KPMG’s investigations had sweeping powers. So why did they fail?

KPMG’s crisis exposes a governance blind spot: legal investigations can establish what happened, but boards need a different review to understand why it happened and how trust and reputation can be rebuilt.

KPMG’s whistleblower crisis has become one of Australia’s most significant corporate governance failures in recent years. It triggered parliamentary inquiries, ASIC investigations, resignations, legal reviews, government contracts being cut and extraordinary public scrutiny. Yet despite the investigations and extensive powers given to those conducting them, one uncomfortable question remains: who truly investigated the leadership failure?

Not simply whether individuals breached policy or had legal authority to access a whistleblower’s laptop. Those questions are rightly the domain of lawyers and regulators. The more important questions are why KPMG’s leadership and governance structures failed to properly test the allegations, why warning signs were not acted upon earlier and why its response appeared to deepen, rather than contain, the crisis.

That distinction matters because organisations rarely lose public trust simply because something goes wrong. They lose it because of how leaders respond once it does.

Why boards reach for lawyers

When allegations of serious misconduct surface, the instinctive response of most boards is to call the lawyers. There are good reasons for this. Directors are immediately confronted by potential regulatory action, litigation, employment issues, disclosure obligations, privilege and personal liability. Lawyers provide a familiar process for establishing facts and navigating those risks, while giving directors confidence they are discharging their duties in a highly uncertain environment.

The problem is not that boards commission legal investigations. They should. The problem is assuming that, once they have, the organisation is investigating everything that matters.

Legal investigations establish facts, test breaches and liability and advise on regulatory exposure. Depending on their mandate, they may also examine broader organisational failures. But they are not always designed to investigate why experienced leaders behaved as they did, whether commercial incentives overwhelmed ethical judgement, why governance mechanisms failed to challenge management, whether warning signs were dismissed or how leadership decisions affected stakeholder trust.

I’ve seen it many times in my career: under pressure, the desire to contain liability can become the organising principle for the crisis response. That is understandable. But when what is legally defensible takes precedence over what is ethically right or consistent with the organisation’s stated values, the response itself can create a secondary crisis and prolong reputational damage.

The stakes extend well beyond legal liability. SenateSHJ’s Crisis Index 300 found listed companies hit by a major crisis suffered an average 35 per cent share-price fall, took more than 400 days to recover, while around one-third never regained their pre-crisis value.

That is where organisations risk falling into what I call the ‘management trap’.

When finding the truth becomes managing the problem

The management trap rarely begins with bad intent. Leadership wants to establish the facts, but as legal exposure grows, commercial consequences become clearer and influential people are implicated, the objective subtly shifts from discovering the truth to managing the consequences.

Attention turns to limiting exposure, protecting commercial relationships and controlling information. Whistleblowers can find themselves scrutinised as closely as the allegations they raise, while decisions are assessed according to whether they are defensible rather than whether they are right.

KPMG provides an uncomfortable example because ASIC has described the episode as a serious breach of trust and questioned whether governance arrangements in accounting partnerships provide meaningful oversight of leadership. ASIC has also told a parliamentary hearing of the difficulties and delays privilege claims can create for regulators trying to establish what occurred.

Each decision may have a legal or procedural rationale. Collectively, however, they can create something more damaging: the impression of an institution managing itself defensively rather than pursuing the truth.

Nor is this uniquely a KPMG problem. The PwC tax leaks scandal exposed shortcomings including excessive CEO power, an overemphasis on revenue growth, insufficient independent voices in governance and a culture that inhibited constructive challenge. PwC’s response ultimately included an independent review of governance, culture and accountability.

Both cases point to the same broader problem: boards are highly practised at investigating breaches. They are less practised at investigating the conditions that produce them.

The missing investigation

Every serious governance failure should therefore prompt consideration of two distinct but complementary independent reviews.

The legal investigation establishes facts, breaches, liability, accountability and regulatory obligations. An Integrity Review examines why the failure happened, how leadership and governance contributed to it, what the organisation’s response did to stakeholder trust and what must fundamentally change.

The two should work alongside each other with clearly different mandates. An Integrity Review should not retry legal findings or interfere with questions of privilege, liability or procedural fairness. Rather, established facts become one input into a broader examination of the organisational system that produced the failure.

Done properly, the Integrity Review should operate as a structured governance process.

It starts by diagnosing the failure: reconstructing the decisions, behaviours, incentives and warning signs that preceded the crisis and examining the choices leaders made once it emerged. It then defines what trust recovery requires, identifying the leadership, governance and stakeholder expectations the organisation now needs to meet.

Next, it tests the trust gap, comparing how leadership believes the organisation behaved with the experience of employees, customers, regulators, investors or other affected stakeholders. Finally, it turns the findings into governance action, assigning owners, changing decision rights, incentives or escalation processes where necessary and establishing measurable proof points the board can use to assess whether governance is improving and trust is returning.

Independence is critical. The review should report directly to the board or an independent board committee, not to executives whose decisions may themselves be under examination.

The distinction between the two reviews is simple. The legal investigation asks: What happened, who is accountable and what are our obligations? The Integrity Review asks: Why did our system produce this behaviour, what did our response reveal about us and what must change for people to trust us again?

Questions a legal review may never answer

An Integrity Review also needs the licence to ask questions that can become uncomfortable inside an organisation under pressure.

When did we stop pursuing the truth and start protecting the institution? Which leadership behaviours, decisions or incentives created the conditions for the crisis? What warning signs or whistleblower concerns did we ignore or fail to escalate, and why?

It should test governance when it mattered most. Did directors receive the full picture or was critical information filtered or softened? Did the board genuinely challenge management? Which decisions were legally defensible but damaged stakeholder trust? Where were small departures from stated values rationalised until they became accepted practice?

Then comes perhaps the most important question: if the same allegation landed on the CEO’s desk tomorrow morning, what would happen differently?

The real test is whether leadership behaviour, incentives, decision rights, escalation processes and board oversight have changed.

What boards should do differently

For CEOs and directors, four practical actions follow.

First, separate legal accountability from integrity diagnosis. Where the seriousness of the failure warrants it, commission both with distinct mandates and independent oversight.

Second, establish what failed and what trust recovery requires. Examine leadership behaviour, incentives, decision-making, warning signs and information flows, then identify the changes needed to prevent recurrence.

Third, measure whether the gap is closing. Use evidence from employees and relevant external stakeholders to test whether leadership’s view of progress matches their experience. Improved perceptions matter, but they must be supported by demonstrable changes in governance and behaviour.

Finally, embed the findings into a reputation governance framework. Assign ownership, establish measurable proof points and require regular reporting to the board on whether changes are working, new risks are emerging and stakeholder confidence is returning.

That turns an Integrity Review from another post-crisis report into a governance mechanism that integrates with risk and compliance systems.

Boards regularly describe reputation and trust as critical organisational assets. If they mean it, failures of integrity should be examined with the same seriousness as failures of finance, safety or cyber security, and the findings should change how the organisation is governed, not simply how the crisis is explained.