Big 4 misconduct reports to ASIC pile up to 153

In its responses to questions taken on notice during its appearance at a parliamentary hearing into the alleged audit misconduct at KPMG Australia, the Australian Securities and Investments Commission (ASIC) provided updated data since the hearing on 4 September 2026, where it previously identified 139 reports of misconduct at the big four accounting firms.

ASIC has now said that between the extended period of 1 July 2023 and 7 October 2026, it received 153 reports of misconduct relating to the big four firms.

The total cases is a count of case numbers, but does not equal the sum of all PwC, KPMG, EY and Deloitte, as some cases are included in multiple big four firms.

Breaking the figures down, ASIC said 48 of these were from 41 unique potential whistleblowers (three potential whistleblowers lodged multiple reports).

Of these 48 reports from potential whistleblowers, 23 related to auditor conduct, according to ASIC.

ASIC appeared before the parliamentary joint committee on corporations and financial services for the oversight of ASIC, the Takeovers Panel, and the Corporations Legislation, where it provided insight into its investigation and surveillance activities on alleged misconduct at KPMG, as well as EY, Deloitte, and PwC.

ASIC chair Sarah Court told the committee that ASIC had directly received 139 reports of alleged misconduct relating to the big four accounting firms since 1 July 2023, and indicated that the complaints may relate to matters outside audit functions.

According to the latest figures provided by ASIC, out of the 153 reports of misconduct (ROM) it has received about the big four firms, KPMG recorded the highest figure of 53 reports, followed by Deloitte (47) and PwC (42), while EY stood last at 18.

KPMG also had the highest figure for reports from potential whistleblowers, at 22, compared to 16 from Deloitte and just seven from both PwC and EY.

Similarly, KPMG recorded the largest number of ROMs received from potential whistleblowers and related to auditor conduct at 17, as well as ROMs related to alleged whistleblower victimisation or breach of confidentiality (13).

Deloitte had 13 ROMs against it from potential whistleblowers and related to issues other than auditor conduct, compared to five at KPMG, four at PwC, and three at EY.

ASIC also reported that it did not receive a complaint linked with the $500,000 payment KPMG made to a former senior manager who alleged wrongdoing in the firm’s tax division as part of the corporate regulator’s audit firm complaints surveillance.

The allegations made by the former senior manager and a former KPMG tax partner related to claims they had discovered wider wrongdoing by KPMG partners stretching back to the 1990s and early 2000s.

ASIC said that KPMG has since confirmed to it that it did not provide the relevant complaint material in response to ASIC’s notices, “noting that the allegations are significantly dated as is much of the correspondence relating to the matter”.

“KPMG has advised that it is reviewing whether that material was responsive to those notices and will confirm its conclusion with ASIC,” the corporate regulator said.

During its appearance before the committee in September, ASIC said it is reviewing more than 550 internal complaints received by the big four accounting firms relating to alleged misconduct since commencing surveillance from 1 July 2023.

The committee asked why the surveillance commenced during the “arbitrary” July 2023 period, to which ASIC executive director, enforcement and compliance, Chris Savundra, said he suspected it was because it was a reasonable period to begin, adding that the information gathered could lead to formal investigations.

Providing more insights into why it chose to begin its surveillance during this period, ASIC said it considered a range of factors and information, including the purpose of the collection to understand what complaints were telling them about audit practices, intelligence from previous work and engagement with the audit firms.

It also included an initial meeting with each firm to understand their record-keeping practices and the likely volume of responsive material, ASIC said.

“Based on the above, ASIC considered that the period since 1 July 2023 period to the date of the notices, 26 June 2026, would provide the appropriate balance between obtaining sufficient information to assess the nature of the complaints being received, while managing our limited resources and still allowing the surveillance to be undertaken in a timely manner,” ASIC said.

It added, however, that its scope does not limit ASIC’s ability to widen its surveillance to earlier periods where appropriate.

Poor practices at large firms outside ASIC’s remit

In her recent address at the G100 – CPA Australia Annual Reporting Luncheon, Court remarked that the regulatory framework within which ASIC operates is “inadequate” for regulating large multi-disciplinary firms like KPMG.

She noted that ASIC has commenced multiple lines of inquiry and formal investigations into the alleged audit misconduct at KPMG.

“As the regulator in this area, we’re doing what we can to hold misconduct to account, but when it does come to the big auditing firms, our regulatory response is necessarily limited,” she said.

“What all of that means is that many of the poor practices that are alleged and that we’ve been reading about currently fall outside our regulatory remit.”

Court said ASIC is continuing its sector-wide surveillance of the big four audit firms following the KPMG revelations and proposed to share high-level findings before the end of the year.