In This Issue

Havoc at KPMG

• The Lendlease Breach

• The Dexus Lunchgate

• Client Betrayal - Optus and Telstra

• Ominous Rumblings about the Macquarie Group Audit

• Eileen Hoggett - Concert Tickets and … a Promotion to CCO

• The Reckoning (So Far)

  • Government Pushback

  • Criminal & Regulatory Investigations

  • Client Backlash

  • The Decimation of Trust

• A Tainted Culture

Havoc at KPMG

The last couple of weeks have been total chaos for KPMG Australia, with a relentless drip-feed of revelations across the Australian Financial Review and other news outlets.

It’s been a slog trying to keep up with the dominoes as they fall. Here’s a summary for those who haven’t been able to follow every twist - although at the rate things are going, there might be new developments by the time you read this.

The situation has been brewing for two years. In 2024 a director submitted a report with dozens of allegations to the whistleblower contact person in the firm.

What followed was a series of inept attempts to put a lid on what was shaping up to be a major scandal, ranging from categorizing the source’s claims as “employee grievances” to avoid giving the reporter the whistleblower protections he was entitled to by law, to giving “investigators” very narrow briefs that excluded interviewing people who witnessed the reported events.

After several escalations that went all the way to the very top of KPMG globally, the whistleblower (strategically labelled the “aggrieved employee” by Australian leadership) was pushed out of the firm. At that point he went to the regulator, and after that too led to a lot of nothing, he approached Senator Deborah O’Neill.

What followed will go down in the annals of Big Four history.

On March 24, at 9:30pm, the Senator stood up in an almost empty parliament and read out a speech that set off tectonic shifts in KPMG world - with reverberations right through the professional services industry.

Using parliamentary privilege, she laid out allegations of partners inappropriately accessing and using confidential Lendlease board papers to gain a competitive edge in audit pitches for clients such as Westpac and Dexus.

She did not share much detail, but what started as a trickle soon turned into a flood of allegations in the press.

👉 View the Full KPMG Scandal Timeline Presentation

The Lendlease Breach

The whistleblower claims, and KPMG has partially admitted, that the auditors abused their access to board documents on Lendlease’s online system, Diligent, to peruse highly confidential board documents which were not meant for their eyes.

In late 2023, Lendlease issued a bid for quotations for their external audit, as they assessed whether to retain KPMG or take their business elsewhere. The subcommittee of the Audit Committee that was overseeing the bid set up a folder on Diligent, where they saved documents such as the tenders received.

The problem was that they did not restrict access.

Anyone who had access to the board documents could access the folder – and when KPMG auditors found out, access it they did, gaining crucial insights into their competitors’ presentations and, I assume, other valuable data such as pricing.

Reports further detail that two senior partners, Eileen Hoggett (then a senior audit partner, now COO) and Paul Rogers, physically removed board documents, stored them in a locker, and circulated them internally.

Allegedly, this intelligence helped KPMG one-up Deloitte, PwC, and EY to win the Westpac external audit — a major coup for the firm.

The Dexus Lunchgate

I wrote about this case in last week’s issue of Big Four News, but I will summarize it here for the sake of completeness.

KPMG had been Dexus’ internal auditor for several years, but when the company issued a call for tenders for their external audit, the partners were determined to expand their slice of the pie and bid for this work too – notwithstanding the fact that having the same firm conduct both the internal and external audits is not ideal because of potential independence issues.

The Dexus Audit Committee initially demurred, but they ultimately decided to allow KPMG to throw their hat in the ring, making it clear that they expected robust Chinese Walls to be put in place between the internal and external auditors, to ensure a level playing field for all bidders.

What did they get instead?

Allegedly, a war room led by audit partner Suzanne Bell, who is in a long-term romantic relationship with KPMG Australia Chairman Martin Sheppard - a relationship that has raised questions about potential conflicts of interest, both perceived and actual.

In one session, according to the whistleblower, an internal audit partner announced he was going for lunch and left his laptop open, displaying restricted Dexus information for the bid team to read.

KPMG ultimately won the $2.5 million engagement.

Client Betrayal - Optus and Telstra

This case is, arguably, the most shocking of the three – because it involves an alleged betrayal of a loyal client that KPMG has audited for 34 years.

Once again we return to the tenders command centre, where a bid team was working on a proposal for Optus rival, Telstra.

According to the whistleblower (these claims were later confirmed by investigators from a law firm engaged by the KPMG board), Optus auditors shared highly sensitive, confidential information about their client with the team preparing the Telstra bid.

This time, the breach did not pay off. Deloitte won the engagement.

Rumblings about the Macquarie Group Audit

Details have not yet fully emerged regarding this case, but the whistleblower has alleged that KPMG leveraged internal information gained through its close connections — specifically via Michelle Hinchliffe, a Macquarie director and former senior KPMG audit partner (including former head of audit at KPMG UK) — to secure the audit tender.

The Macquarie Group audit is widely regarded as one of the most prestigious and lucrative mandates in the Australian and Asia-Pacific market. It is worth around A$75 million annually total fees — with the core Australian component around $30 million. KPMG’s successful bid to wrest the role from PwC in late 2025 was seen as a major strategic victory for the firm.

These remain unproven allegations at this stage, and further details are expected to surface as the Senate inquiry and regulatory probes continue.

Eileen Hoggett - Concert Tickets and … a Promotion to CCO

In the barrage of information that has emerged over the last week or so there were another two important titbits.

Eileen Hoggett - who we last mentioned in relation to the misappropriation of Lendlease board documents – reportedly accepted corporate box tickets to a Taylor Swift concert for herself and family members from Link Group, a major client where KPMG served as auditor.

The timing makes it particularly awkward. Link Group had faced a significant restatement in prior years following ASIC concerns over the valuation of its Funds Solutions business. This led to material adjustments to reported losses and a reduced profit outlook — events that directly hit investor confidence and share price.

While the Swift tickets themselves didn’t cause the restatement, accepting lavish hospitality from a client during such a sensitive reporting period raises legitimate questions: How objective can an auditor be when they (and their family) are enjoying corporate box perks courtesy of the company they’re supposed to scrutinise independently?

And finally, adding insult to injury, Hoggett was promoted to Chief Operating Officer of KPMG Australia after the firm had been alerted about her alleged improprieties by the whistleblower.

The Reckoning (So Far)

After weeks of relentless headlines, KPMG Australia finally blinked.

On May 29, the firm announced that CEO Andrew Yates and National Managing Partner of Audit Julian McPherson had both resigned, effective immediately. The Board appointed Stan Stavros, National Managing Partner of Deal Advisory & Infrastructure, as interim CEO.

In a statement that read like it had been lawyered within an inch of its life, KPMG admitted that its handling of the whistleblower and the subsequent investigations “fell short” of expected standards.

They’ve apologised — to the whistleblower, to their people, and to the broader community — and say they’re now reviewing everything from whistleblower protections to how they investigate serious complaints.

Some partners have already been sanctioned internally. It’s the closest thing we’ve seen to genuine accountability from a Big Four firm in Australia since the PwC tax leaks disaster.

Government Pushback

KPMG is undoubtedly hoping that having offered two of its most senior partners as sacrificial lambs will make the problem go away. That is unlikely. Senator Deborah O’Neill, who lit the fuse back in March with her parliamentary speech, shows no signs of letting this go.

She has been hammering the Big Four for years on audit quality, conflicts of interest, and cultural issues, and this scandal has given her plenty of fresh ammunition.

A Senate inquiry is now actively digging into the matter, with another public hearing scheduled for June 19. Expect more uncomfortable questions about not just KPMG, but the entire self-regulated ecosystem the Big Four have enjoyed for far too long.

The senator has made it clear she wants real structural change — not another round of corporate apologies, musical chairs at the top, and promises to “do better.”

Whether she gets it is another question. History suggests the Big Four are very good at surviving scandals. But this one feels different. The combination of multiple client breaches, a high-profile whistleblower, and sustained parliamentary heat has made this harder to contain.

KPMG’s attempts to contain the fallout have themselves come under scrutiny. The firm is now claiming legal professional privilege over key internal investigation documents, and has pushed for a closed-door parliamentary hearing. These moves are widely seen as efforts to shield partners and limit public accountability.

There’s also a growing risk that this scandal could hit KPMG where it really hurts — in the wallet. The Department of Finance has issued a blunt warning that the firm could be banned from bidding on Commonwealth government contracts after repeatedly failing to disclose the full extent of the whistleblower allegations to officials. This isn’t just embarrassing — it’s potentially existential.

KPMG partners are undoubtedly painfully aware of the precedent set three years ago during the PwC tax leaks scandal. When it was revealed that PwC partners had misused confidential government tax information to advise multinational clients on how to avoid new anti-avoidance rules, the consequences were swift and severe.

The firm was forced to sell its entire government consulting business to a private equity firm for a nominal $1 — a unit previously valued at well over $100 million and generating roughly $600–680 million in annual revenue.

Overall, PwC suffered a 26% revenue drop from $3.17 billion in FY2023 to $2.35 billion in FY2024, lost hundreds of partners and thousands of staff, and saw major client relationships erode. Partner remuneration was cut and public trust collapsed.

The parallels are stark. If KPMG faces a similar ban from new Commonwealth contracts the financial damage would be enormous, triggering reduced partner distributions, accelerated talent flight, further private-sector client defections, and long-term reputational damage that would be difficult to repair.

Criminal & Regulatory Investigations

On Friday, during a parliamentary hearing of the Joint Committee on Corporations and Financial Services, it was revealed that the alleged theft or misuse of confidential client documentation by KPMG personnel could constitute a breach of criminal law.

This marked a significant escalation, shifting the matter from primarily ethical, professional, and regulatory concerns into potential law-enforcement territory.

Meanwhile, the Australian Securities and Investments Commission (ASIC) has launched a preliminary investigation into the conduct of three registered company auditors at the firm.

ASIC Commissioner Kate O’Rourke confirmed the probe during the same parliamentary hearing. She explained that the regulator will focus on alleged misconduct involving the inappropriate sharing and potential use of confidential client information. Potential repercussions include cancellation or suspension of registration, fines, or other sanctions.

In my view, this narrow focus on individual partners risks missing the forest for the trees — the real issue is systemic and demands scrutiny of KPMG Australia’s culture, governance, and incentive structures as a whole.

That said, the regulator has not ruled out expanding its scope - so there might be some developments there.

Client Backlash

Client rumblings are also growing louder: Lendlease CEO Tony Lombardo described the firm’s actions as “not acceptable” in a letter to the parliamentary committee and confirmed the company is in active discussions with KPMG about next steps.

Earlier today Lendlease publicly stated that it is reviewing its audit services with KPMG and is actively beginning the process to change auditors.

Key quote from Lendlease (issued Monday, June 1, 2026)

“It is not appropriate to make a change in auditors this close to financial year end. We will be reviewing our audit services following the completion of FY26 reporting.”

In other words, Lendlease intends to end its 68-year audit relationship with KPMG. An ignominious termination which presages many other clients fleeing the firm.

Other impacted clients, including Optus and Telstra, have been formally notified of the breaches, while broader concerns continue to surface about the integrity of audits delivered to major Australian corporates.

The Decimation of Trust

The resignations may have been intended as a circuit-breaker, but the scandal’s ripple effects are widening. KPMG’s alleged breaches strike at the heart of private-sector confidence.

ASX-listed companies are particularly unsettled. Auditors are privy to the most sensitive board deliberations—strategy, mergers, financial forecasts—and the idea that this information could be weaponized for competitive pitches shatters the implicit trust that underpins the entire audit model.

There may also be significant ramifications for KPMG’s forensic department, which offers independent whistleblower reporting services to major clients through its “FairCall” service — a conflict that Senator Deborah O’Neill highlighted when she remarked that the discovery of institutions like the Reserve Bank of Australia and the ASX using the service “just blows my mind.”

A Tainted Culture

It’s good that two senior heads have rolled. The resignations of CEO Andrew Yates and audit chief Julian McPherson on May 29 were necessary, and the firm’s admission that its handling of the whole affair “fell short” is at least a start.

But let’s not pretend this cleans the slate.

The most uncomfortable question hanging over this scandal is not just what a handful of partners did — it’s how many people knew. Partners on the bids, employees in the war rooms, internal auditors who saw documents being passed around, senior leaders who signed off on narrow investigations… the list goes on.

Yet only one person had the courage to put their career on the line and speak up.

You can’t entirely blame those who chose to keep their heads below the parapet. They watched as the original whistleblower was labelled, sidelined, and eventually pushed out. The message sent from the top was crystal clear: rock the boat at your peril.

That’s the real cultural failure here.

When a professional services firm — one that lectures clients on ethics, governance, and whistleblower protections — creates an environment where employees are scared of calling out serious misconduct, something is deeply rotten.

The “eat what you kill” partnership model, the obsession with winning every pitch, and the cosy relationships at the top are not conducive to ethical behaviour - when all is fair in love and war, lines get crossed.

And here’s the longer-term worry: what are they teaching the next generation?

Younger partners and senior managers are being moulded by people who allegedly believe it is acceptable to rifle through a client’s confidential documents, breach Chinese Walls when it suits them, and treat uncomfortable questions as mere “employee grievances.”

Culture isn’t shaped by press releases and apologies. It’s shaped by what behaviour gets rewarded — and what gets punished.

Until KPMG (and the rest of the Big Four) confront this properly, we’ll likely see more of these scandals. Because the real problem isn’t a few rogue partners. It’s a culture that made their behaviour feel normal.

This scandal has the potential to be a turning point. Whether it leads to genuine structural reform or another cycle of apologies and minimal change will depend on sustained pressure from regulators, parliament, and clients.

Based on public reports and parliamentary records. Some matters remain under investigation.

• EY — Toxic Culture at EY Oceania: One Death, Multiple Warnings, and Still No Real Change

• Deloitte — Federal Court Greenlights Trade Secrets Case Against Deloitte for CDC Vaccine Tech

• KPMG - Lunchgate: Whistleblower Claims about KPMG’s Dexus Laptop Leak

Toxic Culture at EY Oceania: One Death, Multiple Warnings, and Still No Real Change

On 27 August 2022, around midnight, 27-year-old Aishwarya Venkatachalam took her own life, jumping from a terrace on the 11th floor of EY’s Sydney office building. The senior auditor had moved from India to Australia less than a year earlier, for what she had described as her “dream job” with the firm.

Aishwarya had spent the evening with colleagues at an EY social event at The Ivy nightclub in Sydney’s Central Business District — but three women came across her crying in a nearby car park late that evening. When they approached to offer help, she told them that “everyone was so mean to her in her office” and that the people working there were “mean and racist.”

These statements echoed what she had told her best friend, Neeti Bisht, about the work environment at EY, four months prior to her death.

Initial Response and Backlash

EY’s Sydney employees were initially stunned by the tragedy. However, their shock quickly gave way to widespread frustration over the firm’s handling of the situation.

Much of this anger centred on CEO David LaRocca’s town hall address to roughly 9,000 staff across Oceania. In the nearly hour-long speech, he devoted just four minutes to her death, referring to Aishwarya Venkatachalam only as “one of our Sydney assurance team members,” without mentioning her by name.

The hashtag #SayHerName quickly gained traction on LinkedIn and other platforms.

Larocca later justified the omission by stating the firm was “working to maintain space and privacy for Ms Venkatachalam’s family.”

In the aftermath, current and former employees took to LinkedIn, Reddit, and the press to publicly share experiences of bullying, racism, and overwork at EY, with many directly linking the firm’s toxic culture to the tragedy. One former staffer told Daily Mail Australia:

“Those days with EY Sydney were just so miserable. One day, I literally broke down cause of the unfairness and burnt out and cried so much at home. Luckily I have my family and friends to support me . … The partners in that team tend to treat Asian workers like a dog as they expect those workers can always work hard and can deliver more.”

Independent Review

In response to the backlash, EY Oceania commissioned an independent review led by Elizabeth Broderick, former Australian Sex Discrimination Commissioner. The review, which gathered input from over 4,000 current and former employees, was released in July 2023.

While a majority of employees reported that they found their workplace to be a respectful environment, with leadership promoting good behavior (88%), it emerged that there were several systemic issues disproportionately harming vulnerable groups: juniors, women, and CALD (Culturally and Linguistically Diverse) staff.

The following are some of the worrying findings highlighted by the report:

Bullying: Around 15% of employees had experienced bullying at EY Oceania in the previous five years, with women (17%) more likely to have experienced bullying than men (13%).

“The Partners protect bullies. Often they are bullies and aggressive themselves.”

(p. 31)

Sexual harassment: 10% of staff reported experiencing sexual harassment, with women at 15% and men at 6%.

“There are some partners I wouldn’t be in a room alone with.”

(p. 31)

“There was a Partner who tapped a colleague on the bum after a presentation saying ‘good job’. Other women complained but nothing was done. He is known to have problematic behaviours but nothing is done because he brings in a lot of money.”

(p. 72)

Racism: Some 8% of staff had experienced racism, with a concentration amongst employees who identified as ethnically Indian (16%), Chinese (15%) or Māori (21%).

“I’ve witnessed racist slurs. I have seen a Partner ask one of my Chinese-origin colleagues in front of a whole meeting whether he eats dogs. [My Chinese-origin colleague] said he then was left out and not invited to a social event hosted by that Partner after. The worst part is that he and others felt unsafe to say anything.”

(p. 62)

Widespread overwork affecting nearly half the workforce’s mental and physical health.

Low trust in reporting mechanisms, with many fearing career repercussions for speaking up. Only 36% of those who were bullied, 17% of employees who had experienced sexual harassment and 7% of staff who faced racism, lodged a report about what had happened to them.

No accountability, especially for senior leaders.

In the aftermath of the report’s publication, EY leaders apologized to employees and committed to implementing each of the 27 recommendations made by Broderick.

Later Allegations and Lawsuit

Allegations have now emerged, however, that while Elizabeth Broderick and her team were conducting staff interviews, and senior EY partners were publicly assuring employees of their commitment to meaningful change, the firm was covering up a serious case of sexual harassment.

Intern Ofir Larsen alleges that in January 2023, during a work event at the K1 Karaoke Lounge in Sydney’s Haymarket, her manager Harry Young grabbed her right breast, slapped and gripped her left thigh, and made other unwanted physical contact.

After she raised the complaint internally, colleagues allegedly told her to “move on,” while she was shunned by the team and sidelined from several projects.

Larsen further claims she was prevented from participating in Broderick’s culture review survey.

EY has admitted certain aspects of her account — including her exclusion from the survey — but strongly denies any retaliation or victimisation. Larsen is now pursuing legal action against the firm in the Federal Court, seeking damages and greater accountability.

A Parting Shot from Cameron Bird

The firm’s commitment to change was further cast into doubt in January 2026 when veteran EY Oceania partner Cameron Bird — with 19 years at the firm, including a decade as a partner in the infrastructure advisory team — resigned and delivered a scathing farewell email to staff.

Instead of the usual polite goodbyes, Bird excoriated the leadership as “autocratic” and criticised a “rigid, top-down” hierarchical culture dominated by executives obsessed with “career progression and personal gain” and with little genuine regard for staff wellbeing. He declared he could “no longer tolerate the direction the firm is taking,” accusing senior leaders of being “fixated on how things looked rather than how people were treated.”

Not exactly a vote of confidence.

The Challenges of Stamping Out Toxicity

EY Oceania has reported progress on Broderick’s recommendations, including a new “people and culture index,” training programs, and reconciliation initiatives.

Yet here we are, three years later, and we are presented with a former intern suing the firm on one of the more serious issues EY had pledged to fix, alongside a senior partner publicly calling out the performative nature of the leadership.

Reviews and recommendations are easy. Real cultural change is hard — especially in a professional services model built on leverage, billable hours, and protecting rainmakers. When high-revenue partners face no real consequences for toxic behaviour, the message to everyone else is clear: speak up at your own risk.

Aishwarya Venkatachalam’s death should have been a turning point. Instead, it risks becoming another uncomfortable chapter in EY’s ongoing struggle with its own culture. Until the firm demonstrates genuine accountability — not just reports and apologies — these problems will continue to surface, with a devastating human cost.

Federal Court Greenlights Trade Secrets Case Against Deloitte for CDC Vaccine Tech

On April 28, 2026, U.S. District Judge P. Kevin Castel of the Southern District of New York denied Deloitte’s motion to dismiss trade secret misappropriation claims brought against it by the Multi-State Partnership for Prevention (MSPP). The judge ruled that MSPP had adequately substantiated its claim about the existence of protectable trade secrets, reasonable protective efforts, and misappropriation.

The plaintiff will now be able to proceed with its case, based on allegations that Deloitte had misappropriated confidential information about its vaccination management platform, PrepMod.

Pandemic Urgency, Demos, and a No-Bid Contract

The dispute originated in the early chaotic months of the COVID-19 vaccine rollout in 2020. The CDC needed technology for appointment scheduling, distribution tracking, inventory management, and real-time reporting, so it invited companies which had relevant off-the-shelf solutions to present their platforms.

In April 2020, Tiffany Tate, executive director of MSPP, an organization experienced in immunization programs for underserved communities, presented PrepMod to the government agency. The software was designed specifically for large-scale vaccination scenarios, featuring advanced real-time tracking, bi-directional data flows with state registries, workflow efficiencies, and operational architectures tailored for national deployment. Deloitte employees were present for the demo — they were introduced to Tate as consultants assisting the CDC in the selection process.

Tate alleges the presentations included detailed, confidential slide decks marked “CONFIDENTIAL & PROPRIETARY,” live demonstrations of the software’s core functionalities, and technical discussions. She further alleges that confidentiality agreements were in place, which both the CDC and Deloitte had committed to.

One month later the CDC decided not to proceed with an off-the-shelf solution. Instead it awarded a sole-source (no-bid) contract to Deloitte to custom-build the Vaccine Administration Management System (VAMS), citing urgency and Deloitte’s existing GovConnect/Salesforce platform. The initial contract value was approximately $16 million, which then increased to $44–48 million with extensions — but according to court filings project costs ultimately exceeded $80 million.

MSPP sent a cease-and-desist letter in August 2020, alleging that VAMS specifications closely mirrored core PrepMod features that Tate had shown them during the demos.

Deloitte has denied the allegations, maintaining that VAMS was developed independently based on CDC requirements.

An Unsuccessful Deployment

Despite its high cost, VAMS proved largely unsuccessful in practice. It was offered for free to states and jurisdictions, but was only adopted by about nine states at the peak of the rollout.

Clinic staff in adopting states reported having to fall back on paper records after encountering persistent technical problems — website crashes, random appointment cancellations, unreliable registration processes, and difficulties integrating with existing state immunization registries.

Virginia switched from Deloitte’s VAMS to PrepMod in late January 2021 due to these glitches and other usability issues. Connecticut also sought alternatives. By early 2021, VAMS had facilitated only around 4% of total U.S. vaccinations, despite the substantial taxpayer investment.

PrepMod, on the other hand, was deployed in approximately 27 states, making it one of the more widely adopted third-party vaccine management systems during the pandemic. While it too faced scaling issues, sometimes crashing when under extreme load, it was generally praised for being customizable and user-friendly.

What Comes Next

The case now enters the discovery phase. MSPP has the opportunity to request internal Deloitte and CDC documents, emails, code repositories, design specifications, and communications from the critical April–May 2020 period. This could include depositions of key personnel involved in the presentations and contract award.

Deloitte has consistently denied the allegations and is expected to mount a vigorous defense as the case progresses.

Trade secrets litigation is notoriously sensitive, and often very expensive, so there is a good chance that MSPP and Deloitte will pursue some form of settlement. That said, if the case proceeds, it will involve expert testimony on software similarities and reach a jury trial potentially in late 2026 or 2027.

Lunchgate: Whistleblower Claims about KPMG’s Dexus Laptop Leak

“On 6 November 2023, a meeting was held at KPMG’s Barangaroo office. During that meeting, and despite acknowledged independence sensitivities, an arrangement was proposed where [an internal audit partner] would leave his laptop open with Dexus internal audit documents visible while he went for lunch, allowing external audit personnel to view them.”

Senator Deborah O’Neill read these claims into the Senate record on 24 March 2026 under parliamentary privilege, on behalf of a former senior KPMG executive.

“On 30 May 2024, I provided information to an eligible recipient within KPMG Australia for the purpose of invoking the statutory whistleblower provisions under the Corporations Act. The information disclosed concerned matters that I had reasonable grounds to suspect constituted misconduct or an improper state of affairs or circumstances in relation to a regulated entity. The concerns I intended to raise related to audit independence, misuse of confidential information, tender integrity failures, misleading of Parliament, examination misconduct and governance failures at the senior leadership level.”

The whistleblower had gone through all the channels available before going to the senator. They started by reporting the unethical behaviour to relevant executives. When that did not work, they escalated to KPMG’s independent directors, then the internal chair, and even the global council.

It was only when it became clear that KPMG leadership had no intention of taking action that the whistleblower took the matter outside the firm. First to the corporate regulator, the Australian Securities and Investments Commission (ASIC), and finally Senator O’Neill.

Out For Lunch

In 2023, KPMG was acting as Dexus’s internal auditor while simultaneously preparing a bid for the company’s external audit engagement, which was valued at approximately AU$2.5 million. This dual role created a clear independence conflict under professional standards, prompting Dexus executives to insist on strict separation between the internal audit team and the external bid team.

According to the whistleblower, KPMG partners reassured the client that there would be strict Chinese walls put in place between the two teams – but they then proceeded to enact a “wink, wink” charade.

The main allegation is that during a strategy meeting in a “war room” at KPMG’s Barangaroo office, an internal audit partner announced that he was off for lunch, making a show of leaving his laptop open with restricted Dexus internal audit documents visible on screen. The team preparing the bid took a peek at the sensitive material, gaining insights that enabled them to improve their pitch.

KPMG ultimately won the external audit engagement from incumbent PwC. According to the whistleblower, the information allegedly accessed during the November 2023 meeting contributed to the successful bid.

KPMG’s Defence: “Inappropriate Remark” but No Wrongdoing Found

KPMG has strongly rejected the characterisation of the incident as a deliberate breach. In statements following the Senate disclosure, the firm described the partner’s comment about going for lunch as an “inappropriate remark” that should not have been made.

However, KPMG has not provided any comment as to whether the laptop was in fact left unlocked and unattended with restricted Dexus internal audit documents visible on screen, nor has it clarified whether any members of the external audit bid team viewed the material.

The firm has also remained silent on the appropriateness of convening a joint “war room” strategy meeting between its internal audit team and external audit bid team while the independence conflict was active — an arrangement that appears to directly contradict the strict Chinese walls and separation commitments it had reportedly made to Dexus.

KPMG maintains that it commissioned two separate external law firms to investigate the whistleblower’s claims — one to review the firm’s own internal probe and another to conduct an independent assessment.

According to KPMG Chair Martin Sheppard and CEO Andrew Yates, these reviews were “unable to substantiate any claims of wrongdoing” on the basis of the information provided. The firm also noted that it repeatedly invited the whistleblower to supply additional evidence, reportedly on more than 20 occasions — although it has now emerged that when they did so they insisted on the employee signing a non-disclosure agreement and refused to guarantee any legal protection.

While some related conduct matters were identified and resulted in internal sanctions, KPMG maintains there was no compromise of Dexus’s confidential information or breach of auditor independence that affected the outcome of the external audit tender.

However, as discussed in last week’s issue of Big Four News, the firm has already had to claw back previous claims of innocence in relation to other claims made by this very same whistleblower.

The firm admitted that contrary to its previous denials, it was in fact true that Eileen Hoggett (KPMG Australia’s Chief Operating Officer) and Paul Rogers (Senior Partner) had taken confidential Lendlease documents and shown them to members of the Westpac pitch team.

Pattern of Misconduct: Telstra, Macquarie and Other Claims

It is important to note that the Dexus and Lendlease cases are not the only claims made by this whistleblower. These included the improper disclosure and use of restricted Telstra documents — such as materials related to AI governance and internal practices — accessed via a Telstra-issued laptop during a live external audit tender.

The claims also highlighted broader issues, including systemic tender integrity failures, the inappropriate use of networks of former KPMG partners at client organisations to gain competitive advantages (including at Macquarie Group), potential misleading of Parliament, examination misconduct, governance failures at senior levels, and inadequate handling of whistleblower protections.

Ongoing Parliamentary Inquiry: What Happens Next

The Parliamentary Joint Committee on Corporations and Financial Services is conducting private hearings with the whistleblower to assess the evidence, and has the power to call KPMG partners for public testimony. KPMG has stated it is fully cooperating with the committee, ASIC, Chartered Accountants Australia and New Zealand (CA ANZ), and the Tax Practitioners Board.

After making protected disclosures in May 2024, the whistleblower was progressively sidelined and ultimately left KPMG. Senator Deborah O’Neill has characterised the sequence as retaliatory action — a pattern she says is all too common for whistleblowers in large professional services firms. As of May 2026, the whistleblower continues to cooperate with the ongoing Parliamentary Joint Committee inquiry.

• Anthropic & the Big Four — Major AI Partnership Developments

• PwC — Evergrande Liquidators Seek $8.4 Billion

• Deloitte — SCANA Settlement Finalized + Parental Leave Discrimination Lawsuit

• EY — UK Partner Demotions, Canada AI Report Retraction, Australia Tightens Parental Leave

• KPMG — Senior Partner Admits Misusing Confidential Client Files

Anthropic & the Big Four: The Arms Race is On

Over the last week, PwC and KPMG made major announcements about expanding their partnerships with Anthropic — PwC on May 14 and KPMG just yesterday on May 19 — and it’s shaping up to be a full-blown arms race among the Big Four. Deloitte got there early with its initial deal back in July 2024 and a major expansion in October 2025, while EY remains the only holdout, seemingly charting a somewhat different path.

Deloitte – The Early Adopter

Key Dates: Initial collaboration in July 2024; major expansion October 6, 2025.

Deloitte rolled Claude out to its entire global workforce of more than 470,000 people — Anthropic’s largest enterprise deployment at the time. They’ve built certification programs and are co-developing industry-specific solutions with strong compliance guardrails, focusing on regulated industries like financial services, healthcare, and public sector.

Clearly the firm’s approach has so far been using itself as a proof-of-concept of the benefits of AI, to then be able to credibly roll it out to clients.

PwC – Agentic Transformation

Key Dates: Earlier work in February 2026; major expansion May 14, 2026.

PwC is leaning hard into agentic AI, focusing on three core areas: building agentic AI systems for clients, incorporating AI into deal-making processes, and redesigning enterprise functions, with the “Office of the CFO” positioned as an early flagship application.

The multi-year initiative includes training and certifying 30,000 professionals (primarily in the US initially), rolling out specialized tools such as Claude Code (for agentic software development) and Claude Cowork (for productivity workflows integrated into documents, spreadsheets, and presentations), and establishing a joint Center of Excellence.

This direction signals a clear focus on deep transformation.

KPMG – Embedded AI

Key Date: Global alliance announced May 19, 2026 (yesterday).

KPMG is giving Claude to all 276,000+ employees and embedding it directly into core platforms via the new “KPMG Digital Gateway Powered by Claude” on Microsoft Azure. The firm has also been named Anthropic’s preferred partner for private equity and private capital markets.

Their main focus is building agentic workflows for tax, audit, advisory, and legal work — a move that plays directly to the immense strength of KPMG’s global tax practice.

EY – Sitting This One Out (For Now)

EY has made no major direct partnership announcement with Anthropic. Instead, the firm is doubling down on its own EY.ai Agentic Platform and alliances with players like Microsoft, NVIDIA, and Databricks. They remain very active in AI, especially in tax, risk, and finance transformation, but appear to prefer a broader, more independent ecosystem approach.

The AI Battle Ahead

This scramble isn’t surprising at all. Frontier AI like Claude is rapidly moving from experimental pilots to core business infrastructure, and the firms that can best weave it together with deep industry knowledge, regulatory expertise, and change-management muscle are positioning themselves for what looks like a massive wave of consulting and technology work ahead — the kind that will keep the next generation of Big Four partners very busy, and well compensated, indeed.

Evergrande Liquidators Seek $8.4 Billion from PwC

On Monday, the Hong Kong High Court heard the arguments for and against retaining PwC International as a defendant in the case brought by Evergrande’s liquidators, who are seeking 57 billion yuan ($8.4 billion) in damages from the firm over alleged negligent audits (primarily 2017–2020 financials, with focus on overstated revenues). Of the total, up to 38 billion yuan (~$5.5B) could apply to PwC International.

The firm has already incurred major penalties in relation to the Evergrande audits. PwC Hong Kong settled for HK$1.3 billion (~$166M) in fines/compensation in April 2026, while PwC China received a record 441 million yuan (~$62M) fine + 6-month suspension in 2024. The reputational damage has also been considerable, and ongoing, with two former PwC China partners involved in the audits detained under criminal investigation.

PwC International’s lawyer, Richard Handyside, argued that the global network entity was not involved in the failed audits in question, that Hong Kong/China firms are not its subsidiaries, and that it had no duty of care to Evergrande investors and other stakeholders. Liquidators Edward Middleton and Tiffany Wong (Alvarez & Marsal) countered that the international entity was nonetheless responsible for audit quality standards across the PwC network.

This case is shaping up as a major test of network liability for the entire Big Four — how much responsibility does the global coordinating entity bear for the work of member firms in high-risk jurisdictions like China?

Deputy High Court Judge Patrick Fung Pak-tung is expected to issue a decision by August.

Deloitte Finalizes SCANA Settlement

Deloitte has finalized a $34 million settlement with SCANA investors, resolving a six-year securities class action. The agreement, which received final court approval in March 2026, stems from claims that the firm’s clean audit opinions failed to flag major cost overruns and delays in the utility’s failed V.C. Summer nuclear project.

Notably, this outcome represents a shift from regulatory enforcement toward private litigation in the courts. Auditor liability cases have historically been extremely difficult for investors to win under securities law, making this one of the largest auditor settlements in the past decade and signaling growing potential for private actions to hold Big Four firms accountable when regulatory scrutiny eases.

Ex-Deloitte Employee Sues Over Parental Leave Discrimination

Joanne Kim Barela spent 13 years at Deloitte’s Human Capital Consulting practice, earning three promotions and consistently receiving “Strong” or “Exceptional” performance ratings.

She took approved protected leave in 2020 and 2024 for pregnancy-related conditions and newborn care. After both leaves, she returned to strong performance, receiving a $9,100 salary increase and a $37,700 bonus in 2025.

Despite this track record, Barela was terminated in December 2025 during a company-wide reduction in force. According to her complaint, her performance metrics were evaluated without accounting for her protected leave time, putting her at a disadvantage compared to colleagues who worked full years.

She has since filed charges with the California Civil Rights Department and the EEOC, and has received a right-to-sue letter.

EY UK Demotes Equity Partners

EY UK has demoted thirty consulting equity partners to salaried (non-equity) roles as part of a broader shift away from the traditional “job-for-life” partnership model. The moves, which have been ongoing since the firm introduced a salaried partner tier in 2022, aim to concentrate profits and rewards among top-performing partners amid slower growth and margin pressures in the UK market.

This quiet restructuring reflects a wider Big Four trend of prioritizing performance and profitability over tenure and loyalty, with affected partners retaining the title but losing access to the equity profit pool.

EY Canada Retracts Report after GPTZero Investigation Reveals Multiple Hallucinations

After the two AI faux pas made by Deloitte last year, which led to the firm having to retract reports in Australia (“Assuring Integrity in the Targeted Compliance Framework” report) and Canada (Healthcare Transformation Strategy), it is now EY’s turn to deal with an embarrassing case of AI hallucinations. The firm had to withdraw a report (“Points of Attack: Uncovering Cyber Threats and Fraud in Loyalty Systems”) after GPTZero conducted a detailed investigation that revealed the document was riddled with fabricated citations and inconsistent data.

Key Findings by GPTZero:

• 16 out of 27 references were hallucinated (broken or non-existent URLs)

• References to a non-existent McKinsey & Company – Loyalty Economics Report (2022)

• Made-up statistics and mis-attributed claims

• The report was estimated to be 72% AI-generated

“Publishing a report online is essentially a form of data injection into the pool of knowledge that is the internet. When the report includes fake information (either vibed citations or false claims) it can ‘poison the well’ by misleading future researchers, especially if the report is published by a well-known consulting firm...”

— GPTZero researchers: Om Ogale, Paul Esau, Alex Cui

The root of such problematic episodes lies in longstanding Big Four review habits. Partners routinely delegate research, drafting, and citation work to their subordinates, then perform only high-level reviews — assuming the team has done its homework on sources and data.

This model worked well enough in a purely human environment, but it is no longer fit for purpose in the age of generative AI, which can produce convincing but entirely fabricated references in seconds. Without updated vetting processes — such as mandatory citation audits, clear AI-use disclosures, and stronger partner accountability — these damaging episodes are likely to become a regular feature of Big Four thought leadership.

EY Australia Tightens Parental Leave Rules

It’s not just Deloitte that has blipped on the radar because of parental leave this week. EY Australia has introduced stricter eligibility and return-to-work requirements for its 26-week full-pay parental leave policy for either parent, which is significantly more generous than the statutory minimum, which is based on minimum wage.

Effective 1 July 2026, employees must now complete at least six months of service before becoming eligible, and those who take 12 weeks or more parental leave must repay eight weeks’ pay if they resign within 12 months of returning to work.

The six-month service requirement is understandable. Without any eligibility period, there is a legitimate risk of the policy attracting short-term applicants primarily seeking the benefit.

However, the one-year repayment obligation is draconian. New parents — particularly mothers — can encounter unexpected challenges after birth, including postnatal depression, health complications, or childcare crises, which sometimes lead to resignation. While it may make financial sense for the firm to recoup part of the benefits in such cases, the policy sends a punitive and unsupportive message, particularly to long-serving employees.

Hopefully the backlash will encourage EY to come up with a more balanced approach – for example linking any repayment to tenure, such as a sliding scale based on years of service, or carve-outs for genuine medical or family emergencies. The firm is still on time to fix this before the planned July 1 rollout.

KPMG Australia Admits Senior Partner Misused Confidential Files

KPMG Australia has admitted that a senior audit partner improperly accessed and used confidential board documents belonging to longtime client Lendlease. The documents were viewed and displayed while the firm was preparing a pitch to win the external audit for Westpac, one of Australia’s largest banking clients.

The admission, made on 14 May 2026, came after months of initial denials and followed allegations raised under parliamentary privilege by Labor Senator Deborah O’Neill in March 2026.

The documents were allegedly taken from Lendlease by the lead partners on the account — Eileen Hoggett (KPMG Australia’s Chief Operating Officer) and Paul Rogers. They were physically secured in Ms Hoggett’s locker before being circulated internally within KPMG and displayed to members of the Westpac pitch team.

KPMG has told Lendlease that the documents were of “low sensitivity” and provided “zero competitive advantage.” However, the incident has triggered serious concerns about auditor independence, client confidentiality, and the effectiveness of the firm’s internal controls — particularly given KPMG’s 65+ year audit relationship with Lendlease.

According to a Financial Times report, McKinsey is implementing an internal overhaul codenamed Project Acorn. The firm is shifting a larger portion of partners’ profit distributions from immediate cash payouts to equity. This change is designed to strengthen the firm’s capital reserves while adapting to more volatile, performance-linked revenue streams.

Why Is This Happening?

The consulting industry’s traditional economic model — high-margin, time-based billing — is under pressure from multiple directions:

Outcome-Based Pricing is Becoming the Norm. Clients, especially large enterprises, are no longer willing to pay premium rates simply for hours worked. They are pushing for “success fees” based on metrics such as savings or productivity improvements.

Artificial intelligence is also dramatically accelerating project timelines and reducing the need for large teams of junior consultants who once formed the backbone of billable hours. What used to take months of on-site analysis can now be supported (or in some cases replaced) by AI tools. This creates both opportunity and revenue uncertainty.

To stay ahead, firms must invest heavily in proprietary AI platforms, data capabilities and industry-specific solutions. Holding more capital internally gives leadership greater flexibility to make these bets without relying on external debt or diluting ownership.

The Big Four Angle — Especially for Deloitte

McKinsey may well be the canary in the coal mine.

While McKinsey operates as a pure-play strategy and management consultancy, the Big Four have broader service portfolios — but consulting is a large chunk of their annual revenue.

Deloitte stands out in particular. Roughly two-thirds of its global revenue now comes from consulting and advisory work. This makes the firm highly sensitive to changes in pricing models, AI disruption of traditional delivery, and the capital requirements needed to compete at the highest level.

The four firms are investing billions of dollars on talent, tools and intellectual property — investments that are harder to fund if cash flows become lumpier due to outcome-based contracts.

Shifting more partner compensation toward equity is an elegant solution: it builds a stronger internal capital base without raising outside money or cutting distributions too aggressively. It also better aligns partner incentives with the firm’s long-term health.

AI has already upended the traditional pyramid leverage model of the firms. Clearly, partner compensation is next.

The Admission

The firm confirmed today that Paul Rogers, a senior audit partner, accessed confidential Lendlease board materials and used them in the context of the Westpac tender. This comes after months of denials following explosive whistleblower allegations first raised in Parliament.

How the Scandal Unfolded

March 2026 — Labor Senator Deborah O’Neill, Chair of the Parliamentary Joint Committee on Corporations and Financial Services, used parliamentary privilege to publicly air allegations from a former senior KPMG executive.

Key claims included:

• Confidential Lendlease board papers were taken, secured (reportedly in the locker of then-Chief Operating Officer Eileen Hoggett), circulated internally, and allegedly used to strengthen KPMG’s pitch for major audit contracts, including Westpac and Dexus.

• KPMG had acted as Lendlease’s auditor for over 65 years.

• Additional concerns around a “concentration of former KPMG partners” in decision-making roles at Westpac, potentially compromising tender integrity.

KPMG initially responded by stating it had engaged two external law firms to investigate the claims and found no substantiation. The firm also noted the whistleblower had failed to provide sufficient additional evidence despite multiple requests.

April–May 2026 — The parliamentary committee held private hearings with the whistleblower and issued formal warnings to KPMG CEO Andrew Yates and Chairman Martin Sheppard. Pressure continued to mount.

Today (14 May 2026) — KPMG has now formally admitted the core breach involving the Lendlease documents.

Broader Context

This is the latest in a string of high-profile issues for KPMG Australia, following the 2021 exam-cheating scandal (which resulted in a A$615,000 fine) and more recent internal AI cheating cases.

It also continues the intense parliamentary and regulatory scrutiny of the Big Four firms in Australia, which began in earnest after the PwC tax leaks scandal.

What Happens Next?

• The Parliamentary Joint Committee is expected to continue its inquiry.

• Potential regulatory action from ASIC and/or professional accounting bodies.

• Reputational damage and possible client fallout.

• Ongoing questions about KPMG’s internal controls, whistleblower handling, and ethical culture.

Senator O’Neill described the admission as “vindication for the whistleblower.”

Whether you work inside the Big Four, compete with them, regulate them, or simply want to understand how they shape global business, you’re in the right place.

Glad to have you here. New updates drop regularly.