KPMG Whistleblower Scandal: Lessons for Every  Australian Business

In March 2026, a single whistleblower changed the course of one of Australia’s most prominent professional services firms.

The allegations were serious. Confidential client information, including board papers belonging to Lendlease, had allegedly been taken by KPMG audit partners and used to pitch competing audit work to Westpac, Dexus, and Macquarie Group. The whistleblower raised the matter internally. Twice. Three times. Eventually, with anyone who would listen.

And for a long time, nothing substantive happened.

By July 2026, the fallout had claimed the CEO, the national managing chairman, the chief operating officer, and the national managing partner for audit and assurance. ASIC had opened a formal investigation. The federal government had frozen more than $270 million in contracts. A parliamentary committee was actively scrutinising the firm’s conduct. KPMG itself admitted publicly that its internal investigation “was in hindsight not conducted with the necessary rigour required.”

The wrongdoing stayed hidden for months longer than it should have. Not because the whistleblower was wrong. But because the process that was supposed to surface the truth failed to do so, and kept on failing.

This is not a story about KPMG alone. It is a story about what happens when organisations investigate themselves. And it carries a direct lesson for every Australian business that has ever faced, or may ever face, a serious internal complaint.

What Actually Happened at KPMG 

Understanding why the KPMG investigation failed requires understanding the sequence of events, not just the outcome.

The whistleblower first raised concerns internally about the alleged misuse of confidential client information. KPMG conducted an internal review. That review found nothing it could substantiate. The firm accepted the finding and moved on.

The whistleblower disagreed with the outcome and escalated. KPMG appointed an external law firm to review the internal investigation. That external review supported the internal investigation. The finding was again that the allegations were unsubstantiated.

The whistleblower, now deeply concerned about the integrity of both processes, raised the matter with independent board members and other stakeholders. At that point, the board sub-committee, led by the deputy chair and including three independent directors, appointed Allens to conduct a further external legal investigation.

What that investigation ultimately confirmed, and what KPMG has since publicly acknowledged, is that the original internal process fell short. Three partners were sanctioned. The CEO and other senior leadership resigned. ASIC opened a formal probe of its own.

The firm’s own public statement put it plainly:

“KPMG Australia confirms its treatment of a whistleblower and investigation into their allegations fell short of the firm’s expectations, those of the whistleblower and the broader community.”

Why the Internal Investigation Failed

KPMG’s failure was not, at its core, a failure of process design. The firm had a whistleblower policy. It had internal investigation protocols. It engaged external law firms at two separate points. By conventional standards, it followed a process.

The failure was structural. And it is a failure that can affect any organisation that investigates a serious allegation about its own senior people.

As one detailed account of the scandal observed, KPMG framed the initial report as a staff complaint rather than a serious audit problem. That framing shaped who looked at it and how hard they pushed. The people conducting and overseeing the investigation were embedded in the same institution, the same culture, and in some cases the same professional networks as the people being investigated.

When an investigation is conducted inside the organisation it is meant to scrutinise, the independence that rigorous investigation requires is structurally compromised before a single question is asked. This is not a comment on the individual integrity of the investigators. It is a comment on the environment in which they operate, the information they have access to, the relationships they must preserve, and the institutional interests that shape, consciously or not, what they look for and what conclusions they reach.

The external legal firms engaged at two separate points did not resolve this problem. They were asked to review the internal investigation rather than conduct an independent one from the ground up. Their terms of reference were shaped by the institution. Their output was filtered through it. And when both supported the internal finding that turned out to be wrong, the whistleblower’s concerns escalated further rather than being resolved.

The lesson is not that KPMG should have engaged better external reviewers. The lesson is that reviewing an internal investigation is not the same as conducting an independent one. 

The Three Investigation Failures Australian  Businesses Repeat 

The KPMG scandal is exceptional in scale but not in kind. The same structural failures appear in workplace investigations across Australian businesses of all sizes, in every industry, at every level of seniority. RIVICA’s team sees them regularly.

Failure one: the investigator is too close to the institution.

When a person who works for, reports to, or has ongoing professional relationships with the subject of an investigation conducts that investigation, independence is not achievable regardless of personal integrity. The Fair Work Commission has made this point repeatedly in its decisions. Independence is not a state of mind. It is a structural fact. Either the investigator has relationships that compromise their independence, or they do not. If they do, the investigation is vulnerable before it begins.

Failure two: the matter is framed as a lesser concern than it is.

How an allegation is classified at the outset shapes everything that follows. Who investigates it. How much resource is applied. What evidence is gathered. What standards are applied to the findings. The KPMG investigation treated a potential audit integrity breach as a staff complaint.

That framing meant the investigation was conducted to the standard appropriate for a staff complaint, not to the standard appropriate for a serious regulatory and ethical matter. Many organisations make the same mistake, particularly where the subject is senior and the implications of a finding against them are significant.

Failure three: the review of an investigation is confused with an independent investigation.

Asking an external party to review an internal investigation is not the same as asking them to conduct an independent investigation. A review works within the frame of what the internal process produced. An independent investigation starts from first principles: what are the allegations, what evidence exists, what does that evidence mean, and what conclusion does it support. The distinction sounds technical. Its consequences are not.

What the Law Actually Requires 

Australia’s whistleblower protection framework was significantly strengthened by the Treasury Laws Amendment (Whistleblower Protections) Act 2019. The legislation applies to companies regulated by the Corporations Act and provides substantial protections for eligible whistleblowers, including protections against detrimental conduct, confidentiality obligations, and rights to civil remedies where those protections are breached.

ASIC published Report 827 in December 2025, setting out findings from its questionnaire into the whistleblowing practices of 134 surveyed companies. The Report made clear that many organisations continue to fall short of their obligations, particularly in relation to the rigour of their investigation processes and the quality of their communication with whistleblowers about outcomes.

The regulatory direction is clear. ASIC and other regulators are intensifying scrutiny of how organisations handle whistleblower complaints. The KPMG matter has accelerated that scrutiny and is likely to prompt further legislative reform. Australian businesses that treat whistleblower complaints as a human resources matter rather than a governance and legal risk matter are operating in an environment that is actively moving against them. 

What Independent Investigation Actually Looks Like 

An independent investigation is not simply an investigation conducted by someone outside the organisation. It is an investigation that is structurally free of the interests, relationships, and institutional pressures that compromised KPMG’s process.

The characteristics of a genuinely independent investigation are consistent and well established.

The investigator has no relationship with any party to the matter and no interest in the outcome. They were not appointed by, and do not report to, anyone whose interests are affected by the findings. They are not being asked to review someone else’s work. They are starting from the beginning.

The terms of reference are clear and complete before the investigation begins. The allegations are precisely defined. The scope is agreed. Neither party has the ability to narrow that scope once the investigation is underway.

The investigator gathers evidence directly. They interview witnesses. They review documents. They test accounts against each other and against the documentary record. They do not accept the output of a prior process as their starting point.

The investigator assesses credibility independently. Where accounts conflict, they apply recognised principles of credibility assessment: consistency, corroboration, plausibility, and demeanour. They explain their reasoning. They do not simply record that two versions exist and leave the conflict unresolved.

The investigator’s report is their own. It records methodology, evidence, findings, and reasoning in a form that can withstand scrutiny from regulators, courts, and legal counsel. It is not reviewed or filtered by the organisation before it is finalised.

This is a high standard. It is the standard that serious matters require. And it is the standard that the KPMG investigation, at multiple points and despite significant resources, failed to meet.

What This Means for Your Organisation

The KPMG scandal is an extreme case. Most Australian businesses will never face parliamentary scrutiny, a frozen government contract portfolio, or regulatory action of that scale.

But the structural failures that produced it are not extreme. They are common. And the consequences, while smaller in scale, are real: unfair dismissal findings, civil litigation, regulatory penalties, reputational damage, and the legal and management costs of defending a process that should not have been run internally in the first place.

The practical question for every HR manager, general counsel, company secretary, and board member reading this is straightforward. If a serious complaint landed on your desk tomorrow, involving a senior person, alleging misconduct that has governance, legal, or regulatory implications, would your current investigation process produce findings that would withstand external scrutiny?

If the answer is uncertain, that uncertainty is itself the answer.

Why Melbourne Businesses Trust RIVICA for  Independent Investigations 

RIVICA Investigations & Covert Solutions is led by Richard James, a former Detective Sergeant with over 34 years of law enforcement experience, including covert operations and anti-corruption investigations at the highest levels of government. Richard leads a team of agents personally trained and selected to the same investigative standard, and personally develops the strategy for every case RIVICA handles.

RIVICA works directly with HR managers, general counsel, corporate boards, and legal counsel across Melbourne and Victoria-wide. Every investigation is conducted independently, documented to court-admissible standard, and structured to withstand scrutiny from the Fair Work Commission, VCAT, ASIC, and other regulators.

If your organisation is managing a complaint that warrants independent investigation, or you want to understand what that process looks like before you need it, a confidential conversation costs nothing and obligates you to nothing.

Call RIVICA today for a confidential, no-obligation discussion. 

RIVICA Investigations & Covert Solutions | South Melbourne | Serving clients across Victoria and Australia-wide

Richard James is the founder and principal investigator of RIVICA Investigations &  Covert Solutions. He holds over 34 years of experience in law enforcement, government  investigations, and private sector investigative services, and has provided evidence and  testimony in legal proceedings across Australia.