KPMG Australia was paid to advise organisations on ethics, leadership and the importance of speaking up. It operated whistleblower reporting services for some of Australia’s most prominent institutions, including the Reserve Bank of Australia and National Australia Bank.
Yet within KPMG itself, a whistleblower who raised concerns about the misuse of confidential client information encountered a prolonged and deeply flawed response. Independent reviews subsequently identified weaknesses in governance and accountability, perceptions that financial performance was prioritised over ethical considerations, and concerns about the professional risks of challenging senior colleagues.
On 27 October, evidence given at a Senate estimates hearing revealed that the Australian Public Service Commission had terminated an A$1.27 million ethics and leadership training contract with KPMG three months earlier, in July.
The disclosure followed months of parliamentary scrutiny, revelations concerning the misuse of confidential client information and senior leadership departures. On 22 October, the Commonwealth had also extended KPMG’s exclusion from new government engagements until 28 February 2027, following an independent review of the firm’s governance, culture and ethical practices.
How could a firm with extensive expertise in ethics, governance and whistleblower protection fail to apply those principles when confronted with allegations of misconduct involving its own senior personnel?
KPMG Australia’s internal culture
What the independent ethics review found
In October 2026, Principia Advisory published its Ethical Culture Review, an independent examination of the relationship between KPMG’s stated values and its internal culture. The review drew on interviews with almost 500 partners and employees, survey responses from nearly 3,400 staff, an examination of 176 documents and a review of 14 whistleblower hotline cases.
Principia examined the broader organisational conditions that could allow ethical failures to occur and persist. It identified a “say-do gap” between KPMG’s stated values and the behaviour of some of its leaders.
Its findings pointed to inconsistent accountability, leadership appointments that employees perceived as incompatible with the firm’s values, and ethical controls that did not always operate as intended.
“The evidence therefore points not simply to the actions of individual leaders, but to structural conditions that allowed departures from the firm’s values and expectations to persist.”
— Principia Advisory, Ethical Culture Review, p. 4
The review also identified structural governance weaknesses. Power was concentrated among a “tightly connected group”, undermining independent oversight and making it harder to hold senior leaders accountable.
Employees’ willingness to challenge decisions depended heavily on their relationships with individual partners and managers. Outside those trusted relationships, particularly when senior colleagues were involved, speaking up could become more difficult.
“There is a widespread perception that speak-up and challenge carries meaningful professional risk”
— Principia Advisory, Ethical Culture Review, p. 7
Principia also found recurring perceptions that financial performance was the top priority in the firm. Some employees reported greater difficulty raising ethical concerns when commercially important clients or revenue were at stake.
“there is a widespread perception that financial metrics carry substantially greater weight in practice”
— Principia Advisory, Ethical Culture Review, p. 7
The review did not conclude that KPMG’s ethical culture was universally poor. It identified substantial commitment to ethical behaviour among KPMG personnel and examples of teams in which employees felt supported in challenging decisions.
Its central concern was that these positive conditions were inconsistent across the firm, while governance and leadership weaknesses had allowed problematic behaviour to persist.
This was not Principia’s first examination of KPMG’s ethical culture. The consultancy had previously worked with the firm following its examination-cheating scandal. The recurrence of concerns about leadership, accountability and ethical behaviour raises questions about how effectively the lessons of earlier reviews had been implemented.
Teaching ethics to the Australian public service
The Australian Public Service Commission had engaged KPMG under a contract valued at A$1.27 million to provide leadership and ethics training for approximately 300 senior public servants.
The agreement was due to run until December 2026, with an option to extend it for a further two years.
In June, Greens senator Barbara Pocock questioned the appropriateness of the arrangement, given the allegations concerning KPMG’s handling of confidential client information and its treatment of a whistleblower.
On 29 June, Finance Minister Katy Gallagher responded in the Senate that ministers had no authority to unilaterally cancel existing government procurement contracts. The government’s agreement with KPMG to suspend bidding for new Commonwealth work did not automatically terminate existing engagements.
The Australian Public Service Commission nevertheless terminated the contract in July, approximately five months before its scheduled expiry in December.
The decision came to wider public attention on 27 October, when APSC Deputy Commissioner Subho Banerjee confirmed the July termination at a Senate estimates hearing. The hearing established that the cancellation had occurred months earlier, rather than being a new decision taken in October.
Banerjee explained that the decision reflected the broader circumstances surrounding KPMG, as well as the firm’s proposal to replace personnel originally nominated to deliver the training. The commission would instead complete the training internally.
The consequences extend to audit clients
The repercussions have also reached KPMG’s core audit business.
On 29 October 2026, Australian Ethical Investment announced that it would exclude KPMG from its next external audit tender, explicitly citing continuing scrutiny of the firm’s audit practice, including matters raised before a parliamentary committee.
KPMG had audited Australian Ethical since 2013. Although the investment manager acknowledged KPMG’s efforts to improve its governance and ethical controls, it confirmed that the firm would not be invited to compete for the FY2028 appointment.
How KPMG Australia failed its whistleblower
The whistleblower first raised concerns in May 2024 about alleged misconduct involving confidential client information and major audit tenders.
KPMG initially treated much of the matter through employment and grievance processes. Its investigations failed to examine the underlying allegations with sufficient rigour, while the whistleblower’s treatment became a significant issue in its own right.
In May 2026, KPMG acknowledged that its response had fallen short, apologised to the whistleblower and announced leadership departures.
Another independent review…
In September 2026, KPMG published the findings of an independent Andrews Group review examining how it had handled the employee’s disclosures. The review concentrated on the firm’s response to the whistleblower, rather than determining the truth of the original misconduct allegations.
“This review is based on one simple premise: KPMG Australia failed to protect the whistleblower.”
— Andrews Group, Lessons Learned Review into Handling of Whistleblower Disclosure, p. 1, September 2026
Andrews Group identified seven strongly evidence-supported hypotheses for that failure, with three standing out as the principal causes: an overly legalistic approach, inadequate whistleblower procedures and poorly managed conflicts of interest.
Rather than approaching the allegations primarily as questions of ethics and professional standards, KPMG focused on their legal implications. Andrews Group drew a distinction between complying with the law and meeting the higher ethical obligations expected of a professional services firm.
The review suggested that the firm’s response had been guided more by legal considerations than by the values and principles it professed to uphold.
Although KPMG had a formal whistleblower programme, Andrews Group identified shortcomings in its operational procedures, specialist capability and dedicated resources.
The problem was compounded by the seniority of the individuals implicated in the allegations. Andrews Group identified conflicts of interest that had not been adequately managed, yet no specific conflict-management plan had been prepared.
The review also concluded that KPMG had placed excessive emphasis on the whistleblower’s personal workplace grievances, while downplaying allegations of wider misconduct. It suggested that assumptions about the employee’s motivations contributed to the failure to treat the disclosures with sufficient seriousness.
Perhaps the most damaging criticism concerned the way KPMG assessed risk. Andrews Group advanced the hypothesis that the firm had concentrated on the risks posed to the organisation by the whistleblower and their allegations, while failing to give adequate consideration to the risks facing the whistleblower, including the possibility of identification or retaliation.
“KPMG Australia viewed the whistleblower, and the content of their disclosures as a risk to the organisation.”
— Andrews Group, p. 11
Andrews Group also identified inadequate ongoing support. Although some individuals within KPMG had made genuine efforts to protect the whistleblower, the overall response was undermined by conflicts of interest and an approach the reviewers considered insufficiently focused on the individual’s wellbeing.
“the ongoing support, rather than being human centred, appeared to be adversarial”
— Andrews Group, p. 12
The review made six recommendations, including the appointment of a dedicated Whistleblower Protection Officer, the creation of an independent internal Integrity Office and improvements to the whistleblower programme. KPMG accepted all six.
The concerns were not confined to KPMG’s commissioned reviews. A separate government-commissioned examination by Dr Ian Watt, published in October, found that KPMG’s whistleblower and governance arrangements had failed to operate effectively in practice. It described a fragmented response, inadequate ownership of emerging risks and failures to bring warning signs together for timely consideration.
The firm selling whistleblower protection
In another ironic twist, KPMG offers external whistleblower reporting services to clients.
Through FairCall, KPMG operated external reporting channels for major institutions, including the Reserve Bank of Australia and National Australia Bank. The service allowed employees and other eligible individuals to report suspected misconduct, including anonymously, through a channel operated outside their employer.
On 4 June 2026, Greens senator Barbara Pocock questioned Reserve Bank governor Michele Bullock during Senate estimates about the bank’s continuing relationship with KPMG, including its whistleblower hotline.
Bullock confirmed that the Reserve Bank used KPMG’s FairCall service but indicated that the contract was unlikely to be renewed.
“I don’t think we’ll be reappointing them to the whistleblower service. We are re-tendering for that.”
— Michele Bullock, Governor of the Reserve Bank of Australia, Senate estimates, 4 June 2026
The contract was worth approximately A$10,000 a year. Its financial value was relatively modest, but the decision carried greater reputational significance: Australia’s central bank was reconsidering its relationship with KPMG as a provider of whistleblower reporting services after the firm acknowledged serious failures in handling its own whistleblower.
The fallout extended beyond the Reserve Bank.
By 12 June, Newcastle Greater Mutual Group and Police Bank had confirmed they were reviewing their FairCall arrangements. Western Sydney International Airport indicated it could take similar action, Vodafone was seeking assurances from KPMG, and Marinus Link was monitoring developments.
Senator Pocock also called for KPMG to be prevented from providing whistleblower hotline services while the investigation into its conduct continued.
A further development emerged in August, when correspondence released by the Reserve Bank under freedom of information laws revealed that KPMG had already informed the bank on 2 June that it would not renew FairCall services for external audit clients.
KPMG cited independence concerns arising from revised Australian auditing standard ASA 240, which requires auditors to assess aspects of clients’ whistleblowing arrangements. The firm considered that operating those arrangements while auditing their effectiveness would create a conflict of interest.
The revised standard, issued in October 2025, applies to financial reporting periods beginning on or after 15 December 2026. KPMG said it could continue providing FairCall until the Reserve Bank’s existing contract expired on 31 December, but could not renew the arrangement. It intended to continue offering the service to non-audit clients.
The correspondence established that KPMG’s notification preceded Bullock’s parliamentary comments. It did not establish whether KPMG’s decision was influenced by the mounting controversy surrounding its whistleblower scandal, and the firm attributed its withdrawal from audit-client services to the revised auditing requirements.
The real test of ethical expertise
KPMG’s experience illustrates the difference between possessing sophisticated ethical frameworks and ensuring those frameworks operate when senior management’s own interests are at stake.
Principia’s executive summary captured the significance of the gap between stated values and actual behaviour:
“This gap between what the firm said and what it did shifted behavioural incentives and created a strong signal as to what is expected and valued.”
— Principia Advisory, Ethical Culture Review, p. 4
For clients purchasing ethics, governance and whistleblower services, the question is not simply whether an advisory firm can design effective policies. It is whether that firm can demonstrate that its own leaders are held to those same standards when doing so is commercially or reputationally uncomfortable.
This is part of Big4News’ continuing coverage of the KPMG Australia Audit Leak Scandal.
KPMG Australia Audit Leaks Scandal
The KPMG Australia audit-leaks scandal, which erupted publicly in March 2026, has developed from a whistleblower’s contested allegations into an established pattern of misconduct, investigative failure and governance weakness. It represents one of the most serious integrity crises to hit the Big Four in Australia since the PwC tax leaks affair.
About Claudine Cassar
I’m a corporate anthropologist and former Deloitte equity partner. I sold my technology business to Deloitte in 2016 and led the Malta Consulting team for five years. I am the founder and editor of Big4News, which provides independent, clear analysis of PwC, Deloitte, EY, and KPMG — free from corporate spin.
Find me on LinkedIn, X, Instagram, or my author website.
Feel free to reply to this newsletter — I read every reply.
"The evidence therefore points not simply to the actions of individual leaders, but to structural conditions that allowed departures from the firm’s values and expectations to persist." We keep coming back to structural conditions as necessary to the successful discharge of not only ethics, but also risk and compliance responsibilities.