Key Takeaways
ASIC identified investigations into confidential-information misuse, whistleblower victimisation, and KPMG’s transparency reporting.
Separately, compulsory notices to KPMG, PwC, Deloitte and EY produced 551 complaints since 1 July 2023 about potential registered-auditor misconduct. Court said that is not 551 proven whistleblower cases.
KPMG’s FY24 and FY25 reports both state 0 whistleblower complaints related to audit quality. The central audit-leaks disclosure was made on 30 May 2024.
ASIC is also assessing KPMG-related corporate entities and whether any directors warrant further attention — a route around partnership jurisdiction.
No firm-by-firm split has been published. Until it is, 551 is a production figure, not a league table.
The parliamentary inquiry into the KPMG Australia audit-leaks scandal has already heard at length from KPMG, its former leaders, affected clients and the lawyers engaged by KPMG in connection with the whistleblower matter. On 4 September the regulator took the chair.
At its 4 September ASIC oversight hearing in Sydney, ASIC chair Sarah Court appeared alongside commissioners Alan Kirkland and Simone Constant, chief executive Scott Gregson and executive director of enforcement and compliance Chris Savundra.
And ASIC had quite a lot to report.
“I would like to update the Committee on our work regarding KPMG. We have several investigations underway at present, including into the alleged misuse of confidential client information, whistleblower victimisation concerns, and auditor transparency reports.
We are also conducting a surveillance of audit conduct complaints, including potential whistleblower complaints, received by KPMG, Deloitte, EY and PwC. We are working at pace on these matters and expect to provide an update before the end of the year.”
The fallout from the KPMG Audit Leaks scandal is clearly expanding beyond the embattled firm to also encompass the other three Big Four firms in Australia.
Court told the committee that ASIC had used its compulsory information-gathering powers to obtain the material. The regulator required the four firms to provide complaints received since 1 July 2023 relating to potential misconduct by registered company auditors, including matters such as the misuse or sharing of confidential information.
“Just to be clear … this includes whether the firms have received complaints relating to misconduct by registered company auditors, such as the misuse or sharing of confidential information.”
A total of 551 complaints
ASIC enforcement and compliance executive director Chris Savundra explained that the regulator received records relating to 551 complaints. Court said ASIC is currently examining each one individually to determine whether particular matters require further investigation, enforcement action or other regulatory activity.
So while the number is high, with Senator Barbara Pocock expressing surprise at how many complaints there had been, ASIC still needs to ascertain how many raise serious issues, how many warrant further investigation or enforcement action, and how many are whistleblower complaints at all.
We also do not know how the 551 are distributed among KPMG, PwC, Deloitte and EY. When Senator Pocock asked for a firm-by-firm breakdown, Court suggested moving off-camera so ASIC could provide further information.
Meanwhile, KPMG was reporting zero
There is another problem looming for KPMG, as the regulator told the committee in its submission that:
“ASIC is separately investigating alleged false or misleading statements in KPMG's 2025 Transparency Report, which was lodged with ASIC under the Corporations Act”
KPMG’s 2024 Transparency Report, covering the year from 1 July 2023 to 30 June 2024, reported:
0 — Whistleblower complaints related to audit quality — internal and external.
There was, however, unquestionably an active whistleblower complaint concerning conduct inside KPMG’s audit business during FY24.
The whistleblower at the centre of the audit-leaks scandal made his formal disclosure on 30 May 2024, raising concerns about the handling and use of confidential audit-client information and the conduct of senior audit personnel. Some of the underlying conduct was subsequently established. KPMG admitted that a partner had used confidential Lendlease material in a pitch for Westpac’s audit, while a later Allens investigation found that KPMG had accessed rival EY and PwC pitch documents relating to Lendlease. The scandal subsequently widened to other clients, including Optus and Telstra, and KPMG imposed sanctions on partners over misconduct connected with several of the affected audit accounts.
This very serious whistleblower report, which ultimately encompassed 38 allegations, was not acknowledged in the Transparency Report. The firm classified the disclosure as an HR issue rather than as a complaint concerning audit quality and transparency.
The following year, KPMG again reported none. Its 2025 Transparency Report states that in FY25 there were no internal complaints regarding audit quality—even as the whistleblower escalated his complaints via KPMG International’s whistleblower hotline and directly by email to the global leadership of the firm.
Importantly, the zero was not a regulator-prescribed whistleblower statistic. KPMG was required to publish a Transparency Report, but the decision to include a whistleblower metric — and to limit that metric to complaints “related to audit quality” — was KPMG’s own. Its whistleblower framework was broader, covering potentially illegal, unethical or improper conduct across the firm. The question is therefore not simply why a tax whistleblower was excluded from an audit-quality number. It is why KPMG chose such a narrowly defined whistleblower number as the measure it presented publicly.
And there was yet another whistleblower
During these years there was yet another whistleblower at KPMG, albeit in this case one could make the argument that the case was excluded from the transparency report because it related to tax and not audit.
In June 2023 the lawyer of a former senior tax manager wrote to then-chair Alison Kitchen alleging misconduct by former senior partners. KPMG subsequently reached a settlement with the former senior manager in late 2024. The Australian Financial Review reported that the payment exceeded A$500,000 and was arranged by Martin Sheppard, although KPMG has not confirmed the figure, and that it covered the whistleblower’s legal costs. The agreement included confidentiality clauses that prevented the former employee from disclosing the alleged malfeasance by the tax partners.
There is more. In a July 2021 letter from a person identifying themselves as a “concerned taxpayer,” seen in unredacted form by ABC, former KPMG partners Chris Jordan and Wayne Jones were accused of promoting arrangements called “Copper Doctor” and “Gold Doctor”, which the letter described as involving the trafficking of mining-company tax losses, alongside other agricultural and mining arrangements. The letter alleged that Jordan, who spent 26 years at KPMG before later becoming commissioner of the Australian Taxation Office, had paid “little or no income tax” during his time at the firm.
The timing of these whistleblower reports cuts across two reporting years. The former tax manager's lawyer approached KPMG in June 2023, during FY23, while the detailed whistleblower letter sent to KPMG on 30 August 2023 fell within FY24 — the year in which KPMG reported zero whistleblower complaints within its conveniently and narrowly defined category of complaints “related to audit quality”.
These games with classifications—HR issue vs audit complaint; Tax whistleblower report vs audit whistleblower report—are a clear indication of exactly how “transparent” KPMG’s Transparency Report actually is.
“If true, this shows a repetitive pattern of behaviour by KPMG to undermine and silence whistleblowers through payments and non-disclosure agreements to cover up allegations of wrongdoing,” said Greens senator Barbara Pocock of the new whistleblower claims.
“KPMG have a lot of questions to answer. How many whistleblowers have they tried to silence? How much has been spent to pay for their silence?”
Greens Senator Barbara Pocock, speaking to the Australian Financial Review
The tax allegations fell outside the audit-quality whistleblower metric KPMG had chosen to publish. That does not explain the audit disclosure in FY24, the International-channel escalation in FY25, or why a self-selected “audit quality” whistleblower KPI was the number it chose to show the public.
The investigation is now looking at directors too
Another interesting disclosure made by ASIC during the 4 September parliamentary hearing is that the regulator is now also assessing corporate entities within the KPMG group to determine whether the conduct of any directors warrants further regulatory consideration.
ASIC’s ordinary regulatory hook in this sector is the registered company auditor, not the partnership as a firm. Court has been explicit about that limitation throughout the inquiry: ASIC can investigate individual registered company auditors within a partnership, and only in relation to their conduct of an audit. Its jurisdiction over the audit firm itself is “extremely limited”. That helps explain why much of the regulatory scrutiny to date has focused on individual auditors and their fitness and propriety rather than on KPMG Australia as a partnership.
The 4 September disclosure points to another route. ASIC said it is examining corporate entities within the KPMG group because Corporations Act obligations apply to those companies. Companies sit within the Act’s corporate whistleblower regime in a way that partnerships generally do not. In effect, the corporate-entity review gives ASIC a potential avenue for examining conduct that its auditor-specific powers cannot reach at partnership level.
Project Magenta is relevant to that question because it was overseen by a KPMG board subcommittee and was followed by later findings that contradicted important parts of the firm’s earlier position on the whistleblower’s allegations. That raises a question about the quality of governance and oversight of the investigation.
This could become uncomfortable for Michael Ebeid, who was an independent director on KPMG’s board and a member of the board subcommittee that oversaw the controversial Project Magenta investigation conducted by Allens. He has since become KPMG Australia’s first independent chairman, with a salary of A$1 million per year.
ASIC has not announced any finding against Michael Ebeid or any other individual director.
From one KPMG whistleblower to 551 complaints
The KPMG scandal began with one former employee saying that the firm had failed to deal properly with what he had reported.
ASIC is now examining whether KPMG’s treatment of that whistleblower breached the law, whether its transparency reporting was accurate and whether conduct within KPMG-related corporate entities raises questions about directors’ obligations.
And, separately, it has required all four Big Four firms to turn over their audit-conduct complaint records.
The result is 551 complaints requiring assessment.
A scandal initially portrayed as an HR problem inside one firm has caused the regulator to look behind the internal reporting systems of KPMG, PwC, Deloitte and EY simultaneously.
That is a significant expansion in scale — and another reason why the debate over whether Australia’s existing system of Big Four regulation is adequate has now moved onto the government’s reform agenda.
This article is part of the Big4News Investigations & Analysis series, which examines the structural forces shaping Deloitte, PwC, EY and KPMG.
It is also part of our ongoing coverage of the KPMG Australia Audit Leak Scandal.
KPMG Australia Audit Leaks Scandal
The KPMG Australia audit-leaks scandal, which erupted publicly in March 2026, has developed from a whistleblower’s contested allegations into an established pattern of misconduct, investigative failure and governance weakness. It represents one of the most serious integrity crises to hit the Big Four in Australia since the PwC tax leaks affair.
About Claudine Cassar
I’m a corporate anthropologist and former Deloitte equity partner. I sold my technology business to Deloitte in 2016 and led the Malta Consulting team for five years. I am the founder and editor of Big4News, which provides independent, clear analysis of PwC, Deloitte, EY, and KPMG — free from corporate spin.
Find me on LinkedIn, X, Instagram, or my author website.
Feel free to reply to this newsletter — I read every reply.
“If true, this shows a repetitive pattern of behaviour by KPMG to undermine and silence whistleblowers through payments and non-disclosure agreements to cover up allegations of wrongdoing,” - this is a major problem for most of the corporate world, not limited to the Big Four in Australia. The deep dive into transparency reporting is interesting.