Mia JonesKPMG Australia's chief operating officer Eileen Hogget stepped aside from her executive role in June 2026, and chief financial officer John Sams absorbed the COO duties as an external re-investigation into mishandled whistleblower allegations widened. Her exit, reported by Capital Brief and Bloomberg Tax, came less than a week after chief executive Andrew Yates and national audit managing partner Julian McPherson also resigned. For the thousands of Australians who work inside large firms, the shake-up raises a practical question: if you report wrongdoing at work, what does the law actually protect?
What triggered the KPMG shake-up
The turmoil traces back to allegations that the firm misused confidential client documents. According to reporting on the affair, the claims include the alleged use of Lendlease board papers to pursue audit work at Westpac and Dexus, and the use of confidential Macquarie and Westpac information to chase other contracts.
The immediate flashpoint was not only the underlying conduct but how the firm handled the person who raised it. Leadership admitted that an earlier internal probe into the data misuse fell short of public and regulatory expectations, prompting an external re-examination. Interim CEO Stan Stavros confirmed Sams had taken on the operating chief's responsibilities while the review continues.
That sequence — a disclosure, a contested internal investigation, then a leadership clean-out — is a textbook example of why Australia rebuilt its whistleblower regime in the first place.
What the Corporations Act protects
Since the Treasury Laws Amendment (Enhancing Whistleblower Protections) Act 2019 took effect on 1 July 2019, corporate whistleblowers have had far stronger legal footing under Part 9.4AAA of the Corporations Act 2001.
The protections are broader than many employees assume. An "eligible whistleblower" is not just a current staff member. The definition covers current and former employees, officers and contractors, as well as their spouses, dependants and other relatives. Suppliers and their employees can qualify too.
To be protected, a disclosure generally must go to an eligible recipient — such as a director, senior manager, auditor or the corporate regulator — and concern misconduct or an improper state of affairs. Crucially, you do not need to be proven right. A disclosure made on reasonable grounds is protected even if a later investigation clears the company.
Two protections matter most in a case like KPMG's. First, confidentiality: it is generally an offence to reveal a whistleblower's identity without consent. Second, protection from detriment: an employer cannot dismiss, demote, harass or otherwise punish someone for making a protected disclosure.
The penalties are not symbolic
The consequences for breaching these rules are substantial. For an individual, the maximum civil penalty is 5,000 penalty units — currently around $1.11 million — or three times any benefit gained, whichever is greater. For a company, the ceiling rises to 50,000 penalty units, roughly $11.1 million.
Courts have shown they will use these powers. In ASIC v TerraCom, penalties totalling $7.5 million were imposed in a matter that reinforced how seriously reprisals against whistleblowers are treated. A whistleblower who suffers detriment can also seek compensation, reinstatement or other court orders directly.
There are obligations on the corporate side as well. Public companies, large proprietary companies and corporate trustees of APRA-regulated super funds have been required to maintain a compliant whistleblower policy since 1 January 2020.
Where a lawyer changes the outcome
The KPMG episode shows how easily a disclosure can go sideways when the process is handled badly. That is exactly where early legal advice pays off. A lawyer who works in employment or corporate whistleblower matters can help you decide who to disclose to so that protection actually attaches, and how to document the disclosure.
If you have already spoken up and now face a demotion, a sudden performance review or exclusion from projects, an expert can assess whether that amounts to unlawful detriment and what remedies apply. The reverse is also true: directors and managers named in a disclosure have their own exposure and often need advice on responding without breaching confidentiality rules.
You can connect with an employment or corporate law specialist through Expert Zoom to understand your position before you act, rather than after damage is done. The stakes — your job, your reputation and, for the company, seven-figure penalties — reward getting it right early.
What to do if you are considering speaking up
Start by writing down what you know, when you learned it and any documents that support it. Check whether the person you plan to tell is an eligible recipient under the Act, because a disclosure to the wrong colleague may not carry the same protection. Consider whether you want your identity kept confidential, and say so explicitly.
If you fear reprisal, or the matter involves large sums or regulatory breaches, seek advice before you disclose. You can also report directly to the Australian Securities and Investments Commission, which sets out the full framework of corporate-sector whistleblower rights and protections on its official whistleblowing page.
The KPMG saga is a reminder that even the country's largest firms can stumble on process. For an individual employee, the difference between a protected disclosure and an exposed one often comes down to a few decisions made at the start.
The wider workplace-rights picture keeps shifting too — from the rights that follow a leadership resignation to new laws changing what conduct carries consequences at work.
This article is general information, not legal advice. Whistleblower protections turn on the specific facts of your situation. Speak with a qualified lawyer before making or acting on a disclosure.
