential client information, which prompted leadership departures, regulatory scrutiny and restrictions on KPMG’s ability to bid for new government work.

According to figures published on 6 October, more than 30 contracts worth over A$20 million were executed with KPMG after the scandal became public on 24 March 2026.

The figures are based on AusTender contract and amendment values as recorded on 23 July 2026. They represent the value of contracts awarded, rather than necessarily the amounts paid to KPMG during the financial year.

KPMG Accounts for More Than Half of Big Four Contract Awards

The data show that the four largest audit firms received approximately A$109.5 million in Commonwealth contract awards during 2025–26, across 250 contracts.

KPMG accounted for approximately 54% of that value, significantly exceeding the amounts awarded to its competitors.

KPMG’s major government clients include the Department of Industry, Science and Resources, Services Australia, the Department of Defence, the Australian Securities and Investments Commission and the Bureau of Meteorology.

The findings emerge as the Australian government faces wider scrutiny over its reliance on external consultants. Commonwealth consulting contract awards exceeded A$860 million in 2025–26, compared with A$788 million in 2021–22.

Procurement Restrictions Remain in Place

On 16 June 2026, the Australian Department of Finance announced that KPMG had agreed to stop bidding for new Commonwealth work while an independent review examined the firm’s governance, culture, ethics and integrity arrangements.

The restrictions were initially scheduled to expire on 30 September but were subsequently extended to 31 October 2026.

However, the Department of Finance’s procurement guidance provides several exceptions.

Existing contracts can continue, including extensions permitted under their original terms. The restrictions also exclude proposals submitted before 16 June and certain ongoing software licensing arrangements.

Consequently, contracts awarded after the scandal became public in March do not necessarily represent breaches of the restrictions, which only took effect in June.

The procurement figures do not establish how much of the A$58.7 million relates to contracts permitted under these exceptions.

Independent Review

The Department of Finance commissioned an independent review led by former senior public servant Dr Ian Watt to examine KPMG’s governance and ethical frameworks.

The review deadline was extended to 9 October to accommodate findings from other investigations into the firm.

KPMG has separately announced significant governance reforms, including plans for a new Integrity Office and additional whistleblower protections.

This is part of Big4News’ continuing coverage of the KPMG Australia Audit Leak Scandal.

About Claudine Cassar

I’m a corporate anthropologist and former Deloitte equity partner. I sold my technology business to Deloitte in 2016 and led the Malta Consulting team for five years. I am the founder and editor of Big4News, which provides independent, clear analysis of PwC, Deloitte, EY, and KPMG — free from corporate spin.

More about Claudine Cassar.

Find me on LinkedIn, X, Instagram, or my author website.

Feel free to reply to this newsletter — I read every reply.

The UK’s Financial Reporting Council (FRC) has fined Deloitte £6.05 million over failures in its audits of transport operator Go-Ahead Group, including its failure to challenge the wrongful retention of more than £30 million in public funds.

The sanctions, announced on 8 October, relate to Deloitte’s audits of Go-Ahead’s consolidated financial statements for five consecutive financial years, from 2016 to 2020.

The original £11 million penalty was reduced by 45%: 10% for exceptional cooperation and 35% for admissions and early resolution. Deloitte also received a severe reprimand, while the FRC declared that its audit reports for all five years failed to meet the relevant requirements.

Public money retained and profits overstated

The most significant findings concern two Go-Ahead rail subsidiaries, London & South Eastern Railway (LSER) and London & Birmingham Railway (LM).

LSER had received erroneous overpayments from the Department for Transport before Deloitte became Go-Ahead’s auditor. Although contractually obliged to repay the money, the subsidiary retained it without informing the department.

The practice continued during Deloitte’s appointment. LSER released £2.4 million of the overpayments into profit in 2016 and recorded a further £27 million in accruals between 2016 and 2020 under a subsequent franchise agreement.

According to the FRC, evidence obtained from management during later audit years suggested an intention to release these additional amounts into profit if the overpayments were not discovered by the department.

In 2019 and 2020, LSER also classified the accruals in its financial statements in a way that concealed their true nature.

At LM, a separate rail subsidiary, £5.6 million in accruals relating to money owed to the government was released into profit in 2020. The FRC found that LM attempted to conceal the release through the wording of its financial statement disclosures.

The regulator concluded that Deloitte failed to investigate sufficiently, exercise appropriate professional scepticism or adequately evaluate evidence of fraud risk factors.

German rail subsidiary required €40m-plus restatement

The failures extended to Go-Ahead Bayern, a German rail subsidiary.

During the 2020 audit, information initially provided to the auditors indicated that its franchise contracts would generate losses. The German component audit team concluded that a provision for those expected losses was required.

Go-Ahead subsequently provided revised information that changed the projected value of future cash flows from a loss of €8 million to a positive €3 million.

The FRC found that Deloitte did not adequately scrutinise the revised evidence or sufficiently oversee the German audit team.

Although an €8.1 million provision was eventually recognised, it was restated to €49.5 million in the following year’s financial statements — an increase of €41.4 million.

Regulator identifies repeated failures

The FRC said that some of Deloitte’s breaches persisted across all five audit years, despite the relevant matters having been identified as significant audit risks.

Penrose Foss, the FRC’s Executive Counsel and Executive Director of Investigations and Enforcement, described the findings as a “highly concerning pattern of failure” by Deloitte to scrutinise questionable decisions and actions.

The regulator said the failures were particularly troubling because substantial amounts of taxpayers’ money had been placed at risk.

When the Department for Transport discovered LSER’s conduct in 2021, it took action to recover the overpayments, imposed a £23.5 million financial penalty and decided not to renew the subsidiary’s rail franchise.

Deloitte’s response

Deloitte acknowledged shortcomings in its audit work.

A Deloitte UK spokesperson said the firm regretted that aspects of its work had failed to meet expected standards, adding that it had learned from the matter and remained committed to improving audit quality.

In addition to the fine and reprimand, Deloitte must submit a report to its FRC supervisor detailing its root-cause analysis, remedial measures and evidence assessing whether those measures will prevent similar failures.

Deloitte has also paid the regulator’s investigation costs.

The FRC opened its investigation in April 2022. Its original scope included Go-Ahead’s 2021 audit, but that part of the investigation was closed in December 2024 without enforcement action.

Want to stay up to date on all things Big Four around the world?

Check out the News section and subscribe to Big4News for weekly deep dives and briefings.

About the author: Claudine Cassar is the founder and editor of Big4News, covering audit, consulting, regulation and governance across Deloitte, PwC, EY and KPMG.

KPMG Australia has announced plans to establish a new Integrity Office and appoint a whistleblower protection officer as part of an expanded programme of governance and cultural reforms following its confidential-information scandal.

The measures form part of an updated Action Plan, published on 9 October 2026, which incorporates recommendations from independent reviews commissioned after allegations emerged that KPMG personnel had misused confidential client information and mishandled whistleblower disclosures.

The revised plan builds on reforms announced in June, when KPMG committed to strengthening independent oversight, changing senior leadership and reviewing its whistleblowing arrangements.

New Measures and Independent Oversight

The latest changes include plans for an Integrity Office and a designated whistleblower protection officer, alongside further measures to strengthen accountability and external scrutiny.

KPMG says its updated programme addresses three areas: governance and leadership, culture and conduct, and controls and assurance.

The firm has already implemented several significant governance changes. Michael Ebeid became its first independent chairman in August, following amendments to the partnership agreement approved by partners.

The reforms also envisage greater independent representation on KPMG Australia’s National Governance Board and increased independent involvement in oversight and executive appointments.

Dr Kerry Schott, a former senior Australian public servant, continues to provide independent advice and challenge to the board as it oversees implementation of the Action Plan.

External Reviews Identify Further Improvements

The revised plan incorporates findings from several external assessments.

Principia Advisory’s review of KPMG’s ethical culture and whistleblowing arrangements produced 26 findings and 14 recommendations, all of which the firm says it has accepted.

Separately, the Andrews Group completed a review of KPMG’s handling of a whistleblower disclosure. KPMG says its board accepted all six recommendations.

Chartered Accountants Australia and New Zealand has also completed a quality review examining the firm’s systems for handling confidential client information and promoting ethical conduct. KPMG says it has accepted the review’s suggestions for further improvement.

The firm has committed to publishing regular progress reports and sharing them with regulators and other relevant stakeholders.

Fallout From the Confidentiality Scandal

The reforms follow months of scrutiny over KPMG Australia’s handling of confidential information and its response to allegations raised by a whistleblower.

The controversy prompted leadership departures, parliamentary scrutiny and restrictions on the firm’s ability to secure new Australian Commonwealth government work.

KPMG’s response has included changes to its senior management, revised confidentiality policies and the introduction of additional independent oversight.

The Australian Department of Finance separately commissioned an independent review led by former senior public servant Dr Ian Watt to assess aspects of KPMG’s culture, ethics, integrity and governance.

The October Action Plan sets out further commitments by the firm, but the effectiveness of the reforms will depend on their implementation and the findings of continuing independent scrutiny.

This is part of Big4News’ continuing coverage of the KPMG Australia Audit Leak Scandal.

About Claudine Cassar

I’m a corporate anthropologist and former Deloitte equity partner. I sold my technology business to Deloitte in 2016 and led the Malta Consulting team for five years. I am the founder and editor of Big4News, which provides independent, clear analysis of PwC, Deloitte, EY, and KPMG — free from corporate spin.

More about Claudine Cassar.

Find me on LinkedIn, X, Instagram, or my author website.

Feel free to reply to this newsletter — I read every reply.

The FTSE Bursa Malaysia KLCI brings together 30 of the largest and most prominent companies listed on Bursa Malaysia, spanning banking, telecommunications, utilities, plantations, consumer businesses and industrial groups.

But who audits them?

Big4News examined the latest available annual reports and corporate disclosures for every company in the index to identify its external auditor, how long the current audit firm has held the mandate, and the latest disclosed audit fee.

The results show how Malaysia’s largest listed companies divide their audit work among the major accounting firms — and reveal a notably concentrated market in which Deloitte currently holds no KLCI audit mandates.

The table below can be sorted by company, sector, auditor, appointment year and audit fee.

Audit market share

The Big Four audit 24 of the 30 companies in the FTSE Bursa Malaysia KLCI, giving them a combined market share of 80% by number of audit mandates.

PwC leads the market with 10 clients, or 33.3% of the index. EY follows with eight mandates, representing 26.7%, while KPMG audits six companies, or 20.0%.

The remaining six mandates are divided between BDO, with four clients, Crowe with one, and HLB Ler Lum Chew PLT with one.

The most striking feature is the absence of Deloitte. Despite being one of the major international accounting networks operating in Malaysia, Deloitte does not audit any of the 30 KLCI companies in this analysis.

Challenger firms have an unusually large foothold

The KLCI stands out from many of the major indices tracked by Big4News because one in five companies is audited outside the Big Four.

BDO alone audits four of the 30 constituents, giving it a 13.3% market share. Crowe and HLB Ler Lum Chew each hold one further mandate.

That leaves the Big Four with a combined 80% share — still dominant, but materially lower than in markets where they audit virtually every leading listed company.

PwC and EY dominate the audit-fee pool

Audit fees produce an even more concentrated picture than mandate counts.

Big4News identified a statutory audit fee for 29 of the 30 KLCI companies. Across those companies, the disclosed fees total approximately RM167.8 million.

PwC-audited companies account for about RM70.9 million, or 42.3% of the identified fee pool.

EY follows closely with approximately RM61.5 million, or 36.7%.

Together, the two firms account for almost four-fifths of identified audit fees.

KPMG accounts for around RM22.9 million, or 13.6%, while BDO’s identified fees total approximately RM8.5 million, or 5.1%. Crowe and HLB Ler Lum Chew together account for the remaining 2.4%.

Challenger firms are in a weaker position when it comes to fees. BDO, Crowe and HLB Ler Lum Chew collectively audit six KLCI companies, but account for only around 7.4% of the identified audit-fee pool.

Auditor tenure

Malaysian independence rules applying to public-interest entities require key audit partners to rotate after prescribed periods. The “Since” figures used by Big4News measure the tenure of the audit firm itself, rather than the engagement partner signing the audit.

The longest identified relationship in the dataset is QL Resources and KPMG, dating to 1998.

EY has audited both Gamuda and Maybank since 2002, while its relationship with MISC dates to 2003 and with AMMB Holdings to 2005. PwC has audited Axiata Group since 2008 and Maxis since 2009.

At the other end of the spectrum, there have also been recent changes. PwC became CelcomDigi’s auditor for the 2024 financial year, while SD Guthrie’s PwC relationship dates from 2025.

Notes on the Malaysian data

Audit fees are presented in Malaysian ringgit (MYR). Where companies disclose audit and non-audit remuneration separately, only the relevant audit amount is included. Reporting terminology and fee scope are not completely uniform across Malaysian issuers, so the figures should be read as the latest reliably identifiable audit fees rather than as a perfectly standardised pricing comparison.

This approach is consistent with the wider methodology used throughout the Who Audits? project. For details on source hierarchy, auditor-tenure calculations, treatment of fees and our policy on missing data, see Who Audits? Sources & Methodology.

Who audits the world’s largest companies?

Explore the Big4News Who Audits? hub, which maps the audit firms behind the world’s leading stock-market indices — including auditor tenure, audit fees and Big Four audit market share.

Explore the global Who Audits? series →

The Ibovespa is Brazil’s benchmark equity index, tracking the most actively traded stocks on B3.

The portfolio effective from 8 September 2026 contains 76 securities representing 74 companies. Bradesco and Petrobras each have two share classes in the index, so Big4News consolidates those into a single issuer for audit-market analysis. B3 confirms that the September–December 2026 portfolio comprises 76 securities from 74 companies.

Big4News identified the current external auditor of all 74 companies, together with the first year of the current engagement and the latest audit-fee information that could be established to publication standard.

Audit fees are shown in Brazilian reais.

The table is sortable. Click any column heading to reorder the data by company, sector, auditor, tenure or audit fee.

For details on how Big4News verifies auditors, tenure and fees across the series, see Who Audits? Sources & Methodology.

Ibovespa audit market share

PwC is the largest auditor in the Ibovespa, with 25 of the 74 company mandates, giving it a 33.8% market share.

KPMG follows with 17 companies, or 23.0%. EY audits 13 companies, equivalent to 17.6%, while Deloitte audits 12, or 16.2%.

Together, the Big Four audit 67 of the 74 companies — 90.5% of the index.

That leaves seven companies, or 9.5%, audited by firms outside the Big Four.

Grant Thornton, BDO and Forvis Mazars each hold two Ibovespa mandates, while Baker Tilly audits one company.

This gives Brazil a more visible challenger presence than many of the other large-company audit markets tracked by Big4News.

PwC’s lead is broad rather than sector-specific

PwC’s overall lead is reinforced by its presence across several of the index’s largest sectors.

Among the 13 utilities, PwC audits five companies, compared with three for EY, two each for KPMG and Deloitte, and one for Grant Thornton.

Financial services are more dispersed. Of the 11 financial companies, PwC audits four and KPMG three, while Deloitte and EY each hold one mandate. BDO and Baker Tilly account for the remaining two.

Consumer discretionary is led by EY, which audits five of the 13 companies in the sector. KPMG and PwC each audit three, while Deloitte audits two.

Materials are much more concentrated: PwC audits five of the eight companies, EY one, and Forvis Mazars two.

Among industrial companies, the market is split entirely between PwC and KPMG, with four and three mandates respectively.

The pattern helps explain PwC’s overall lead. Rather than depending on a single dominant sector, the firm holds substantial positions across financials, utilities, materials and industrials.

Auditor relationships are relatively young

The tenure data also sets Brazil apart.

Twenty-nine of the 74 current engagements began in 2024 or later, including 12 in 2025 and eight in 2026.

Thirty-four — almost half the index — began in 2023 or later.

Recent changes include companies such as:

• Azzas 2154 — Deloitte from 2026

• C&A Modas — KPMG from 2026

• Cogna — PwC from 2026

• ENGIE Brasil Energia — KPMG from 2026

• Fleury — KPMG from 2026

• ISA Energia Brasil — EY from 2026

• Itaúsa — PwC from 2026

• WEG — PwC from 2026

There are, however, a handful of much longer relationships.

PwC has audited Itaú Unibanco since 2001, while KPMG’s relationship with Bradesco dates to 2011. Santander Brasil has been audited by PwC since 2016, and Rede D’Or by EY since the same year.

Brazilian regulation helps explain the overall turnover. CVM rules generally limit an independent audit firm to five consecutive years with the same client, followed by a minimum three-year interval before reappointment. Companies with a qualifying statutory audit committee can extend the audit-firm relationship to ten consecutive years.

Audit fees vary enormously across the index

Big4News has identified an audit-fee figure for 71 of the 74 companies, although the quality and recency of those disclosures vary.

Among the largest current or recent disclosed figures are:

• Itaú Unibanco — approximately R$87.7 million

• Bradesco — approximately R$73.7 million

• Petrobras — approximately R$37.4 million

• Vale — approximately R$32.3 million

• Santander Brasil — R$31.5 million

• Axia Energia — approximately R$26.5 million

• Embraer — approximately R$25.9 million

• BTG Pactual — approximately R$25.4 million

• Ambev — approximately R$20.5 million

• Suzano — approximately R$19.2 million

The spread is substantial. Brazil’s largest banks, energy companies and globally active industrial groups generate audit engagements many times larger than those of smaller domestic issuers.

That is why simple mandate counts and fee scale can tell very different stories about the competitive position of audit firms.

About the data

The dataset reflects the Ibovespa portfolio effective from 8 September to 31 December 2026.

B3’s official portfolio contains 76 securities representing 74 companies. Bradesco and Petrobras each have two share classes in the index; Big4News treats each issuer as a single audit client for market-share analysis.

For the full methodology, see Who Audits? Sources & Methodology.

Who audits the world’s largest companies?

Explore the Big4News Who Audits? hub, which maps the audit firms behind the world’s leading stock-market indices — including auditor tenure, audit fees and Big Four audit market share.

Explore the global Who Audits? series →

When the Financial Reporting Council issued a £3.2 million fine against PwC over the audit of Babcock International, the commentary followed a familiar script. Missed red flags. Inadequate testing on long-term contracts. Failure to properly interrogate cash pooling arrangements. The story was framed simply: a bad audit performed by auditors who dropped the ball.

That framing is both incomplete and unhelpful.

Treating enforcement actions like Babcock as isolated technical failures misunderstands how institutional audit actually operates. The teams assigned to high-profile engagements are not incompetent. They are composed of highly educated, technical, and hard-working professionals. Yet regulatory findings year after year carry the same short diagnosis: a lack of professional scepticism.

Professional scepticism is defined as an attitude that includes a questioning mind, being alert to conditions that may indicate possible misstatement due to error or fraud, and a critical assessment of audit evidence. But in practice, scepticism is not merely a psychological state. It is an operational process. And like any operational process, it breaks down under structural, commercial, and behavioural pressures long before an audit partner signs off on an opinion.

To understand why scepticism fails, we have to look past individual accountability and examine the four structural forces that erode it from within.

Structural forces that erode professional scepticism

1. The familiarity threat and the design constraint

The audit profession has long recognised the familiarity threat. It is the core reason mandatory partner rotation rules exist, why firm rotation requirements were introduced for certain public-interest audits, and why ethical standards contain detailed safeguards against familiarity threats.

Yet familiarity continues to quietly compromise independence. The fundamental issue is a structural design constraint: an audit firm is paid by the client it is tasked with scrutinising. Over multi-year engagements, audit teams and client management inevitably build working relationships. Distance is gradually replaced by rapport, and rapport eventually turns into baseline trust.

When an auditor trusts a management team, their baseline assumption shifts. Anyone who has sat in audit rooms during fieldwork knows how this looks in practice. Instead of requiring management to prove their position from scratch, the auditor begins looking for evidence to confirm that management’s explanation is reasonable.

This shift is subtle. It does not look like misconduct. It looks like efficiency. The auditor reviews provided documents rather than interrogating underlying assumptions. They may place too much weight on written representations rather than testing them against other audit evidence. The requirement to maintain professional distance is systematically undermined by the commercial reality of a long-standing client relationship.

2. The internal hierarchy: where junior scepticism goes to die

In any audit engagement, the professionals closest to the detailed evidence are the most junior members of the team. Associates and Senior Associates review the individual contracts, perform the balance sheet reconciliations, and ask the initial questions.

In theory, if a junior auditor uncovers an anomaly, it is escalated to the Audit Manager and Engagement Partner. In practice, the escalation dynamic is fraught with behavioural friction.

When a second-year senior uncovers a complex accounting choice that feels wrong, escalating that concern requires pushing back against two powerful forces simultaneously. The first is client authority: senior finance directors with twenty years of experience can dismiss a junior’s query with a confident explanation and a wave of the hand. The second is internal pressure: engagement managers work against tight fee budgets and delivery deadlines. Raising a fundamental question about an accounting treatment late in the engagement threatens to derail the schedule and overrun the budget.

When a junior auditor brings a concern to a senior team member, the response is too often framed around commercial pragmatism. We looked at this last year. Management knows their business. That is not material for our scope.

When junior concerns are repeatedly dismissed, the team learns an implicit lesson: asking awkward questions creates friction, whereas accepting plausible explanations keeps the engagement moving. Scepticism is filtered out at the bottom of the chain before it ever reaches the partner who has the authority to act on it.

3. Prior-year assumptions and the SALY trap

One of the most insidious drains on professional scepticism is the reliance on prior-year audit files, popularly known as Same As Last Year.

Auditing is an exercise in managing vast amounts of information within constrained timeframes. To maintain efficiency, audit teams naturally rely on the methodologies, risk assessments, and assumptions established in previous years. If a complex revenue recognition model was accepted in 2018, the threshold of proof required to accept it in 2019 is inherently lower.

This creates a compounding risk. Every experienced auditor has inherited a workpaper where a roll-forward calculation contains an old, unexplained manual adjustment that everyone carried over because the partner signed it off last year. If the original analysis contained a subtle flaw or accepted a marginal management assumption, that flaw becomes institutionalised. By year three or year four, the audit team is no longer evaluating the accounting treatment from first principles. They are auditing against their own prior acceptance.

Challenging a long-standing accounting method requires an auditor to implicitly admit that previous audits, which their own firm signed off on, may have missed something. The systemic pressure to maintain consistency can work against the impulse to re-examine established positions.

4. The unprepared client and the audit fog

While much of the debate centres on auditor behaviour, the operational state of the client being audited plays a massive and underreported role in the erosion of scepticism.

When a business approaches an audit without mature control frameworks, clean balance sheet substantiations, or structured evidence, it creates audit fog. Audit teams arrive to find open request trackers, half-reconciled ledgers, and missing supporting documents. Complex businesses can create exactly this type of high-friction environment, where technical clarity becomes obscured by sheer operational scale. In Babcock’s case, the FRC’s findings covered areas including cash pooling and two long-term contracts.

Faced with messy records and approaching filing deadlines, the auditor’s capacity for high-level technical challenge is overwhelmed by administrative firefighting. Scepticism requires cognitive bandwidth. When an audit team spends the majority of its time helping a client reconcile basic schedules or chasing missing documents, they have neither the time nor the energy left to rigorously interrogate management’s judgement-heavy estimates or goodwill impairments.

Ineffective client preparation directly degrades audit quality. It forces auditors into a defensive posture where getting the audit over the line becomes the primary objective, overriding the obligation to critically challenge management.

The regulatory mismatch

When these internal and external dynamics cause an audit to fail, the regulatory response arrives years later.

As the Babcock enforcement timeline showed, regulatory bodies can take years to reach a final determination and issue financial penalties. By the time a fine is announced, the engagement partners have shifted roles, the original staff have scattered, and the financial impact of the fine is absorbed as a cost of doing business.

A regulatory enforcement timeline that takes half a decade cannot act as a real-time deterrent. A penalty regime that hits the firm’s balance sheet without addressing the underlying commercial incentives does not change day-to-day behaviour on active field engagements.

Moving Beyond the Status Quo

If the industry is serious about strengthening professional scepticism, it must address the environment in which auditors work.

Audit firms need explicit mechanisms that reward junior staff for raising technical concerns, ensuring those objections are reviewed independently of the immediate engagement manager’s budget pressures. Rotation schedules must be treated as opportunities for genuine zero-based audits rather than continuations of prior-year work. And for finance leaders and PE sponsors, the conclusion is unambiguous: expecting an external audit to serve as your primary internal control check is a flawed strategy.

Real audit readiness is not about preparing for field week or managing an auditor’s request list. It is about maintaining the internal standards, evidence trails and technical rigour that allow the external audit to focus on assurance and challenge rather than becoming an unpredictable exercise in discovery.

Until the profession confronts these structural design constraints, insufficient professional scepticism will remain a recurring headline rather than a solved problem.

Who is Ephraim Unuigbe?

Ephraim Unuigbe, ACA, CISA, MIoL is the founder of Mou Consulting and an audit, controls and governance specialist with more than 14 years’ experience across Big Four and other major accounting firms, including EY, Grant Thornton and S&W.

He has held senior audit roles and now works with PE-backed and growth-stage businesses on audit readiness, financial controls, IT general controls, financial reporting and the remediation of audit findings. His work focuses particularly on helping businesses strengthen their control environments as they move towards institutional-grade reporting and audit requirements.

Ephraim also serves as an Independent Member of the Audit Committee at Southampton City Council and as a Governor and Audit Committee Member at Itchen Sixth Form College.

This article is part of the Big4News Investigations & Analysis series, which examines the structural forces shaping Deloitte, PwC, EY and KPMG, drawing on documented evidence, regulatory records and case studies to analyse audit quality, governance, incentives, culture and accountability.

The AEX brings together semiconductor manufacturers, banks, insurers, energy businesses and international consumer groups listed in Amsterdam. Its audit appointments span some of the Netherlands’ best-known companies alongside businesses incorporated in the UK, Belgium, Luxembourg, Switzerland and Jersey.

This snapshot uses Euronext’s constituent list dated 25 September 2026, which contains 29 companies. The table identifies each company’s current auditor, the first financial year under the engagement and its latest disclosed audit fee.

Companies are sorted alphabetically, with fees presented in euros. The table can be sorted by company, sector, auditor, since and audit fee.

The final column explains exceptions, including predecessor fees, currency conversions and disclosures that combine audit with other assurance work.

EY leads a market shared entirely by the Big Four

EY holds 11 appointments, representing 37.9% of the total. KPMG follows with seven appointments, or 24.1%. PwC holds six, or 20.7%, and Deloitte five, or 17.2%.

Every company in this snapshot appoints a Big Four firm. There are 29 companies and 29 audit appointments, with each company counted once.

EY’s portfolio includes Shell,ArcelorMittal, Aegon, NN Group and Universal Music Group. It also audits ASM International and BE Semiconductor Industries. PwC audits ASML, giving those two networks all three appointments among the index’s semiconductor equipment manufacturers.

KPMG’s seven engagements include Ahold Delhaize, Heineken, Unilever and Magnum Ice Cream Company. PwC’s portfolio includes ABN AMRO, Adyen, KPN and Philips, while Deloitte audits ING, Prosus, Exor, CVC Capital Partners and SBM Offshore.

The composition shows both the breadth of EY’s lead and the depth of the other firms’ portfolios. A smaller appointment count can still encompass large international groups and substantial financial institutions.

A period of extensive appointment changes

Sixteen companies have a recorded first financial year with their current auditor of 2025 or later.

The FY2025 changes brought Aalberts, ASM International and IMCD to EY. PwC began its engagements at Adyen, ASML, DSM-Firmenich, KPN and Philips. KPMG took over at Heineken, WDP and Wolters Kluwer.

Four further changes take effect for FY2026: PwC succeeds EY at ABN AMRO; EY succeeds PwC at Akzo Nobel and KPMG at NN Group; and Deloitte succeeds KPMG at ING.

Magnum’s KPMG engagement also begins in FY2025, ahead of its December listing as a separate company. Its start date reflects the establishment of that reporting company rather than a conventional change of audit firm.

These recent engagements sit alongside longer relationships. KPMG’s Unilever engagement dates from FY2014, and EY’s engagements at RELX and Shell from FY2016. EY has audited BE Semiconductor Industries since FY2018. Ahold Delhaize’s current KPMG engagement begins in FY2023, following the appointment approved in 2022.

The dates identify the first audited financial year. An appointment approved in advance, a later annual reappointment or a change in the audit firm’s legal entity does not establish a new start year.

Audit fees

The fees recorded in the table total approximately €353.8m, with a median of approximately €10m.

Shell has the largest recorded fee, at approximately €47.7m after converting its US$56m disclosure. Aegon follows at €34m. ING and Unilever each report €32m, while ArcelorMittal’s US$29.1m converts to approximately €24.8m. Together, these five companies account for 48.2% of the recorded total.

The range extends to WDP’s disclosed statutory auditor remuneration of €360,360 and Exor’s €383,000 for the holding company and its consolidated subsidiaries. Exor’s figure covers that reporting group; it does not add together the separate audit fees of its investee companies.

Four figures relate to outgoing auditors’ FY2025 work: EY at ABN AMRO, PwC at Akzo Nobel and KPMG at ING and NN Group. The table identifies the recipient and year alongside the current appointment.

Prosus reports for the year ended 31 March 2026. Its figure includes US$9m of financial-statement audit fees for Deloitte and its network, equivalent to approximately €7.8m. Other assurance services and fees paid to other audit firms are excluded.

The disclosures illustrate the different scales and scopes of the engagements. The notes identify combined categories at Aegon, ArcelorMittal and DSM-Firmenich, and the scope of WDP’s statutory auditor remuneration.

Sources and methodology

The table follows Euronext’s 25 September 2026 constituent list. Auditor appointments, engagement dates and fee disclosures were reviewed on 8 October 2026 using annual reports, signed audit reports and company appointment announcements.

Fees generally relate to FY2025, with Prosus reported for FY2026. Financial-statement audit fees for the principal auditor network are used where separately disclosed. The notes identify predecessor fees, inseparable review or assurance work and other scope exceptions.

US-dollar and sterling amounts are converted to euros using ECB reference rates at each company’s financial year-end: 31 December 2025, or 31 March 2026 for Prosus.

Read the full Sources and Methodology, or explore other indices in Who audits the world’s largest companies?.

Who audits the world’s largest companies?

Explore the Big4News Who Audits? hub, which maps the audit firms behind the world’s leading stock-market indices — including auditor tenure, audit fees and Big Four audit market share.

Explore the global Who Audits? series →

The Straits Times Index brings together 30 leading companies listed in Singapore. Every company in the index uses one of the Big Four, and two networks hold four-fifths of the mandates.

FTSE Russell’s September 2026 review made no changes to the STI’s constituents. This dataset retains that 30-company universe and identifies each company’s principal external auditor, the first audited financial year where precisely established, and its latest qualifying audit-fee disclosure. The table can be sorted by company, sector, auditor, since and audit fee.

Verification cutoff: 9 October 2026. Fees are shown in Singapore dollars; Notes identify financial periods and disclosure exceptions.

STI audit market share

KPMG leads with 13 appointments, or 43.3% of the index. PwC follows with 11, or 36.7%. Together, they audit 24 of the STI’s 30 companies.

Deloitte holds four mandates, or 13.3%, and EY two, or 6.7%. No company in this snapshot has a principal group auditor outside the Big Four.

These percentages count companies. A subsidiary auditor is not an additional STI appointment, and an auditor’s share of mandates should not be read as its share of fees.

Property groups give the market its distinctive shape

Real estate is the largest sector in the dataset, with 12 companies and trusts. KPMG audits six, Deloitte three and PwC three.

The recent changes are concentrated in this part of the index. Deloitte’s first audit year was FY2024 at CapitaLand Ascendas REIT, CapitaLand Integrated Commercial Trust and CapitaLand Investment. Ascendas REIT switched from EY; the other two switched from KPMG. The changes are documented in Ascendas REIT’s appointment announcement, CICT’s issuer disclosure and CapitaLand Investment’s announcement.

KPMG subsequently replaced PwC at Mapletree Industrial Trust, Mapletree Logistics Trust and Mapletree Pan Asia Commercial Trust. Their first KPMG-audited period was FY2025/26, ending 31 March 2026. The latest reports identify KPMG and its affiliated firms in the current-year disclosures and PwC firms in the prior-year comparisons: MIT, MLT and MPACT.

Six recent changes therefore account for one-fifth of today’s STI appointments. They show movement between the large networks, while leaving the Big Four’s combined share at 100%.

Banking is split between PwC and EY

PwC audits DBS and OCBC; EY audits UOB. KPMG’s financial-sector appointment is Singapore Exchange.

The banking disclosures also show why network coverage affects the fee figures. OCBC’s FY2025 report reports S$9m payable to its principal auditor and S$7m to associated firms, giving S$16m for the PwC network. UOB’s report gives S$5m to EY and S$3m to affiliates, totalling S$8m. Both disclosures are rounded to millions.

DBS discloses S$11.02m for PwC audit and audit-related services combined. That broader category is flagged in the table; it is not presented as a separately verified statutory-audit-only amount.

About the data

Auditors are standardised at network level. “Since” records the first audited financial year, using its end year consistently: FY2025/26 appears as 2026. It does not record the latest shareholder reappointment.

The table contains 27 fee figures. Financial-statement audit fees attributable to the principal network are preferred; separately disclosed audit-related, assurance, tax, other services and other-firm fees are excluded. Broader inseparable categories and narrower principal-auditor disclosures are identified in Notes.

DFI Retail, Hongkong Land and Jardine Matheson disclose group audit totals without isolating the principal network’s remuneration. Their numerical fee cells remain blank; Notes record the available totals. Other figures span FY2025 and FY2026, different currencies and different group boundaries. They should not be added together as a standardised measure of Singapore audit spending or used to calculate auditor fee market shares.

Who audits the world’s largest companies?

Explore the Big4News Who Audits? hub, which maps the audit firms behind the world’s leading stock-market indices — including auditor tenure, audit fees and Big Four audit market share.

Explore the global Who Audits? series →

The FTSE TWSE Taiwan 50 Index tracks 50 of the largest companies listed on the Taiwan Stock Exchange.

Who audits the world’s largest companies?

Explore the Big4News Who Audits? hub, which maps the audit firms behind the world’s leading stock-market indices — including auditor tenure, audit fees and Big Four audit market share.

Explore the global Who Audits? series →

The FTSE MIB comprises 40 of the largest and most liquid companies listed on Borsa Italiana and provides a snapshot of the leading end of Italy’s public-company audit market.

Big4News identified the current statutory auditor of every constituent, the first financial year of the present audit engagement, and the latest available audit fee where this could be established to publication standard.

The dataset reflects the FTSE MIB at 30 September 2026. Audit fees are shown in euros.

The table is sortable. Click any column heading to reorder the data by company, sector, auditor, tenure or audit fee.

For details on how Big4News verifies auditors, tenure and audit fees across the series, see Who Audits? Sources & Methodology.

FTSE MIB audit market share

KPMG and PwC lead, with Deloitte close behind.

The FTSE MIB audit market is overwhelmingly controlled by the Big Four, which audit 39 of the index’s 40 companies.

KPMG and PwC each audit 11 companies, giving both firms a 27.5% market share. Deloitte is close behind with 10 mandates, or 25%. EY audits seven companies, equivalent to 17.5%.

The only company not audited by the Big Four is Tenaris, whose auditor is Forvis Mazars.

Financial services are split across all four firms

Financials are the largest sector in the FTSE MIB dataset, with 11 companies, and the audit mandates are spread across all four Big Four firms.

KPMG audits BPER Banca, FinecoBank, Generali and UniCredit.

PwC audits Banca Mediolanum, Banca Monte dei Paschi di Siena and Mediobanca.

EY audits Azimut, Intesa Sanpaolo and Unipol.

Deloitte audits Banco BPM.

The distribution is significant because financial institutions include some of the largest and more complex audit engagements in the index, yet no single firm dominates the sector.

Elsewhere, the pattern is less balanced.

PwC audits all three information-technology companies in the dataset — Nexi, STMicroelectronics and Technoprobe.

The six utilities are split evenly between KPMG and Deloitte, with three mandates each.

Among the six industrial companies, Deloitte holds three mandates, while EY, KPMG and PwC each audit one.

Auditor rotation has produced a relatively young set of engagements

The FTSE MIB stands out for the relatively recent start dates of many of its current audit relationships.

Eleven current engagements began in 2024 or later.

They include:

• Hera — KPMG from 2024

• INWIT — KPMG from 2024

• Stellantis — Deloitte from 2024

• A2A — KPMG from 2025

• Prysmian — PwC from 2025

• Tenaris — Forvis Mazars from 2025

• Avio — KPMG from 2026

• Banco BPM — Deloitte from 2026

• BPER Banca — KPMG from 2026

• Mediobanca — PwC from 2026

• STMicroelectronics — PwC from 2026

At the other end of the spectrum, the earliest current engagements in the dataset date only to 2019.

Those include Amplifon with KPMG, Eni and Nexi with PwC, Saipem with KPMG and Telecom Italia with EY.

That is a markedly different tenure profile from markets where individual audit relationships can extend back several decades.

European rules for public-interest entities place limits on the duration of statutory audit engagements. Under the EU Audit Regulation, the standard maximum duration of an audit-firm engagement is ten years, subject to extensions under specified circumstances.

The FTSE MIB data reflects that environment. Audit mandates change hands regularly, and none of the current relationships in the index predates 2019.

Audit fees change the ranking

The picture looks different when the market is viewed through disclosed audit fees rather than the number of mandates.

Big4News identified a current audit fee for 34 of the 40 companies. Across those engagements, the disclosed fees total approximately €232.3 million.

KPMG-audited companies account for around €76.9 million, or 33.1% of the identified total.

Deloitte ranks second by disclosed fees at approximately €61.6 million, or 26.5%.

PwC accounts for about €46.8 million, or 20.1%, while EY accounts for approximately €45.7 million, or 19.7%.

Forvis Mazars accounts for around €1.3 million, or 0.5%.

That produces a different ordering from the mandate count. KPMG and PwC are tied for first by number of clients, but KPMG has a substantially larger share of the identified fee pool.

About the data

The dataset reflects the FTSE MIB constituent set at 30 September 2026. Borsa Italiana describes the FTSE MIB as comprising 40 of the most liquid and highly capitalised shares listed on Euronext Milan and Euronext MIV Milan.

For more detail on how the series is researched and standardised, see Who Audits? Sources & Methodology.

Explore Who Audits?

See the Who Audits? hub for company-by-company data on the auditors, audit tenure, market share and audit fees behind major stock-market indices around the world.

Who audits the world’s largest companies?

Explore the Big4News Who Audits? hub, which maps the audit firms behind the world’s leading stock-market indices — including auditor tenure, audit fees and Big Four audit market share.

Explore the global Who Audits? series →

The WIG20 brings together 20 of the largest and most liquid companies listed on the Warsaw Stock Exchange’s Main Market. Its constituents include major banks, energy groups, retailers and manufacturers, providing a view of who audits some of the most prominent businesses on the Polish exchange.

The table reflects the WIG20 constituent and auditor snapshot for September 2026, with the latest fee research completed on 8 October 2026. Big4News has identified the external auditor, the first financial year of the current engagement and a disclosed fee for all 20 companies.

The results show a concentrated market with an unusual distribution of mandates: PwC leads comfortably, Deloitte is absent, and Grant Thornton audits two constituents. Recent starting dates are common, but those recent engagements are all held by Big Four firms.

Fees are shown in Polish złoty (PLN) and relate to FY2025. The Notes column identifies differences in reporting periods, fee scope and currency conversion, including amounts that combine audit and review services.

Click the column headings to sort the table by company, sector, auditor, the first financial year of the engagement or audit fee.

WIG20 audit market share

PwC holds nearly half the WIG20 audit appointments

PwC audits nine WIG20 companies, giving it a 45% share of appointments—equal to KPMG and EY combined. KPMG holds five mandates, EY four and Grant Thornton two. Deloitte has none.

This gives the WIG20 a distinctive audit-market structure. The Big Four account for 90% of appointments, but that share is divided among just three networks. Grant Thornton completes the field through its engagements at LPP and CD Projekt.

Financial services anchor PwC’s position

Five of PwC’s nine clients are financial companies: Bank Pekao, PZU, Erste Bank Polska, Alior Bank and Kruk. KPMG audits the remaining two financial constituents, PKO Bank Polski and mBank.

PwC’s lead therefore rests heavily on financial services. EY’s portfolio has a different composition: three retail groups—Żabka, Pepco and Modivo—and manufacturer Grupa Kęty. KPMG combines banking with energy, utilities and food retail through ORLEN, PGE and Dino Polska.

Recent engagements remain concentrated in the Big Four

Twelve of the 20 current audit relationships began in FY2024 or FY2025. PwC holds six of these engagements, KPMG four and EY two.

The recent appointments have strengthened the three largest networks’ presence in the index. Grant Thornton’s two engagements are older, dating to FY2018 at CD Projekt and FY2022 at LPP.

Pepco and ORLEN account for the largest recorded fees

Pepco has the largest recorded fee in the WIG20 dataset at PLN 24.9 million, followed by ORLEN at PLN 18.6 million. Erste Bank Polska ranks third at PLN 7.2 million.

The two figures have different reporting scopes. Pepco’s FY2025 annual report discloses EUR 5.840 million in audit fees, including discontinued operations. Converted at EUR/PLN 4.2676, this produces the PLN 24.9 million figure shown in the table. ORLEN’s amount combines PLN 12.5 million in separately identified audit fees with a PLN 6.1 million category covering audits and reviews.

At the lower end, CD Projekt records PLN 150,000, Budimex PLN 256,000 and PGE PLN 550,000. Modivo’s PLN 3.3 million figure includes both audit and review services for the parent/group and subsidiaries.

About the data

This dataset covers the 20 companies in the September 2026 WIG20 snapshot, with the latest fee research completed on 8 October 2026. Auditor identities, first financial years and fee figures are recorded for every company.

The research draws on annual reports, audited financial statements, auditor reports and appointment announcements. Read Who Audits? Sources & Methodology for details of how Big4News identifies auditors, establishes tenure and treats fee disclosures.

Who audits the world’s largest companies?

Explore the Big4News Who Audits? hub, which maps the audit firms behind the world’s leading stock-market indices — including auditor tenure, audit fees and Big Four audit market share.

Explore the global Who Audits? series →

The Swiss Market Index brings together 20 of Switzerland’s largest and most liquid listed companies. Its constituents span global pharmaceutical groups, major financial institutions, consumer businesses and industrial manufacturers.

This September 2026 snapshot identifies each company’s current auditor, the first financial year under the engagement and its disclosed audit fee. It reflects the index changes effective on 21 September 2026, when Galderma and Sandoz replaced Swisscom and Kühne+Nagel.

The table can be sorted by company, sector, auditor, since and audit fee.

Notes explain reporting periods, currency conversions and differences in fee scope.

KPMG holds half the appointments

KPMG audits 10 of the index’s 20 companies, giving it a 50% share of appointments. EY holds six mandates, or 30%, followed by PwC with three, or 15%. Deloitte audits one constituent, representing 5%.

Every company in the SMI appoints a Big Four firm. KPMG and EY together hold 80% of the index’s audit appointments.

KPMG’s portfolio includes Novartis, Roche, Swiss Re, ABB and Richemont. It also audits both September additions, Galderma and Sandoz. Four of the index’s six healthcare companies appoint KPMG; Alcon uses PwC and Lonza uses Deloitte.

EY’s six engagements include UBS, Zurich Insurance and Nestlé. PwC audits Alcon, Swiss Life and Partners Group. Deloitte’s sole appointment is Lonza.

Audit fees

The fees recorded in the table total approximately CHF390.7m, with a median of CHF9.75m.

Four companies account for about 60.5% of that total: UBS, Zurich Insurance, Nestlé and Swiss Re.

UBS has the largest recorded fee, at approximately CHF119.7m after conversion from US dollars. Its USD151m Audit category comprises USD100m in global audit fees and USD51m in additional services classified as audit, required by law or statute. Separately disclosed non-audit services are excluded.

Zurich Insurance follows at approximately CHF45.2m, while Nestlé reports CHF40.2m and Swiss Re’s fee converts to CHF31.3m. ABB and Novartis record approximately CHF24.6m and CHF22.4m respectively. At the lower end, Geberit reports CHF1.81m.

These figures reflect the companies’ disclosed audit categories. Some include interim reviews or mandatory assurance work alongside the financial-statement audit. Nestlé’s figure includes review of ESG information, while ABB’s includes mandatory sustainability assurance. The table notes identify these differences.

Recent appointments and established relationships

Five companies have a recorded first financial year with their current auditor of 2024 or later.

Deloitte’s Lonza engagement begins with FY2024. EY replaced PwC at Geberit for FY2025, and PwC replaced KPMG at Partners Group for the same year. Richemont’s engagement with KPMG begins with FY2026, following PwC.

Amrize’s EY engagement dates from 2024, before its 2025 spin-off and listing. That starting year records the audit relationship of the new entity rather than an auditor switch at the point of listing.

Among the longer relationships, EY’s UBS engagement dates from 1998 and PwC’s Swiss Life engagement from 2002. Roche has appointed KPMG since 2004, while Logitech’s KPMG engagement dates from 2015.

The dates record the first financial year under the current continuous auditor network engagement. Annual reappointments continue the relationship rather than resetting its starting year.

Sources and methodology

The table reflects the September 2026 research snapshot, with a review of auditor appointments, engagement dates and fee disclosures completed on 8 October 2026. The constituent set incorporates SIX’s ordinary index review effective on 21 September 2026.

Fees generally relate to FY2025. Richemont and Logitech are reported for FY2026, ended 31 March 2026. Figures use group audit fees attributable to the principal auditor network where separately disclosed. The notes identify combined audit and review or mandatory assurance categories and other exceptions.

Foreign-currency amounts are converted to Swiss francs using ECB reference rates at the issuer’s financial year-end: 31 December 2025 for calendar-year reporters and 31 March 2026 for Richemont and Logitech. Swiss and US member firms of the same network count as one appointment per company.

Read the full Sources and Methodology, or explore other indices in Who audits the world’s largest companies?.

Who audits the world’s largest companies?

Explore the Big4News Who Audits? hub, which maps the audit firms behind the world’s leading stock-market indices — including auditor tenure, audit fees and Big Four audit market share.

Explore the global Who Audits? series →

The OMX Copenhagen 25 tracks a selection of the largest and most actively traded securities listed on Nasdaq Copenhagen.

There is one wrinkle when analysing its audit market. The index contains 25 securities, but A.P. Moller - Maersk appears twice through its A and B share classes. For audit-market analysis, Big4News counts Maersk once, giving a universe of 24 underlying companies.

Nasdaq’s June 2026 semi-annual review also changed the composition of the index. Nordea Bank entered and Bavarian Nordic left, with the changes taking effect on 22 June 2026.

For each company, Big4News identified the current external auditor, the first financial year of the present audit relationship where this could be established reliably, and the latest available statutory audit fee.

The dataset reflects the index at September 2026. Audit fees are shown in Danish kroner.

The table is sortable. Click any column heading to reorder the data by company, sector, auditor, tenure or audit fee.

For details on how the data is compiled, verified and standardised across the series, see Who Audits? Sources & Methodology.

PwC audits more than half of the companies

Denmark’s largest listed companies present an unusually concentrated picture.

Every one of the 24 underlying companies is audited by the Big Four.

But the work is not divided among all four firms.

PwC audits 13 companies, giving it 54.2% of the market. EY has six mandates, or 25%, while Deloitte audits five, equivalent to 20.8%.

KPMG is conspicuous by its absence from Denmark's blue-chip index. None of the 25 securities in the OMX Copenhagen 25 is currently audited by KPMG. The firm did audit Bavarian Nordic, but the vaccine maker was removed from the index in June 2026 and replaced by PwC-audited Nordea.

PwC’s dominance is even greater by audit fees

PwC audits just over half of the companies in the index but accounts for almost two-thirds of the statutory audit fees identified by Big4News.

Big4News identified a current statutory audit fee for 23 of the 24 underlying companies, with disclosed fees totalling approximately DKK 645 million.

PwC-audited companies account for about DKK 425 million, or 65.9% of that total. Deloitte accounts for approximately DKK 144 million (22.4%), while EY accounts for around DKK 76 million (11.7%).

The difference reflects the size of some of PwC’s mandates. A.P. Moller - Maersk has the largest audit fee in the dataset at approximately DKK 108 million, followed by DSV at DKK 73 million and ISS at DKK 54 million. Carlsberg, another PwC client, reports an audit fee of DKK 46 million.

Among Deloitte’s clients, Danske Bank reports DKK 45 million and Novo Nordisk DKK 43 million, while Vestas reports approximately DKK 37 million.

Who audits the world’s largest companies?

Explore the Big4News Who Audits? hub, which maps the audit firms behind the world’s leading stock-market indices — including auditor tenure, audit fees and Big Four audit market share.

Explore the global Who Audits? series →

The OMX Stockholm 30 brings together 30 of the largest and most traded shares on Nasdaq Stockholm. Its constituents include industrial groups with worldwide operations, major Nordic banks and some of Sweden’s best-known consumer businesses.

This September 2026 snapshot identifies each company’s current auditor, the first financial year under the engagement and its disclosed audit fee. Companies are listed alphabetically, but the table can be sorted by company, sector, auditor, since and audit fee.

Fees are presented in Swedish kronor, with the final column explaining currency conversions, predecessor fees and other exceptions..

A closely divided market

EY holds nine audit appointments, giving it 29.0% of the Stockholm index’s appointments. PwC and Deloitte each hold eight, or 25.8%, while KPMG holds six, or 19.4%. Every company on the index is audited by a Big Four firm.

Svenska Handelsbanken has two auditors, PwC and Deloitte. Counting both produces 31 appointments across the 30 companies.

Each network counts once per company; Alfa Laval’s two individually appointed EY auditors count as one EY appointment.

The market-share chart therefore measures each network’s share of those 31 appointments.

The distribution reflects the different types of businesses in the index. Industrials make up 13 of the 30 companies, and EY audits six of them: Atlas Copco, Alfa Laval, ASSA ABLOY, Epiroc, Lifco and Skanska. These businesses account for two-thirds of EY’s Stockholm appointments. Its remaining clients are SEB, Essity and SCA.

The financial sector has seven companies and eight audit appointments. PwC and Deloitte each hold three. PwC audits Nordea and Swedbank and shares Handelsbanken’s audit with Deloitte. Deloitte’s other financial-sector clients are Investor and Industrivärden. EY audits SEB, while KPMG audits EQT.

KPMG’s six appointments include both telecommunications companies, Tele2 and Telia, as well as ABB and AstraZeneca. Deloitte’s portfolio includes Ericsson and AB Volvo; PwC’s includes Hexagon, Sandvik and Saab. Appointment counts capture the breadth of each firm’s client list, while the names behind those counts reveal its position in particular industries.

Recent appointments alongside established relationships

Six companies have a recorded first financial year with their current auditor of 2024 or later. Deloitte’s Addtech engagement and KPMG’s appointments at Tele2 and Telia begin with financial years ending in 2024. PwC’s Boliden engagement and EY’s Lifco engagement begin in 2025.

AstraZeneca appointed KPMG at its April 2026 annual general meeting, making 2026 the first financial year of the new engagement. The company’s latest published annual fee disclosure in this snapshot still relates to PwC’s FY2025 audit.

At the other end of the table, Saab’s relationship with PwC dates from 2011. Deloitte’s Investor engagement and KPMG’s NIBE engagement date from 2013. H&M’s Deloitte engagement began in 2021. EQT’s start year is left blank because the company’s disclosures give conflicting dates. The table records the first financial year under the engagement; annual reappointments do not restart that date.

Audit fees reflect the scale of the companies

The audit fees recorded in the table total approximately SEK2.29bn, with a median of SEK57.5m. Where separately disclosed, the figures cover fees for the principal auditor’s network, excluding fees paid to other audit firms and separately identified non-audit services. Disclosed audit categories can include reviews, sustainability assurance or transaction-related audit work, as identified in the notes. Six companies account for approximately 50.6% of that total: ABB, AstraZeneca, Ericsson, Hexagon, AB Volvo and Atlas Copco.

ABB has the largest recorded fee, at approximately SEK285.5m after conversion from US dollars. AstraZeneca follows at SEK260.6m. Ericsson reports SEK181m, Hexagon’s fee converts to SEK165.6m, and AB Volvo and Atlas Copco report SEK142m and SEK125m respectively.

The largest disclosures come from international groups with substantial audit operations. The range also extends to much smaller disclosures: Industrivärden reports SEK1m. A count of audit appointments gives each company equal weight; the fee data shows how widely the financial scale of those appointments varies.

AstraZeneca’s SEK260.6m figure comes from the FY2025 disclosure for predecessor PwC’s group and subsidiary statutory audits, including USD0.8m relating to prior years. KPMG appears as the current auditor, and the table’s note identifies PwC as the recipient of the reported fee. Handelsbanken’s SEK52m figure combines SEK45m for PwC and SEK7m for Deloitte. These distinctions matter when allocating disclosed fees between audit firms.

About the data

The table uses the September 2026 research snapshot, with a full review of constituents, current auditor appointments, engagement dates and fee disclosures completed on 8 October 2026. The June 2026 Nasdaq review made no changes to the index’s constituents.

“Since” refers to the first financial year ending under the current audit engagement. Handelsbanken’s paired dates follow the same order as its paired auditors. For Nordea Bank Abp, the date reflects its first reporting period, which ended in 2018. EQT’s issuer governance and IPO documents say 2011, while its signed auditor’s report says 2012; the table leaves that date blank and explains the conflict in Notes.

Fees use the latest annual disclosure available in the research, generally FY2025, with Addtech reported for FY2025/26. The figures use separately disclosed statutory audit or audit-engagement fees for the group auditor’s network where available, excluding separately identified non-audit services and fees to other audit firms. SEB’s audit category includes quarterly reviews, and NIBE’s includes contractual reviews. ABB’s includes mandatory sustainability assurance and may include quarterly reviews and comfort letters; Epiroc’s includes sustainability audit at group level. Hexagon’s audit category includes work relating to the potential separation of Octave. Telia’s figure covers continuing operations, with no separate charge for interim reviews; its unsplit discontinued-operation remuneration is excluded. EQT’s audit-services category includes contracted examinations and agreed-upon procedures. Notes identify exceptions, including fees paid to a predecessor. The total combines company disclosures across reporting periods and currencies; allocating it by network requires the recipient and any joint-audit split to be taken into account.

Euro and US-dollar disclosures are converted to Swedish kronor using ECB reference rates at 31 December 2025. These conversions provide a common presentation currency.

See Sources and Methodology for the series’ definitions and research approach. Explore the other markets in Who audits the world’s largest companies?.

Who audits the world’s largest companies?

Explore the Big4News Who Audits? hub, which maps the audit firms behind the world’s leading stock-market indices — including auditor tenure, audit fees and Big Four audit market share.

Explore the global Who Audits? series →

The KOSPI 200 brings together 200 leading companies listed on the Korea Exchange and spans some of South Korea’s largest industrial, technology, financial and consumer groups.

Big4News identified the current FY2026 external auditor of every constituent, together with the first financial year of the present audit relationship where this could be established reliably and the latest available audit fee.

The dataset reflects the KOSPI 200 at September 2026. Audit fees are shown in South Korean won.

The table is sortable. Click any column heading to reorder the data by company, sector, auditor, tenure or audit fee.

For details on how Big4News verifies and standardises the data across the series, see Who Audits? Sources & Methodology.

KOSPI 200 audit market share

EY leads, but the Big Four do not have the market entirely to themselves.

EY is the largest auditor in the KOSPI 200, with 60 of the 200 mandates, equivalent to a 30% market share.

KPMG follows with 54 companies, or 27%, while PwC audits 46, or 23%.

Deloitte is considerably smaller, with 27 mandates and a 13.5% share.

Together, the Big Four audit 187 of the 200 companies, or 93.5%.

That leaves 13 companies — 6.5% of the index — audited by firms outside the Big Four.

EY’s lead is driven by several major sectors

The overall market-share figures conceal substantial differences between sectors.

Industrials are the largest group in the dataset, with 42 companies. KPMG leads there with 16 mandates, followed by EY with 12, PwC with eight and Deloitte with five.

Materials tell a different story. Of the 39 materials companies, EY audits 15 — considerably more than KPMG’s nine. Seven materials companies use firms outside the Big Four, making the sector one of the clearest areas of challenger participation.

EY is also particularly strong in healthcare, auditing nine of the 14 healthcare companies.

PwC leads financial services. It audits nine of the 22 financial companies, compared with five for KPMG and four each for EY and Deloitte.

KPMG has the strongest position in information technology, where it audits seven of 17 companies. Its clients include two of the most prominent semiconductor companies in the index, Samsung Electronics and SK Hynix.

Audit fees put KPMG in first place

Market share changes again when the size of identified audit fees is considered.

Big4News identified a current audit fee for 182 of the 200 companies.

Together, those fees amount to approximately KRW 187.8 billion.

KPMG-audited companies account for approximately KRW 60.2 billion, or 32.1% of the identified total.

PwC follows with about KRW 52.8 billion, or 28.1%, while EY accounts for approximately KRW 44.5 billion, or 23.7%.

Deloitte accounts for around KRW 25.7 billion, or 13.7%.

The ten other audit firms represented in the index collectively account for approximately KRW 4.6 billion, or 2.4% of the identified fee pool.

That produces a different ranking from the number of mandates. EY leads by client count, but KPMG holds the largest share of identified audit fees.

Korea has an exceptionally young auditor-tenure profile

Big4News established the first financial year of the current audit relationship for 199 of the 200 companies.

More than three-fifths of those relationships began in just the past two financial years: 62 began in 2025 and another 61 in 2026.

A further 34 began in 2024 and 29 in 2023.

That means 186 of the 199 precisely dated relationships — 93.5% — began in 2023 or later.

Only 13 date from before 2023.

The oldest precisely established current relationship in the dataset begins in 2020, when PwC became auditor of Korea District Heating. One further relationship, S-Oil with PwC, can be traced much further back, but Big4News leaves its “Since” field blank because the true first financial year of the continuous engagement could not be established reliably.

Korea’s auditor-designation system helps explain the turnover

The unusually short tenures are closely connected to South Korea’s regulatory framework.

Under Korea’s periodic auditor-designation system, listed companies generally select their external auditor for six years before the financial regulator appoints an auditor for the following three years. The system was introduced to strengthen auditor independence. South Korean rules also generally require listed companies to retain the same appointed auditor for three consecutive financial years.

The framework means that three-year audit periods appear repeatedly throughout the KOSPI 200 data.

About the data

The dataset reflects the KOSPI 200 constituent universe at September 2026 and contains 200 companies.

For more detail on the methodology used across the series, see Who Audits? Sources & Methodology.

Who audits the world’s largest companies?

Explore the Big4News Who Audits? hub, which maps the audit firms behind the world’s leading stock-market indices — including auditor tenure, audit fees and Big Four audit market share.

Explore the global Who Audits? series →

Spain’s IBEX 35 brings together international banks, electricity groups, infrastructure businesses and some of the country’s best-known consumer brands. Its audit market is concentrated entirely in four networks, with only one appointment separating the leader from its two closest competitors.

This table uses the September 2026 roster and identifies each company’s current financial-statement auditor, the first financial year audited by that firm and its latest disclosed audit fee. Fees appear in euros. It can be sorted by company, sector, auditor, since and audit fee.

Notes explain changes of auditor, broader fee categories, reporting periods and other exceptions.

A narrow lead for KPMG

KPMG holds 11 appointments, or 31.4% of the total. EY and PwC each hold 10, or 28.6%, while Deloitte holds four, or 11.4%. All 35 companies appoint a Big Four firm, and each is counted once in the appointment chart.

KPMG’s position is particularly visible in utilities. It audits four of the sector’s seven companies: ACCIONA Energía, Endesa, Iberdrola and Naturgy. EY audits Redeia and Solaria, while Deloitte audits Enagás.

The six banks divide differently. PwC audits Santander, CaixaBank and Bankinter; KPMG audits Sabadell and Unicaja; and EY audits BBVA. Mapfre, the seventh company classified as a financial business in the table, appoints KPMG.

The other firms’ portfolios reach well beyond banking and utilities. EY’s clients include Inditex, Amadeus, ArcelorMittal and Cellnex. PwC audits Telefónica, Repsol and Ferrovial. Deloitte’s four engagements are ACS, Enagás, Grifols and Inmobiliaria Colonial.

Recent changes alongside established engagements

Eight companies have a recorded first financial year with their current auditor of 2024 or later. Grifols’ Deloitte engagement, Merlin Properties’ PwC engagement and Unicaja’s KPMG engagement began in FY2024. EY began auditing Cellnex in FY2025, alongside Deloitte at Colonial and PwC at Ferrovial.

Two further changes take effect for FY2026. Deloitte succeeds EY at Enagás, while PwC succeeds Deloitte at Indra. Their fee entries therefore describe the outgoing firms’ completed FY2025 work and identify the recipients in the Notes column.

Longer relationships remain prominent. KPMG’s Mapfre engagement and EY’s Solaria engagement date from FY2015. PwC’s engagements at Santander and Bankinter, and EY’s at Fluidra, date from FY2016. Seven companies have recorded start years of FY2017.

“Since” refers to the first financial year audited by the current firm. The year in which shareholders approved an appointment can be earlier. Puig’s date follows the disclosed continuous individual-company audit tenure rather than its IPO date.

Santander dominates the recorded fee total

The fee figures in the table total approximately €335.1m, with a median of €3.3m. This is the sum of the recorded disclosures, including labelled predecessor fees and broader audit categories.

Santander’s €118.5m disclosure accounts for 35.4% of that total. BBVA follows at €26.7m, ArcelorMittal at approximately €24.8m, Iberdrola at €23.55m and Telefónica at €20.59m. Together, these five companies account for 63.9% of the recorded total. At the other end of the table, Solaria records €274,000 and Rovi €361,000.

The disclosures do not all measure the same scope of work. Santander’s audit category includes interim reviews, integrated financial-statement and internal-control audits, and regulatory reports. Enagás’ predecessor fee also includes review and internal-control work. Grifols reports its group audit fee rounded to the nearest €1m and includes interim limited reviews and PCAOB financial-statement audits.

Where companies separately identify audit-related services, sustainability assurance, tax or other work, those amounts are excluded. The notes also identify subsidiary fees paid to another network: Aena’s €553,000 KPMG figure excludes €380,000 paid to Grant Thornton for Luton subsidiary audits.

These differences limit direct price comparisons. The appointment chart measures current mandates; the table provides the latest disclosed fee information with its scope and timing explained.

Sources and methodology

The September 2026 worksheet was updated on 9 October 2026, with targeted checks against consolidated accounts, audit committee reports and issuer appointment announcements. Unchanged fields retain the supporting research from the earlier verified worksheet.

Fees generally relate to FY2025. Logista’s year ended on 30 September 2025 and Inditex’s on 31 January 2026. ArcelorMittal’s US$29.1m was converted to euros using the ECB’s 31 December 2025 reference rate, EUR1 = US$1.1750.

Read the full Sources and Methodology, or explore other indices in Who audits the world’s largest companies?.

Who audits the world’s largest companies?

Explore the Big4News Who Audits? hub, which maps the audit firms behind the world’s leading stock-market indices — including auditor tenure, audit fees and Big Four audit market share.

Explore the global Who Audits? series →

This table records the principal external audit networks for the JSE Top 40 research roster after the September 2026 review. It includes 41 issuer entries because Investec Limited and Investec plc are recorded separately. Nine entries have joint auditors, giving 50 recorded appointments.

The table can be sorted by company, sector, auditor, since and audit fee.

Fees relate to the financial years and scopes stated in the notes; the research cutoff is 9 October 2026.

The JSE Top 40 research roster presents an unusually close contest among the Big Four. PwC and EY each hold 13 recorded appointments, or 26%. KPMG follows with 12, or 24%, and Deloitte has 11, or 22%. BDO accounts for the remaining appointment, at Sibanye-Stillwater, giving it a 2% share. Together, the Big Four hold 49 of the 50 appointments in this dataset.

Those figures require a clear counting rule. The table contains 41 issuer entries, including separate records for Investec Limited and Investec plc. Nine entries have two principal audit firms. Counting each joint signatory once produces 50 appointments. The resulting shares describe the distribution of recorded audit mandates across those legal issuers. They do not measure audit revenue, the firms’ share of index capitalisation or their positions across the wider South African market.

Joint audits shape the competition

Joint appointments are concentrated among financial institutions. Absa, Capitec, Discovery, FirstRand, Investec Limited, Nedbank, Old Mutual, Standard Bank and Sanlam each have two principal firms in the roster. Consequently, a network can hold several major banking and insurance mandates without displacing the other signatory. Different pairings also give each of the Big Four access to substantial financial-sector work.

Recent appointments coexist with continuing relationships

Several appointments in the roster begin in FY2026. These include KPMG at Bid Corporation, Richemont and FirstRand, and Deloitte alongside EY at Standard Bank.

Who audits the world’s largest companies?

Explore the Big4News Who Audits? hub, which maps the audit firms behind the world’s leading stock-market indices — including auditor tenure, audit fees and Big Four audit market share.

Explore the global Who Audits? series →

I investigate corporate misconduct for a living, which often means arriving after decisive events and reconstructing what happened from the remaining records. By that point, the people involved have had months or years to develop explanations for their decisions. Documentation is rarely complete, but it can provide a more reliable basis for understanding how an institution responded in real time.

That is what makes the KPMG Australia whistleblower matter useful beyond the immediate scandal. Big4News has already documented the discrepancies between what KPMG told its whistleblower, independent directors, clients and Parliament, and what later emerged in the public record. The broader question is whether those failures reflect something distinctive about professional partnerships or a more general tendency among large organizations to manage threatening information in ways that protect the institution before they protect the reporting process.

My view is that the partnership model is better understood as an intensifier than as the underlying cause. The mechanisms visible in the KPMG record—for example, how a complaint is classified, who controls the investigation, how the reporting employee is treated, and how senior leadership receives information—also appear in organizations with very different ownership structures.

The Importance of the First Classification Decision

Three aspects of the KPMG record are particularly important.

First, the whistleblower’s disclosure was treated substantially as an employment and grievance matter even though the allegations concerned audit integrity, confidential client information and the conduct of senior personnel. That routing decision matters because it determines the framework through which an organization evaluates what follows. An integrity matter directs attention toward evidence, conflicts, independence and accountability. An employment matter naturally brings questions of communication, workplace relationships, performance and process into the foreground.

Second, the external legal reviews did not necessarily constitute the independent examination that outsiders might have assumed. Ashurst later told Parliament that it had not been engaged to investigate the substance of the allegations of misconduct. The subsequent Allens review, Project Magenta, operated within a scope approved by a KPMG board subcommittee, interviewed fourteen senior partners and directors, did not interview the whistleblower, and did not comprehensively search the relevant digital records. Yet it still identified conduct consistent with significant parts of the account it was said to have rejected.

Third, KPMG searched the whistleblower’s computer and located material that set out the substance of his allegations, while continuing to emphasize that it lacked sufficient information to pursue them. None of these facts, considered individually, establishes a coordinated effort to silence a whistleblower. Taken together, however, they show how early decisions about classification, scope, and evidence can shape the institutional response long before anyone reaches a formal conclusion.

Boeing: Operational Pressure without a Partnership Structure

Boeing provides a useful comparison because the organizational form is entirely different. At an April 2024 US Senate hearing, quality engineer Sam Salehpour testified that he had raised concerns about manufacturing and assembly practices involving the 787 and 777 over several years and experienced isolation and transfer after refusing to remain quiet. Former Boeing manager Ed Pierson also described warnings about factory conditions that he believed had been disregarded. Boeing has disputed important technical allegations and has stated that retaliation against employees who raise safety concerns is prohibited.

The organizational point does not depend on resolving engineering disputes. Where delivery schedules, production targets, and financial expectations exert strong pressure, an employee who repeatedly interrupts work to raise concerns can gradually be treated as an operational problem. A person who believes he is protecting quality may be viewed as obstructive, overly cautious, or insufficiently focused on execution. That shift can occur through ordinary performance expectations, meeting dynamics, and reassignment decisions, which is why it can be difficult to distinguish from routine management unless the sequence of events is examined closely.

Wells Fargo: When the Personnel Record Becomes Part of the Defense

Wells Fargo offers a more formal example because there is a government agency finding. In 2022, the US Department of Labor’s Occupational Safety and Health Administration found that Wells Fargo had violated the whistleblower protection provisions of the Sarbanes-Oxley Act by terminating a senior manager in its Chicago-area commercial banking division.

The manager had repeatedly raised concerns through management and the corporate ethics process about conduct he believed violated federal law. OSHA ordered more than $22 million in back wages, benefits, compensatory damages, and other relief. The determination was subject to objection and further proceedings and should not be treated as a final judicial ruling.

The point for boards is how an employment record can become part of the institution’s later explanation. Wells Fargo eventually attributed the termination to restructuring; OSHA found that explanation inconsistent with the treatment of other managers involved in the same initiative. Performance management and restructuring are legitimate functions, but they also create documentation that can later appear neutral and self-explanatory. Investigators therefore need to ask not only what a personnel file says, but how and when that record developed after an employee raised concerns.

Theranos: Legal and Personal Pressure on the Whistleblower

Theranos represents a more overt version of the same imbalance. Employees Tyler Shultz and Erika Cheung raised concerns about the reliability of the company’s blood-testing technology. The company responded to dissent and disclosure with aggressive legal pressure, confidentiality claims, and threats of litigation.

Shultz has described legal expenses running into hundreds of thousands of dollars, as well as severe damage to his relationship with his grandfather, former US Secretary of State George Shultz, who served on the Theranos board.

The case demonstrates the disparity in resources that can arise when an employee challenges an institution with substantial financial, legal, and reputational power. Formal reporting channels and a prominent board provide limited protection if directors receive incomplete information or defer excessively to management. KPMG’s independent directors confronted a different version of that problem: the public record indicates they did not always receive an accurate account of how the whistleblower allegations were handled. That should temper the idea that conventional corporate-governance structures are, by themselves, an adequate solution.

What the Partnership Model Adds

The partnership model still warrants close scrutiny because it concentrates conflicts that may be more dispersed elsewhere.

The first is economic. In a large professional-services partnership, people responsible for overseeing an allegation may share directly in the same profit pool as the partners, clients or practices affected by it. No one has to act dishonestly for that connection to influence judgment. Commercial dependence can shape which issues receive urgency; how much disruption is considered acceptable and how readily senior colleagues are challenged.

The second is the concentration of roles. Senior partners are owners as well as employees, and many also serve as managers, governance participants and major revenue generators. When an allegation concerns a commercially powerful partner, the institution may therefore be investigating a person who is simultaneously a colleague, an owner and an important economic asset.

The third issue is the global network structure. When the KPMG whistleblower escalated his concerns to KPMG International, the global organization declined to investigate, citing the legal separation of the Australian member firm, despite a published hotline framework that contemplated escalation when allegations involved senior leadership at the member firm.

The legal independence of member firms is genuine, but it creates a governance tension: global networks derive substantial commercial value from a shared name while responsibility for misconduct may remain largely within the individual member firm. The Australian Senate identified related governance concerns in its examination of PwC’s tax confidentiality scandal, which it described as a calculated breach of trust.

What I Test When I Review a Whistleblower Matter

Almost every major organization has a whistleblowing policy. The existence of the policy tells me relatively little about whether the system works. I am more interested in four practical questions:

1. who made the initial classification decision;

2. what the investigator was actually instructed to examine;

3. what happened to the complainant after the report;

4. and whether the evidence was independently searched.

The first two questions concern governance and scope. Who decided that an allegation belonged with HR, compliance, legal, internal audit, or the board, and was that decision recorded? An administrative choice in the first few days can shape the entire response.

Likewise, the name of an outside law firm is less important than its engagement letter. Investigators need to know what questions the firm was authorized to answer, which witnesses it could interview, which systems it could search, and who retained control over those decisions. An investigation can be external without being meaningfully independent.

The next questions concern retaliation and evidence. I want to know what happened to the reporting employee six, twelve, and twenty-four months later. Changes in performance ratings, responsibilities, promotion prospects, access to meetings, or management documentation are measurable and should be reviewed systematically. I also want to know whether the evidence was tested independently rather than relying primarily on interviews with the people implicated by the complaint. Digital records, messages, access logs and financial information can test competing accounts in ways that interviews alone cannot.

The Governance Lesson

Serious institutional misconduct rarely requires a formal conspiracy. More often, the conditions develop through ordinary forces: hierarchy, loyalty, commercial pressure, professional dependence and repeated decisions to give the institution the benefit of the doubt. Employees observe what happens to colleagues who raise difficult issues, and those observations influence whether the next concern is reported, softened or withheld.

For that reason, the quality of a whistleblowing system cannot be measured by the existence of a hotline, an ethics policy or an external law firm on call. More meaningful measures are what happens after a report is made, who controls the next steps, whether evidence is tested independently and whether the person who raised the concern can continue to work without adverse treatment unrelated to legitimate performance issues.

KPMG Australia is especially instructive because so much of that process has entered the public record. Partnerships are not uniquely prone to mishandling unwelcome information, but their concentration of ownership, management, commercial incentives and professional relationships can make institutional self-protection harder to detect and overcome. The governance challenge is therefore not simply to create more reporting channels. It is to ensure that once a concern enters the system, no single group with a material stake in the outcome controls how the concern is classified, investigated and ultimately explained.

This article is part of the Big4News Investigations & Analysis series, which examines the structural forces shaping Deloitte, PwC, EY and KPMG.

About Charles Cohen

Charles Cohen is the Founder of SilverTree Intelligence Group and a highly experienced intelligence director and fraud specialist. With a distinguished career in due diligence and investigative services, he has advised Fortune 500 companies, private equity and venture capital firms, investment banks, high-net-worth individuals, law firms, real estate management firms, oil and mining enterprises, and some of the world’s largest insurance firms.

Most recently, Charles served as Director of Aon’s M&A and Transaction Solutions Corporate Intelligence practice, where he acted as a trusted advisor to clients and led and mentored a global team of intelligence analysts and cyber experts.

His extensive background in consulting, advisory, and investigations began at Deloitte, where he served as a Managing Investigator for the firm’s global parent office in New York. Over the years, he has conducted investigations for top firms, including the Mintz Group and Ethos Risk Services.

Charles’ investigative expertise spans a broad range of areas, including internal corporate investigations, litigation support, M&A due diligence, executive vetting, post-fraud assistance, asset tracing, witness location, interviewing, and trial monitoring.

He holds a bachelor’s degree from the University of Wisconsin–Madison, is a Certified Fraud Examiner (CFE), a Certified Insurance Fraud Investigator (CIFI), a FCRA Certified Professional Background Screener, and a member of the Board of Regents for the Association of Certified Fraud Examiners.

The EURO STOXX 50 is one of the principal benchmarks for large listed companies in the eurozone.

STOXX describes the index as representing 50 of the largest companies in the eurozone by free-float market capitalisation, drawn from a range of major industry sectors. The benchmark currently includes companies from eight countries and captures roughly 60% of the free-float market capitalisation of the wider EURO STOXX Total Market Index.

The September 2026 annual review brought ENGIE and Nokia into the index, replacing Wolters Kluwer and Volkswagen preference shares. The changes took effect on 21 September 2026 and are reflected in this dataset.

For each constituent, Big4News identified the current statutory auditor or auditors, the first financial year of the current audit relationship where this could be established reliably, and the latest available audit fee.

Unlike the S&P 500, however, the EURO STOXX 50 cannot always be analysed on a simple one-company, one-auditor basis.

Several French companies appoint two statutory audit firms simultaneously. Big4News therefore records those firms separately.

That produces 65 current audit appointments across the 50 companies.

The table is interactive: click any column heading to sort the data by company, sector, auditor, tenure or audit fee.

The dataset reflects the index composition following the September 2026 review.

EURO STOXX 50 Audit Market Share

PwC holds the largest number of mandates

PwC has the strongest position in the EURO STOXX 50, with 18 of the 65 audit appointments, equivalent to 27.7%.

Deloitte follows with 15 mandates, or 23.1%.

EY holds 13, representing 20.0%, while KPMG has 11, or 16.9%.

The remaining eight mandates are held outside the Big Four:

Forvis Mazars — 6
BDO — 1
Grant Thornton — 1

Together, Deloitte, EY, KPMG and PwC account for 57 of the 65 current audit appointments, or 87.7%.

That remains an overwhelming share.

But it is noticeably below the concentration found in the large-company US market.

In the S&P 500, the Big Four audit 494 of 500 companies, or 98.8%. In the Nasdaq-100, they audit 99 of 100.

The EURO STOXX 50 therefore presents a different picture: the Big Four still dominate, but large European companies provide a more meaningful foothold for firms outside the four global networks.

Forvis Mazars has a significant position

Most of that non-Big Four presence belongs to Forvis Mazars.

The firm holds six EURO STOXX 50 statutory audit mandates.

It serves alongside PwC at Schneider Electric and Sanofi, EY at Safran, EssilorLuxottica and Danone, and Deloitte at LVMH.

Grant Thornton is joint statutory auditor of Hermès International alongside PwC.

BDO occupies an even more distinctive position: it is the sole statutory auditor of SAP.

SAP appointed BDO for FY2026.

That means SAP is the only company in the EURO STOXX 50 without a Big Four firm involved in its current statutory audit.

Across the remaining 49 companies, at least one of Deloitte, EY, KPMG or PwC is present.

The European market is therefore still highly concentrated, but its structure is different from that of the US. Non-Big Four participation is concentrated largely in joint-audit arrangements rather than in companies abandoning the Big Four altogether.

The picture changes considerably by sector

PwC’s overall lead does not translate into dominance in every industry.

Financial services is the largest sector in the dataset, with 13 companies and 15 auditor appointments.

PwC and EY each hold five financial-sector mandates, KPMG has three and Deloitte two.

Industrials account for nine companies but 13 audit appointments because several use joint auditors.

PwC, Deloitte and KPMG each hold three industrial mandates, while EY and Forvis Mazars each hold two.

Consumer discretionary contains nine companies and 12 audit appointments.

PwC leads that group with four, followed by Deloitte with three. EY and Forvis Mazars each hold two, while Grant Thornton has one through its joint-audit role at Hermès.

Information technology tells a rather different story.

There are only four technology companies in the index: ASML, SAP, Infineon Technologies and Nokia.

Deloitte audits two of them — Infineon and Nokia — while PwC audits ASML and BDO audits SAP.

The result is a much less technology-heavy audit market than the Nasdaq-100, where information technology alone accounts for 42 companies.

The sector mix therefore helps explain why the competitive pattern among audit firms differs so markedly between the two indices.

European audit relationships are generally much shorter

One of the clearest contrasts with the S&P 500 is audit tenure.

Some US audit relationships stretch back more than a century.

Nothing comparable appears in the EURO STOXX 50 dataset.

Among the appointments for which an exact starting year could be established, the oldest identified relationships date to 1999.

PwC has audited Sanofi since 1999, while Grant Thornton’s statutory audit relationship with Hermès International also dates to 1999.

Several further engagements begin in 2004: EY at TotalEnergies, Forvis Mazars at Schneider Electric, Deloitte at L’Oréal and KPMG at Saint-Gobain.

BNP Paribas has used Deloitte since 2006, while Forvis Mazars has served EssilorLuxottica since 2007.

The contrast with the United States is structural rather than accidental.

European public-interest entities are subject to mandatory auditor-rotation rules that restrict how long the same statutory audit firm can remain in place.

Europe rotates audit firms as well as audit partners

EU rules impose a maximum duration on statutory audit engagements for public-interest entities.

The standard maximum period is ten years, although national rules and the EU framework allow extensions in certain circumstances.

A competitive tender can permit a longer engagement, while a joint-audit arrangement can allow the maximum duration to extend further.

Under the EU Audit Regulation, an engagement may be extended to a maximum of 24 years where more than one statutory auditor or audit firm is appointed simultaneously and the firms produce a joint audit report.

That is an important part of the context for the EURO STOXX 50 data.

It helps explain both the prevalence of relatively recent appointments and the continued use of joint auditors among major French companies.

The system is fundamentally different from the US regime, where companies can retain the same audit firm indefinitely provided partner-rotation and other independence requirements are met.

The European model therefore places greater emphasis on changing the audit firm itself.

Santander has the largest audit fee in the dataset

Audit-fee information is less uniform across Europe than in US proxy filings, but Big4News was able to identify a reliable current figure for 26 of the 50 companies in this research pass.

Among those companies, the median disclosed audit fee is approximately €20.1 million.

Banco Santander has the largest figure in the dataset at €118.5 million (PwC).

It is followed by:

Allianz — €69.6 million (PwC)
BNP Paribas — €67.63 million (Deloitte / EY)
TotalEnergies — €46.11 million (PwC / EY)
LVMH — €35.0 million (Deloitte / Forvis Mazars)
Eni — €31.07 million (PwC)
Sanofi — €29.2 million (Forvis Mazars / PwC)
BBVA — €26.7 million (EY)
Vinci — €24.7 million (PwC / EY)
Schneider Electric — €24.57 million (PwC / Forvis Mazars)
Iberdrola — €23.55 million (KPMG)
Saint-Gobain — €22.6 million (Deloitte / KPMG)
Intesa Sanpaolo — €20.96 million (EY)

These figures need more caution than a simple league table might suggest.

European issuers do not all report audit remuneration using identical terminology or presentation.

In addition, where a company has joint auditors, the disclosed audit-fee figure may relate to the combined statutory audit rather than representing the amount received by either individual firm.

Big4News therefore does not allocate a joint-audit fee between the firms unless the underlying company disclosure itself provides that split.

The figures should be read as company-level audit costs rather than auditor-level fee revenue.

About the data

The dataset covers the 50 constituents of the EURO STOXX 50 following the September 2026 annual review, which became effective on 21 September 2026.

ENGIE and Nokia entered the index, while Wolters Kluwer and Volkswagen preference shares were removed.

Auditor identifies the current statutory or external auditor.

Where a company appoints two statutory audit firms, both are retained separately rather than forcing the company into a single-auditor classification.

This is particularly relevant for French companies, where joint statutory audits are common among large listed groups.

Since represents the first financial year for which the current firm held the statutory audit engagement, where that date could be established to the evidentiary standard used in this project.

It is not necessarily the date on which shareholders most recently approved or renewed the appointment.

Where an auditor changed for FY2026, the first year is recorded as 2026 only where the transition was supported by company or regulatory evidence.

Audit fee is the latest reliably disclosed amount attributable to audit services.

Audit-related and non-audit services are excluded where they can be separated from the statutory audit category.

For joint-audit companies, the figure may represent the combined audit remuneration paid to both statutory auditors.

No attempt is made to divide the amount between the two firms unless the issuer itself provides that information.

Fees are shown in euros.

The primary sources used include annual reports, shareholder-meeting documents, statutory auditor disclosures, regulatory filings and company investor-relations material.

Underlying data snapshot: September 2026.

Who audits the world’s largest companies?

Explore the Big4News Who Audits? hub, which maps the audit firms behind the world’s leading stock-market indices — including auditor tenure, audit fees and Big Four audit market share.

Explore the global Who Audits? series →