CA ANZ gives KPMG its tick of approval in recent practice review

Chartered Accountants ANZ has finalised its targeted Quality Practice Review of big four firm KPMG, which examined KPMG’s systems and processes for handling confidential audit client information and promoting an ethical culture.

The review, undertaken from July to October 2026, was based on interviews and a number of documents that were requested from KPMG. KPMG has published the review report from CA ANZ in full on its website.

To conduct the review, CA ANZ interviewed the divisional risk management partner and three other employees from the audit and assurance department; the ethics and independence partner; the chief risk officer and two other employees from KPMG’s quality and risk division; and the national managing partner of People & Inclusion, along with three other employees from People and Inclusion. The current chief executive, John Sams, and members of the board were not interviewed.

The Quality Practice Review by CA ANZ concluded that there were "no significant deficiencies" identified within KPMG’s systems and processes for the storage and handling of confidential information of audit clients within its audit department.

The Corporate Regulator is currently formally investigating the audit department of KPMG in relation to the potential misuse of confidential information belonging to its client Lendlease, and the alleged misuse of confidential information from another client, Optus.

Recent evidence uncovered in an Allens investigation into KPMG also confirmed that confidential audit information was stored in a staff locker and inappropriately shared among employees at the firm.

CA ANZ said in the review report that KPMG had implemented a control environment "encompassing governance, risk assessments, information security practices, incident management and compliance monitoring".

"Confidentiality obligations covering confidential information are embedded within policies, engagement terms and annual compliance processes, with accountability clearly assigned to partners and staff. Information security measures include access controls, secure client portals, data classification requirements, monitoring, data loss prevention activities and safeguards for KPMG Restricted information."

The Quality Practice Review also found that the system and processes for promoting an ethical culture within the audit function and across the organisation more broadly, including the firm’s whistleblower protection policies, to be sufficient.

The whistleblower responsible for bringing the allegations about misconduct at KPMG to light has previously stated that they were targeted with retaliatory behaviour by certain colleagues at the firm after they had raised concerns about the ethics, integrity and culture of KPMG’s audit practice.

CA ANZ stated in the report that KPMG had implemented initiatives intended to embed ethical behaviour and accountability, including the establishment of the Ethics Champions Network, engagement with the Ethics Centre and monitoring ethical culture through surveys and reviews.

"The firm supports reporting of ethical misconduct through various speak-up mechanisms including confidential reporting channels and whistleblower protections, with retaliation monitoring processes in place," the review said.

Senator Tania Lawrence previously criticised KPMG for failing to instil a speak-up culture within the firm.

Former KPMG chief executive Andrew Yates told the Parliament Joint Committee on Corporations and Financial Services during a hearing in August that while he had strived to create a speak-up culture at the firm, it was clear that in the case of the whistleblower the firm had let itself down.

Lawrence said the treatment of the whistleblower by the firm indicated that KPMG "clearly did not have a speak-up culture, bar the whistleblower".

Recently appointed KPMG chief executive John Sams also conceded that speak-up culture was clearly not a "uniform experience" at the firm and said the whistleblower had been failed in this case.

The review did contain suggestions for enhancing ethical behaviour at KPMG, which included additional training, clarifying governance accountability for ethics and conduct, and appointing an independent chief ethics officer.

The review overall concluded that KPMG’s systems and processes relating to the areas reviewed "comply with the applicable mandatory requirements".

Despite the conclusions of the review, CA ANZ said it recognises the concern the matters surrounding the audit division at KPMG have caused members, the profession and the wider community.

"Trust in the accounting and audit profession depends on strong professional standards, effective regulatory oversight and meaningful consequences when those standards are not met," it said.

"CA ANZ will use all mechanisms available to it to hold members accountable under its By-Laws and independent professional conduct framework. We also recognise that professional bodies form only one part of the regulatory system."

The professional body noted that investigations by ASIC and the Tax Practitioners Board remain ongoing alongside CA ANZ’s own professional conduct investigations.

"This may affect the timing and progress of CA ANZ’s investigations as it is appropriate that these higher-order regulatory processes are given the time required to play out," it said.

It also noted that the Quality Practice Review was only one part of CA ANZ’s response to the KPMG matter.

"It is not the conclusion of it. Our separate conduct processes remain ongoing, and we will continue to pursue them independently and in accordance with our role," it said.