KPMG’S TRUST CRISIS: INSIDE THE FAILURE OF CONTROL

Rubric: Business
Format: INVESTIGATIONS
Author: Sinisa Brkic (sb)

KPMG is paid to examine controls, challenge corporate governance and protect confidence in financial reporting. In Australia, the auditor is now confronting failures inside its own walls after confidential client information was misused, internal investigations failed to establish what had happened and new whistleblowers began approaching parliament. What started as a complaint about client data has become something larger: a test of whether one of the world’s most powerful professional services firms was capable of policing itself.

The Business of Trust

KPMG does not sell an ordinary product. It sells assurance. Companies allow its auditors into some of their most sensitive financial systems. Boards provide confidential documents. Executives discuss strategy, risk and internal weaknesses. Governments hire its specialists. Investors rely on audits carrying its name when deciding whether financial statements can be trusted.

That business model depends on a simple proposition. Information entrusted to the firm must remain protected, professional boundaries must hold and the people assessing other organizations’ controls must be capable of controlling themselves. In Australia, that proposition is under extraordinary pressure. 

A scandal that emerged publicly in March 2026 has exposed confirmed misuse of confidential client information, serious failures in the handling of a whistleblower, repeated investigations that initially failed to substantiate allegations and a series of senior leadership departures. By August, a parliamentary inquiry was hearing that more whistleblowers had come forward with accounts of similar conduct. The crisis is no longer about whether one document was improperly viewed or one employee made a bad decision. It is about the architecture of trust inside KPMG itself.

The Warning Came From Inside

The affair originated with allegations raised by a KPMG whistleblower who said confidential client information had been improperly used in pursuit of new audit business.

Among the most serious allegations were claims involving Lendlease, one of Australia’s major property groups. Confidential board material was alleged to have been accessed and used by KPMG personnel while preparing bids for audit work at other companies, including Westpac and property group Dexus.

The significance was obvious. An auditor can gain access to information that competitors would never ordinarily see. If material obtained through one client relationship is then used to improve the firm’s position when pitching to another company, confidentiality ceases to be merely an internal policy issue. It becomes a question about the integrity of the professional relationship itself. KPMG initially said the central whistleblower allegations had not been substantiated. That position did not survive.

KPMG Investigated KPMG

The first internal investigation did not substantiate the allegations. The whistleblower continued raising concerns, and an external legal review was subsequently commissioned. That review supported the initial conclusions. For KPMG, the matter might have ended there. The firm had investigated. External lawyers had reviewed the investigation. The allegations remained unsubstantiated. Instead, the process became part of the scandal.

In May 2026, KPMG publicly acknowledged that its handling of the whistleblower and its investigation had fallen below the standards expected by the firm, the whistleblower and the broader community. It conceded that the original internal investigation had not been conducted with the necessary rigor. A further external investigation was launched with an expanded scope and new evidence.

This is where the case acquires its most damaging institutional dimension. A professional services firm whose business includes testing whether other organizations investigate problems properly had failed to establish the full facts inside its own organization. The control failure was no longer limited to the alleged conduct. It had spread to the response.

The Evidence That Changed the Story

As parliamentary scrutiny intensified, evidence emerged that made the earlier conclusions increasingly difficult to defend. At an August hearing, former KPMG audit partner Eileen Hoggett was questioned about confidential Lendlease documents that had been kept in her locker. An email from May 2023, presented to the committee, showed her authorizing a colleague to view printed material in that locker while work was being prepared for another proposal.

Hoggett told the committee she did not remember storing the documents and expressed regret over the episode. Her account became one of several moments in which parliament confronted former senior personnel with records that appeared more precise than their recollection of events. The inquiry also heard that people involved in internal inquiries had themselves been given misleading information by KPMG personnel. That matters enormously.

An investigation can fail because evidence is incomplete. It can fail because the scope is too narrow or because investigators make poor judgments. But if individuals inside an organization provide inaccurate or misleading accounts to those trying to determine what happened, the weakness becomes deeper. Controls exist. People still have to respect them.

Optus Made the Problem Larger

The controversy widened beyond Lendlease when KPMG acknowledged inappropriate sharing of confidential information relating to telecommunications company Optus. Sensitive Optus information was shared with another team inside KPMG that was pursuing audit work involving rival Telstra. KPMG acknowledged that the handling of the material breached the confidentiality owed to its client. This shifted the affair.

The firm was no longer confronting only disputed allegations concerning one client and one audit pursuit. A separate case involving another major corporate client had demonstrated that confidential information had crossed internal boundaries where it should not have gone. Optus responded with unusual force. Its chairman described KPMG’s conduct before the parliamentary inquiry as a serious breach of professional obligations and made clear that commercial ambitions could not come before those duties. That reaction goes to the center of the crisis. Clients hire an audit firm precisely because certain boundaries are supposed to be absolute.

The Wall That Clients Thought Existed

Large professional services firms operate multiple businesses under one organizational umbrella. Audit teams examine companies while consultants, tax specialists, deal advisers and other professionals pursue work across the same corporate landscape. That structure creates enormous commercial advantages. It also creates enormous informational tension.

The industry’s answer has traditionally been controls. Confidential information is supposed to be restricted. Ethical barriers are designed to prevent material obtained in one engagement from being improperly used elsewhere. Conflict systems, access restrictions, professional standards and internal governance are meant to ensure that the size of the firm does not become a mechanism for transferring privileged information across competing teams. The KPMG scandal has exposed what happens when those barriers fail in practice. It is not enough for a firm to maintain a confidentiality policy. The real test is whether a partner under commercial pressure believes the boundary cannot be crossed.

A Whistleblower Became the Control System

One of the most uncomfortable features of the affair is how much depended on a person inside the organization refusing to let the matter disappear. The whistleblower had raised concerns well before the scandal became public. Those concerns went through internal processes and external review without producing the conclusions that later developments forced KPMG to confront. Only after the allegations entered parliament did the affair become a major public crisis. That sequence raises an obvious question. If the whistleblower had stopped pushing, what would KPMG’s clients have known?

Several companies appearing before the parliamentary inquiry made clear how important the disclosures had been. Major clients expressed frustration over the timing and quality of the information they received as the scandal unfolded. The uncomfortable implication is that formal control systems did not reveal the problem. A whistleblower did.

When the Firm’s Own Investigations Become Evidence

KPMG’s response has now produced a fourth investigation. That number alone does not prove misconduct on a broader scale. Complex allegations can require multiple inquiries, particularly as new evidence emerges. But repeated investigations matter when earlier processes gave reassurance that later proved inadequate. A firm can survive an employee breaking a rule. It can discipline the individual, repair the control and demonstrate that the system identified the breach. The consequences are more serious when the system repeatedly fails to understand the breach itself.

KPMG’s new chief executive, John Sams, acknowledged the gravity of that problem before parliament. He rejected the idea that the affair could simply be reduced to a handful of bad individuals and said the firm’s culture itself had to be examined. That admission may prove more important than any individual departure. If the problem is cultural, the solution cannot be a personnel list.

The Leadership Fallout

The consequences have already reached the top of KPMG Australia. Former chief executive Andrew Yates left his position as the scandal intensified. Audit leader Julian McPherson also departed, while Martin Sheppard stepped down after serving as chairman of both KPMG Australia and the firm’s Asia Pacific organization. Other senior figures have also left or faced disciplinary consequences.

KPMG has since installed new leadership, including CEO John Sams and independent chairman Michael Ebeid, and has announced a program of governance and control reforms intended to rebuild confidence. Leadership changes create visible accountability. They do not automatically create institutional repair.

The challenge for the new leadership is not simply to demonstrate that different people now occupy the offices. It is to prove that the incentives, controls and internal behavior that produced the crisis have changed with them.

Then More Whistleblowers Appeared

At the parliamentary hearing in Canberra on August 14, committee chair Deborah O’Neill said additional people were approaching the inquiry with reports of misconduct and accounts of repeated behavior. That development may ultimately be more consequential than the original allegations.

A single whistleblower can be dismissed as mistaken, disgruntled or isolated. Multiple whistleblowers describing comparable concerns force an organization to confront the possibility that a problem extends beyond one dispute. It remains important not to treat every new allegation as established fact. The additional claims must be investigated individually and fairly. But their emergence changes the risk profile. The question facing KPMG is no longer merely what happened in the cases already identified. It is whether the known cases represent the boundaries of the problem.

Another Whistleblower Had Already Been Paid

The August hearing produced another uncomfortable disclosure. Former chairman Martin Sheppard confirmed that a separate whistleblower who had raised allegations involving KPMG’s tax division received a settlement in late 2024.

A settlement does not establish the truth of every allegation raised in the underlying dispute. Companies settle matters for many reasons, including avoiding prolonged litigation and resolving employment conflicts. But in the context of the current scandal, the disclosure adds another layer to the debate about how KPMG dealt with internal critics and concerns. Professional firms depend on people being willing to challenge senior colleagues when standards are breached. If employees believe speaking up threatens their careers, the organization’s most important warning system becomes weaker.

A whistleblower policy on paper is not enough. Employees have to believe it.

Westpac Found Itself Inside the Story

The scandal also reached one of Australia’s largest banks. KPMG had won Westpac’s audit mandate after a competitive tender. The parliamentary inquiry has examined allegations that confidential Lendlease material was used during preparations associated with that pursuit.

Personal relationships added another dimension. Peter Nash, a Westpac director involved in the broader audit governance environment and a former KPMG Australia chairman, had longstanding ties to senior people at the firm. Parliament heard that he had stayed at former KPMG chairman Martin Sheppard’s home during the period surrounding the audit pitching process. Westpac has said relevant relationships were disclosed and governance procedures were followed. The existence of relationships does not by itself establish improper conduct.

But audit independence is built not merely around actual conflicts. Perception matters too.

The Client Reaction Is Becoming a Business Problem

For KPMG, the crisis is no longer confined to parliamentary hearings and internal governance. Clients are making decisions.

Lendlease ended a relationship with KPMG that had stretched across decades. Macquarie has sought evidence concerning the integrity of the process through which KPMG was selected as its auditor and has indicated that the appointment could be reconsidered. Westpac has demanded answers, while Optus has publicly condemned the misuse of its information. These reactions transform an ethics scandal into a commercial threat. Trust in professional services is difficult to quantify on a balance sheet. Its loss becomes visible when clients start asking whether information is safe, whether audit teams are independent and whether the firm can credibly investigate its own people.

Once those questions reach the boardroom, the problem has already moved beyond reputation management.

KPMG Is Now Rebuilding the Controls

The firm has announced a substantial action plan. Measures include strengthening its system of quality management, changing procedures governing the pursuit of audit engagements, reinforcing ethical barriers and requiring additional training on confidentiality, privacy and information protection. KPMG has also acknowledged shortcomings relating to the use of confidential client information, the integrity and objectivity of senior personnel, its treatment of the whistleblower and its oversight of the entire affair.

These are not cosmetic admissions. They amount to recognition that several components of the firm’s internal governance required repair at the same time. The question now is whether reforms designed after a scandal can change behavior established before it. Training can explain rules. Governance can allocate responsibility. Technology can restrict access. None of those measures can substitute for a culture in which partners understand that some commercial advantages must simply remain unavailable.

ASIC Is Investigating

Australia’s corporate regulator has also entered the affair. ASIC opened an investigation concerning KPMG partners and alleged misuse of client information. That development matters because the scandal is no longer being judged solely by the firm, its lawyers or parliament.

External regulatory scrutiny introduces a different standard. It also exposes an unusual feature of the professional services sector. Major accounting firms exercise enormous influence across financial markets while their partnership structures do not always fit neatly within regulatory frameworks designed for conventional corporations. The controversy has therefore revived a question Australia was already confronting after the PwC tax scandal. Are the institutions auditing corporate Australia themselves subject to enough independent oversight?

Australia Has Seen This Movie Before

The timing is particularly damaging because KPMG is not the first Big Four firm in Australia to trigger a national debate about confidential information. PwC became engulfed in scandal after confidential Australian government tax policy information was improperly used within the firm’s international business network. The details differ substantially from the KPMG affair. They should not be collapsed into one allegation or treated as equivalent misconduct. But the structural similarity is difficult to ignore.

Large professional services firms are paid because they possess expertise, privileged access and trusted relationships. Those same characteristics create commercial value that can become dangerous when internal boundaries fail.

Australia has now confronted major confidentiality controversies involving two members of the Big Four within only a few years. At some point, the debate stops being about individual firms. It becomes a debate about the model.

The Big Four Problem

Deloitte, EY, KPMG and PwC occupy an extraordinary position in modern capitalism. They audit some of the world’s largest corporations while simultaneously operating extensive businesses in consulting, tax, technology, transactions, risk, government work and strategic advice. Their employees can possess an extraordinary concentration of information about companies, industries and public institutions. Scale makes them useful. Scale also makes boundaries harder to police. An audit practice must remain independent. A consulting practice wants growth. Partners want clients. Teams compete for mandates. Former partners move onto corporate boards. Clients become employers. Employees cross between audit and advisory roles. None of this is inherently improper. But the architecture produces incentives that regulation and professional ethics are expected to contain. KPMG’s crisis asks what happens when they do not.

Canberra Is Considering Structural Answers

The Australian government is now examining reforms to the regulation of accounting, auditing and consulting firms. A Treasury options paper released in June considers measures aimed at strengthening audit quality, ethical standards, independence, regulatory surveillance and penalties. Among the ideas under discussion are restrictions on firms providing audit and non audit services to the same client and more radical forms of structural separation. A stronger model could force audit businesses and non audit businesses into genuinely separate entities.

The government is also examining the unusual scale permitted within professional accounting partnerships and whether existing regulatory arrangements remain appropriate for organizations of this size. KPMG has opposed some of the most interventionist options, including structural separation. Its argument deserves serious consideration. Breaking apart firms could create costs, reduce access to specialist expertise and alter competition in ways that produce unintended consequences. But after PwC and now KPMG, defending the status quo has become harder.

The Conflict Inside the Business Model

The core issue is not that auditors should never sell other services. It is that the economics of professional services can create a permanent tension between professional restraint and commercial opportunity. An auditor is expected to be skeptical. A sales organization is expected to win. An auditor protects confidential information. A business development team searches for insight. An auditor’s first obligation is professional integrity. A partnership also rewards revenue. Well governed firms are designed to keep those imperatives from corrupting one another. When they collide, policy manuals become less important than culture.

Who Audits the Auditor?

There is a fundamental asymmetry at the center of the industry.

When a listed company has weak controls, its auditor may identify the weakness. When financial statements contain material errors, auditors are expected to challenge management. When governance fails, boards, investors and regulators can demand explanations.

But when an audit firm itself develops a serious control problem, much of the early response happens behind closed doors. Partners investigate partners. Boards appointed within the organization oversee management. External lawyers are hired by the institution facing the allegations. Global networks can point to the legal independence of local member firms. Eventually regulators and parliament may intervene, but often only after the issue has already escaped the organization’s own systems. That structure makes whistleblowers disproportionately important.

The person with the least institutional power can become the mechanism through which the most powerful institution is finally examined.

This Is Why the Failed Investigations Matter Most

It would be easy to identify the misuse of confidential client material as the defining feature of KPMG’s scandal. It may not be. The more consequential failure could be what happened after concerns were raised. An organization can never guarantee that no employee will violate a rule. The real measure of control is what happens when someone reports that the rule may have been broken. Does the organization investigate aggressively? Does it protect the person raising the concern? Does it challenge senior people with the same skepticism it applies to junior employees? Does it tell affected clients quickly? Does it want to know the answer even when the answer is commercially painful? That is where KPMG’s credibility was tested. By its own admission, parts of the response failed.

Trust Cannot Be Audited Back Into Existence

KPMG Australia now has new leadership, new investigations, new policies and a detailed reform program. All may be necessary. None is sufficient on its own. A professional services firm can rewrite procedures within weeks. It can change reporting lines, commission reviews and require thousands of employees to complete new training. Trust returns more slowly.

Clients will judge KPMG not by the elegance of its action plan but by what happens the next time a partner encounters confidential information that could help win business. Employees will judge the firm’s whistleblower reforms by what happens to the next person who challenges someone powerful. Regulators will judge the governance overhaul by whether they need parliament to expose the next failure.

The Crisis Has Escaped KPMG

This is now bigger than one Australian partnership. The audit industry exists because modern markets cannot function on corporate self certification alone. Investors need independent assurance. Boards need external challenge. Regulators need credible financial reporting. The entire structure assumes that auditors occupy a position of unusual professional discipline.

That is why scandals inside audit firms carry a different weight. A retailer can survive a product failure. A technology company can survive an outage. An auditor whose central product is trust faces a more fundamental problem when its own systems fail to protect confidential information and its own investigations fail to establish what happened. The product itself comes into question.

Inside the Failure of Control

KPMG’s Australian crisis began with information that should not have moved. It deepened because warnings were not handled properly. It became a national scandal because the mechanisms designed to establish the truth did not establish it soon enough. Now parliament, regulators, clients, new executives and additional whistleblowers are doing what KPMG’s own systems were supposed to do from the beginning: determine how far the failure went and whether it was exceptional or structural. That answer remains unfinished. But one conclusion is already difficult to avoid. For an audit firm, control is not a department, a policy manual or a compliance presentation. It is the basis on which every client hands over information, every board accepts professional judgment and every investor places weight on an audit opinion.

KPMG has spent decades examining whether other organizations deserve that confidence. Australia is now asking the same question of KPMG.