KPMG CEO resigns as whistleblower scandal erupts

KPMG Australia boss Andrew Yates and senior partner Julian McPherson have abruptly resigned after the company confirmed confidential client data had been shared and potentially used to win new business with other clients, following explosive claims from a whistleblower.

KPMG, which dominates audit work for Australia’s corporate giants and government services, was thrown into turmoil on Friday as it grapples with an escalating scandal sparked by a whistleblower’s complaint.

The company said its treatment of the whistleblower complaint and a subsequent investigation into the allegations “fell short of the firm’s expectations, those of the whistleblower and the broader community”.

The anonymous whistleblower first made a complaint in 2024 with dozens of allegations, including that KPMG partners illicitly accessed board papers from their client, Lendlease, which were used to win lucrative audit work at Westpac and Dexus. The whistleblower also alleges confidential information was used to win Macquarie’s lucrative audit contract, which is worth about $75 million a year.

The matter became public in March, when Labor MP Deborah O’Neill raised the whistleblower allegations in a Senate speech, citing “misuse of confidential information, corruption of ASX audit tender processes” and retaliation against the whistleblower for raising these concerns.

“There are clear allegations here of profoundly unprofessional and unethical behaviour,” she said.

The allegations at KPMG have echoes of the tax leaks scandal at rival PWC, where partners at the firm allegedly used confidential government tax plans to help multinational companies avoid the new scheme.

While the alleged victims in the latest case are corporations, rather than taxpayers, it is a major embarrassment for KPMG in the competitive world of auditing and consulting.

Sarah Court, the next chair of the Australian Securities and Investments Commission, told a Senate estimates committee that the watchdog was looking into the matter.

“We’ve commenced a preliminary investigation into allegations about the conduct of a number of registered company auditors at KPMG,” she said.

Accessing and sharing confidential client data is a serious allegation for consulting groups, which need access to their clients’ most sensitive data to complete lucrative audit work and consulting services.

“What’s happened is huge in the context of advisory businesses and professional services firms,” Helen Bird, a corporate governance expert at Swinburne University, said.

“There could be ramifications beyond KPMG.”

After PWC was engulfed in scandal earlier this decade, it was forced to spin off its government business for $1 in 2024. It was also banned from any further business with federal agencies, and it was forced to sack hundreds of staff as customers fled to other consulting groups, such as KPMG.

This week during Senate estimates, Finance Department officials said they had told KPMG Australia it could be banned from bidding for contracts after the firm had repeatedly failed to notify officials about wide-ranging allegations of client data misuse.

Finance Minister Katy Gallagher’s office did not comment on Friday, but on Wednesday, Gallagher said she was “deeply frustrated” by KPMG’s failure to self-report until forced to do so by a whistleblower.

On Friday, KMPG said an initial internal investigation, which did not substantiate the allegations raised by the whistleblower, had not been conducted with the “necessary rigour required”.

After an initial internal investigation into the 2024 complaint, KPMG later appointed law firm Ashurst to review the internal investigation after the whistleblower declined to co-operate with the internal investigation.

Another law firm, Allens, was later appointed to conduct a fresh external investigation when the whistleblower raised the allegations with the board, which included former NSW premier and current Cricket Australia chairman Mike Baird.

“Allens are continuing to challenge the conclusions reached in prior investigations,” KPMG said on Friday.

KPMG chairman Martin Sheppard said he had accepted the resignations of Yates and McPherson with immediate effect as they had ultimate responsibility for managing the whistleblower complaint and the internal investigations.

“We apologise unreservedly to the whistleblower. We commit to learning from this process to ensure we create an environment where it is safe and easy to surface concerns that will be acted upon. KPMG apologises to the clients whose information was not handled with the care and respect they expect from us,” Sheppard said.

The firm said appropriate disciplinary action would continue to be imposed if the investigations identified further matters.

As recently as May 14, two years after the whistleblower made the allegations, KPMG said that “based on the evidence identified to date, the allegations have not been substantiated”.

But KPMG did concede, at the time that it made this statement, to two “related conduct matters”.

One concerned the inappropriate sharing of client documents between KPMG personnel, and the other was described as an “inappropriate informal remark”.

On Friday, KPMG said its “ongoing investigation recently revealed a separate incident where internal documents containing client information have also been inappropriately shared internally”.

Investigations into all three matters are ongoing, it said.

A letter from Lendlease chief executive Tony Lombardo in late April to a parliamentary joint committee chaired by O’Neill confirmed the construction giant had been the victim of the earlier data breach, which KPMG described as a “related conduct” matter.

Lendlease said KPMG first made it aware of whistleblower allegations in May last year – that sensitive board papers had been accessed by its audit partners to win work with other clients – but KPMG said it was satisfied there was “no issue”.

After O’Neill aired the whistleblower allegations in March, KPMG told Lendlease that one of its audit partners had actually accessed the board papers, but the consulting group deemed the documents to be of “low sensitivity” that gave it “zero competitive advantage”.

“Lendlease has advised KPMG that the actions of its employees are not acceptable and is in discussions with KPMG as to the action to be taken,” Lombardo says in the letter to a parliamentary committee.

The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning.