KPMG Whistleblower Failure – Practical Governance Lessons
Summary
It began when a whistleblower raised concerns about the internal sharing of confidential client information. Those claims were tested through internal and external reviews, both of which initially found no wrongdoing. However, after escalation to the board and the appointment of a further independent investigation, KPMG conceded that its earlier processes lacked sufficient rigour and did not properly address the allegations. 1
KPMG has since acknowledged that its treatment of the whistleblower, and the conduct of the investigations, fell short of expectations. Leadership accountability followed, with both the CEO and the head of audit stepping down, alongside regulatory scrutiny and reputational damage.2
For boards, the takeaway is straightforward. A flawed whistleblower framework creates a second-order risk. Even where misconduct is unclear or unproven, poor handling of a disclosure can escalate quickly into a governance, regulatory and trust issue.
Five practical governance lessons
1. Ensure investigations are independent from the outset
Where allegations are serious or involve senior personnel, the investigation model should default to independence and not escalation after failure. This may come from predefined triggers for external investigation, ensuring direct board or committee oversight and separate investigation from operational management. A preliminary assessment based on all the information gathered from a whistleblower should be used as the basis for an independent review where allegations are of a serious nature.
2. Simplify the complaints process
Complex systems deter use. Overlapping legal frameworks at the state and federal level already create confusion for potential whistleblowers.3 At an organisational level, this may include providing potential whistleblowers with clear and simple reporting channels, anonymous options and clear explanations regarding what happens after a report is made. The primary objective is to remove friction at the point of disclosure and provide guided transparency over the entire process.
3. Focus on protection, not just compliance
Policies often meet legal requirements but fall short in protecting individuals in practice. Effective programs should include proactive monitoring for retaliation, clear accountability for protecting the whistleblower and access to support mechanisms where risks are identified. Whistleblowers often bear the personal and professional cost of speaking up. Fear of personal and professional detriment remains a major barrier. KPMG’s own acknowledgement that it fell short of its “speak-up culture” ambitions illustrates the gap between intent and execution.4
4. Stress test processes
ASIC guidance reinforces that leading organisations actively monitor, review and improve their whistleblower programs, using disclosures to identify systemic issues.5 Organisations should consider regularly reviewing the quality of investigation pathways and processes, track timeframes and outcomes and use disclosure to identify systemic risks.
5. Treat whistleblowing as a standing board risk
Whistleblower frameworks should sit alongside audit, risk and compliance on the board agenda. Boards should receive regular reporting on disclosures and outcomes, oversee high-risk or sensitive matters directly and ensure accountability for failures in process, not just outcomes.
Bottom Line
For organisations, the practical implications are clear. If your whistleblower framework is not trusted, it will not be used. If investigations are not credible, issues may escalate. In an environment of heightened regulatory scrutiny and a rising public trust deficit, organisations that fail to get their policy settings and processes right risk not only legal consequences but reputational harm. Critically, the execution of processes matters. Clear accessibility, accurate reporting, independent investigation pathways, and active oversight and accountability are all necessary mechanisms to uphold public trust and confidence wherever whistleblowers speak up.
[1] https://www.abc.net.au/news/2026-05-29/kpmg-boss-resigns-over-mishandled-whistleblower-allegations/…
[2] https://anz.peoplemattersglobal.com/news/leadership/kpmg-australia-whistleblower-scandal-forces-ceo…
[3] https://www.governanceinstitute.com.au/app/uploads/2025/10/Submission-AG-Public-Interest-Disclosure… KPMG boss resigns over mishandled whistleblower allegations – ABC News
[4] https://download.asic.gov.au/media/wsjegua5/rep758-published-2-march-2023.pdf