KPMG leaked confidential Optus information and surveilled whistleblower’s laptop, inquiry hears

KPMG has admitted to another breach of ethics after its staff leaked Optus’ confidential information to colleagues bidding for an audit contract with Telstra.

The consulting firm’s executives also surveilled a whistleblower’s laptop and dismissed the individual as someone with “workplace grievances”, a parliamentary inquiry heard on Friday.

The internal leaks first became public when senator Deborah O’Neill shared the whistleblower’s testimony under parliamentary privilege in a speech on 24 March.

KPMG initially said the allegations had not been substantiated, but in subsequent weeks determined partners had leaked Lendlease’s confidential information and another partner had made an inappropriate remark suggesting colleagues look at Dexus’ confidential information.

On Friday, KPMG’s chair, Martin Sheppard, publicly confirmed for the first time that staff who audited Optus shared unredacted confidential information to the team that was pursuing the audit contract for Telstra, a competitor telco.

“Information moving through an ethical divider … shouldn’t have moved through that divider,” he said at the parliamentary joint committee public hearing in Canberra.

KPMG’s former chief executive Andrew Yates said the confirmation of the Optus leak motivated his decision to resign in May.

“There was evidence to support some of the whistleblower allegations that, had I overseen things differently, we could have found earlier, and it was that day that I realised that I felt I needed to take accountability,” Yates told the inquiry.

Yates said he was paid $1.7m for his resignation notice period, plus $2.4m on retirement as part of the firm’s partnership agreement.

The peak accounting body, Chartered Accountants Australia and New Zealand, said it was investigating Yates and 11 others over the scandal. Its chief executive, Ainslie van Onselen, said she was “disgusted” by the alleged conduct.

Partners Eileen Hoggett and Paul Rogers told the inquiry they had stood down from audit work and were being investigated by the Australian Securities and Investments Commission over their alleged role in leaking Lendlease information.

Tony Lombardo, the chief executive of Lendlease, said KPMG and Yates told him they had investigated and dismissed leak allegations in May 2025, and he was not given any update until the allegations were made public in March.

He told the committee KPMG had since given Lendlease only “piecemeal and sporadic” updates and refused to share its investigations.

KPMG held Lendlease’s audit contract for 68 years. Lendlease will be seeking a new auditor, and Lombardo said it would seek reimbursement from KPMG for the associated costs, the committee heard.

The firm has not substantiated another allegation of KPMG receiving inappropriate guidance and feedback as it bid for and won the major bank Westpac’s audit contract.

‘Culture of fear’

Members of the parliamentary joint committee put heavy scrutiny on KPMG’s initial treatment of the whistleblower as an issue for the human resources department and subsequent failure to address their allegations.

KPMG’s former head of audit, Julian McPherson, told the hearing he authorised a search of the whistleblower’s computer on 30 May 2024, after the whistleblower first spoke up, over worries he might leak KPMG information while pursuing jobs elsewhere.

That day, the whistleblower emailed McPherson to again raise concerns over his colleagues’ actions and warn he was facing retaliation from colleagues for speaking up, the committee heard.

“These are not isolated incidents but instead endemic within the organisation whereby profit and revenue growth is placed above everything else, including integrity, people, wellbeing and fundamentally doing the right thing,” he wrote.

“The lack of speak up culture, the culture of fear, retribution and revenue growth at all costs is not acceptable.”

McPherson said he first spoke to KPMG’s human resources team about the letter, then the legal team.

McPherson said further computer searches were carried out on 21 and 26 November 2024. Yates told the inquiry those searches uncovered evidence for the whistleblower’s allegations that had not previously been raised and KPMG began investigating.

In 2025, the whistleblower signed a deed of release and no longer works for KPMG.

Sheppard did not commit to revisiting the terms of the deed of release to provide the whistleblower with better financial and legal support. Yates said he believed KPMG had not handled the complaints appropriately.

“I don’t think we made the whistleblower feel comfortable through the process,” Yates told the committee.

“I feel that we could have made the process easier and I also feel probably we could have made it a more humanistic approach.”

Senator Paul Scarr put to Yates that the KPMG whistleblower “suffered a horrendous personal mental and career cost”. Yates said he was “deeply distressed” to hear that.