What the KPMG Australia scandal reveals about leadership, culture and corporate accountability

A whistleblower complaint that began inside KPMG Australia has since become one of the country's biggest corporate governance crises.

Over two years, allegations over the misuse of confidential client information evolved into wider concerns about whistleblower protection, leadership accountability, internal investigations and governance within one of Australia's largest professional services firms.

The fallout has reached far beyond KPMG, drawing in regulators, Parliament, government departments, major clients and KPMG International. It has prompted leadership resignations, regulatory investigations, client scrutiny and renewed calls for reform across Australia's accounting profession.

For business and HR leaders, the story is about more than one firm's failings. It is a case study in how governance lapses, mishandled whistleblower complaints and weak organisational oversight can quickly escalate into a crisis of trust.

The origins of the scandal stretch back to 2023.

In June and August that year, KPMG partners accessed confidential Lendlease board documents containing sensitive information about audit proposals submitted by rival firms EY and PwC. Those documents later became part of KPMG's preparation for its bid to secure Westpac's external audit.

The issue escalated further on 10 October 2023, when seven members of KPMG's audit business met to prepare partner Kim Lawry for the Westpac audit tender. During the meeting, confidential material was extracted from Lendlease board papers that included assessments of rival bids which were displayed.

Less than a month later, another incident emerged.

During KPMG's pursuit of Dexus external audit in November 2023, partner Jeff O'Sullivan allegedly remarked that he would leave his laptop open while at lunch so colleagues could view confidential Dexus internal audit material. 

KPMG later maintained the comment had been intended as a joke and said it found no evidence that the information had been accessed or shared. However, O'Sullivan was sanctioned for making what the firm described as an inappropriate remark.

At the same time, KPMG's pursuit of the Westpac audit was attracting separate questions over conflicts of interest.

Peter Nash, then chair of Westpac's audit committee and a former national chairman of KPMG Australia, attended audit pitch meetings during the tender process. KPMG chairman Martin Sheppard later confirmed that Nash was not there while the tender was underway. 

Although Westpac maintained Nash had disclosed his KPMG connections and was not involved in selecting the successful bidder, the bank later acknowledged that the relationships created an appearance of bias.

Despite those concerns, KPMG secured Westpac's audit in March 2024.

Only weeks after winning the mandate, the matter took a different turn.

On 30 May 2024, a KPMG audit director lodged a formal protected disclosure alleging the misuse of confidential client information and raising broader concerns about conduct within the firm.

Rather than marking the beginning of an extensive investigation, the disclosure soon became entwined with an employment dispute.

On the very day the complaint was submitted, then head of audit Julian McPherson authorised a search of the whistleblower's work laptop. He later told a parliamentary inquiry that the firm feared confidential information could be shared externally while the employee considered other career opportunities.

According to the whistleblower, the firm's response intensified over the following months.

In July 2024, he alleged KPMG informed him that he would need to relocate or face termination, only weeks after making the protected disclosure. He has consistently argued that the organisation treated the complaint as a workplace issue rather than a whistleblower matter.

Further covert searches of the whistleblower's laptop followed in November 2024. During those searches, IT staff located documents outlining additional allegations concerning the misuse of confidential client information. Copies of the material were distributed to then chief executive Andrew Yates and senior leaders across audit and human resources.

In November 2024, the firm secured Dexus as an audit client despite the unresolved allegations relating to its pursuit of the engagement.

As concerns deepened, attention shifted from the allegations themselves to the way KPMG investigated them.

In January 2025, the firm engaged law firm Ashurst in relation to an employment matter connected with the whistleblower.

KPMG later cited Ashurst's work as evidence that the allegations had been externally reviewed. However, Ashurst would eventually tell Parliament that it had never been asked to investigate the substance of the whistleblower's claims and had not conducted such an inquiry.

By March 2025, the whistleblower had escalated the matter beyond Australia.

In May, he [whistleblower] wrote directly to KPMG International chair Bill Thomas and global general counsel Anne Collins seeking intervention. Global leadership declined to launch its own investigation and instead referred the matter back to the Australian partnership.

Ashurst subsequently carried out two reviews between June and August 2025 examining KPMG's handling of the whistleblower.

Although those reviews did not investigate the underlying allegations, one concluded there was "some risk" that KPMG's use of confidential Lendlease board papers during the Westpac pursuit may have breached contractual obligations owed to its client.

Despite that finding, KPMG later relied on Ashurst's work to argue publicly and internally that the allegations could not be substantiated.

Around the same time, KPMG's own employee relations conduct panel reached a different conclusion.

The panel found sufficient grounds to sanction senior partners Eileen Hoggett, Kim Lawry and Paul Rogers over their handling of confidential Lendlease material and recommended financial penalties.

Those sanctions, however, did not proceed immediately.

Evidence later presented to Parliament showed then chief executive Andrew Yates opposed the proposed penalties, delaying disciplinary action for several months.

In August 2025, the whistleblower submitted detailed correspondence identifying additional incidents involving confidential client information and naming individuals allegedly involved.

Soon afterwards, KPMG commissioned law firm Allens to conduct another review.

Known internally as Project Magenta, the investigation operated under the oversight of a KPMG board subcommittee.

When Allens delivered its report in December 2025, it concluded that the whistleblower's allegations were either unsubstantiated or lacked sufficient evidence.

Yet the investigation itself would later become one of the most controversial aspects of the scandal.

The review relied primarily on interviews with senior KPMG partners. It did not interview the whistleblower, junior employees, affected clients, competing audit firms or other key external witnesses. Nor did it undertake a comprehensive examination of emails or digital records.

Despite those limitations, KPMG relied heavily on Project Magenta to dismiss the allegations internally and publicly.

That position would not survive long.

The controversy moved into the national spotlight on 24 March 2026.

Using parliamentary privilege, Senator Deborah O'Neill publicly disclosed the whistleblower's allegations, transforming what had largely remained an internal corporate dispute into a matter of national scrutiny.

The following day, independent KPMG director Michael Ebeid circulated an email to fellow directors dismissing many of the allegations as "completely false" and describing O'Neill's actions as "very inappropriate and unfair". The email would not become public until July, when it added fresh questions about how seriously the firm's leadership had initially treated the claims.

Regulatory attention quickly followed.

In April 2026, ASIC began preliminary inquiries into the conduct of three registered company auditors linked to the allegations.

KPMG also imposed financial sanctions on Eileen Hoggett, Kim Lawry and Paul Rogers over their handling of confidential Lendlease information. The penalties came months after the firm's own conduct panel had first recommended disciplinary action. 

Evidence later revealed that the sanctions imposed on Hoggett and Lawry had been reduced from the amounts originally proposed.

Later that month, KPMG submitted documents to Parliament and regulators summarising its findings. Those submissions largely relied on Project Magenta and continued to portray the whistleblower's allegations as unsupported, while devoting considerable attention to the employee's performance and proposed relocation. 

Critics later argued the submissions failed to present a complete picture of misconduct already identified inside the firm.

The firm's position began to shift in May.

On 14 May 2026, KPMG admitted that a senior audit partner had improperly accessed and displayed two confidential Lendlease board documents while pursuing Westpac's audit contract. Although the firm argued the documents were of "low sensitivity" and provided "zero competitive advantage", Lendlease described the conduct as unacceptable.

The admissions did not stop there.

Senior officials from the Department of Finance confronted KPMG over its failure to notify the Commonwealth of the allegations under new significant-event disclosure requirements. What had been scheduled as a routine meeting instead became a formal examination of the firm's governance, with officials warning that possible consequences ranged from heightened monitoring to restrictions on future government work.

Around the same time, KPMG confirmed it had sanctioned Jeff O'Sullivan over his remarks during the Dexus audit pursuit. While the firm maintained the comments had been made in jest and found no evidence confidential information had been shared, the adequacy of its investigation later came under scrutiny because several key witnesses were never interviewed.

On 29 May, KPMG publicly acknowledged that both its treatment of the whistleblower and the rigour of its internal investigations had "fallen short". The firm issued a public apology.

The consequences were immediate.

Chief executive Andrew Yates resigned alongside national managing partner of audit Julian McPherson. Stan Stavros was appointed interim chief executive while the search for permanent leadership began.

The same day, Parliament announced a public inquiry into KPMG's handling of the allegations, summoning senior executives, independent directors, regulators, clients and external legal advisers to give evidence.

KPMG sought to have parts of the parliamentary examination conducted behind closed doors and asserted legal professional privilege over internal investigation documents requested by both Parliament and ASIC. The decision attracted criticism from lawmakers, who argued the firm was relying on confidentiality to shield itself from scrutiny.

Meanwhile, independent directors reportedly demanded another investigation after receiving additional information that exposed shortcomings in earlier reviews.

Government agencies also began reassessing their relationships with the firm.

The Victorian Government reviewed approximately $24 million worth of contracts, while the Commonwealth placed more than $270 million in KPMG engagements under enhanced oversight after classifying the matter as a significant event.

Regulators widened their focus as well.

ASIC formally investigated registered company auditors Eileen Hoggett and Paul Rogers while continuing inquiries into other individuals linked to the allegations.

Client confidence also began to weaken.

Dexus confirmed Hoggett would not sign its 2026 accounts. Rest sought additional assurances from KPMG, while the Reserve Bank of Australia indicated it did not expect to renew the firm's whistleblower service contract.

Reports also emerged that partners were considering leaving KPMG amid growing concerns over client relationships, partner capital and the firm's financial position.

The defining moment arrived on 19 June 2026.

Over an 11-hour parliamentary hearing, senior KPMG leaders, independent directors, clients, lawyers, regulators and professional bodies gave evidence in public.

During the hearing, KPMG acknowledged additional breaches involving the internal sharing of confidential Optus information during its unsuccessful pursuit of Telstra's external audit.

Ashurst also confirmed that it had never been engaged to investigate the substance of the whistleblower's allegations, directly contradicting KPMG's earlier public statements.

Incoming KPMG International chief executive Gary Wingrove apologised personally for the whistleblower's treatment, while the whistleblower argued that the global organisation's refusal to intervene represented the most significant failure in the entire affair.

Following hours of questioning, KPMG reversed its earlier refusal to disclose internal investigation documents and agreed to provide them to the parliamentary committee.

ASIC Chair Sarah Court described the firm's conduct as an "egregious and serious breach of trust" and argued that the regulator required stronger powers to oversee accounting firms directly, rather than focusing solely on individual auditors.

Governance reset

The fallout accelerated throughout June and July.

KPMG confirmed that chairman Martin Sheppard would step down as part of a broader governance overhaul. The firm also announced the departures of Paul Rogers and Eileen Hoggett, committed to appointing its first independent chair and expanded the number of independent directors on its board.

The Department of Finance appointed former senior public servant Dr Ian Watt AC to conduct an independent review of KPMG Australia's culture, ethics, integrity and governance, while Treasury released an options paper proposing sweeping reforms across Australia's accounting, auditing and consulting sector.

The proposals included stronger ASIC oversight, mandatory audit rotation, enhanced governance requirements, tougher penalties and possible structural separation between audit and consulting businesses.

The scandal was no longer confined to one firm.

Chartered Accountants Australia and New Zealand launched a broader review of ethics and confidential information practices across KPMG, Deloitte, EY, PwC and other large professional services firms. ASIC also initiated an unprecedented sector-wide review into how the Big Four handled whistleblower complaints.

Fresh disclosures throughout July demonstrated that the controversy remained far from over.

Previously confidential findings confirmed that KPMG partners had accessed rival audit proposals held by Lendlease during the firm's pursuit of the Westpac engagement, substantiating one of the whistleblower's central allegations.

Further details from Project Magenta also became public, revealing the investigation had relied largely on brief interviews with senior partners while excluding many external witnesses and operating within a scope controlled by a KPMG board subcommittee.

The financial impact also became increasingly visible.

Reports suggested KPMG was preparing to eliminate several hundred jobs as declining demand from government and private-sector clients affected revenue. Partner remuneration was also expected to come under pressure.

Leadership changes continued.

John Sams was appointed chief executive in July, succeeding interim leader Stan Stavros. However, some lawmakers questioned whether promoting another long-serving executive represented a genuine break from the leadership team that had overseen the crisis.

Meanwhile, Westpac demanded the removal of senior partner Kim Lawry from its audit engagement, leading to her resignation from KPMG's national board and partnership. The firm also imposed a fresh round of sanctions over the misuse of confidential Optus information during its unsuccessful pursuit of Telstra's audit.

The latest development came on 27 July, when KPMG Australia was barred from bidding for new Victorian Government work until 30 September 2026.

The scandal is no longer simply about one whistleblower complaint or one firm's internal failings.

It has become a defining test of whether Australia's largest accounting firms can continue to rely on self-governance, or whether stronger external oversight is now unavoidable.

With ASIC investigations continuing, parliamentary hearings ongoing, Treasury consulting on sector-wide reforms and governments reassessing commercial relationships, the implications now extend well beyond KPMG.

The next phase is already underway.

A second parliamentary hearing is scheduled for August, submissions on Treasury's reform proposals will shape the future regulatory framework, and the independent review into KPMG's governance is due to report by the end of September.

Whatever the final outcome, the affair has already reshaped the debate around audit independence, corporate governance and accountability. For Australia's Big Four, it marks a watershed moment whose consequences are likely to extend well beyond a single firm or a single whistleblower.