KPMG Audit Crisis: What Australia’s Macquarie-Lendlease Affair Reveals About India

By P. SESH KUMAR

The controversy over confidential audit information, whistleblower protection and boardroom conflicts exposes gaps between declaring independence and enforcing it.

New Delhi, September 2026 — There is a particular cruelty in the way a well-turned phrase can wait, quietly, for years, and then come back for its author.

In two thousand and eighteen, Michelle Hinchliffe, then head of audit at KPMG in the United Kingdom, was asked by British parliamentarians whether her firm’s comfortable nineteen-year relationship with Carillion had dulled its scepticism. Carillion had just collapsed, with roughly seven billion pounds of liabilities and three thousand jobs lost. Her answer was elegant, and on its face unanswerable. Independence, she said, is a mindset.

It was the right answer. It was also the wrong kind of right answer, because it converts a set of enforceable rules into a state of mind, and a state of mind can only be verified by the person who holds it.

Eight years on, the sentence has come back. Hinchliffe retired from KPMG in two thousand and twenty-two after thirty-seven years, joined the boards of Macquarie Group and Macquarie Bank as an independent director, and now chairs both board audit committees. She is the person whose social calendar has become the most closely read document in Australian corporate governance.

Let me say at the outset what this is not. It is not a finding against her. Macquarie has said, on the record, that her conflicts were declared and that she recused herself from scoring the firms and from the decision to appoint KPMG. The allegations rest on a single whistleblower’s account, amplified by a single newspaper, and have not been tested anywhere. The interesting question is not whether one director behaved badly. It is why a system with four layers of governance, two law firms and a global network’s risk apparatus could not answer that question for two years, and needed a senator with parliamentary privilege to force it.

A folder, a lunch, and a laptop.

The Macquarie affair is a tributary, not the river. The river begins in mid two thousand and twenty-three, with a folder of Lendlease board papers.

Lendlease had been a KPMG audit client for some sixty-eight years. Its board papers contained, among other things, assessments of competing audit bids submitted by rival firms. On two occasions, KPMG partners accessed that folder. In October, seven people from KPMG’s audit business met to prepare a partner for the Westpac audit tender, then worth about thirty-two million Australian dollars a year. During that meeting, confidential material drawn from the Lendlease papers, including the rival bid assessments, was displayed.

Then comes the sentence worth pausing over. On the thirtieth of May two thousand and twenty-four, a KPMG audit director made a formal internal disclosure about the misuse of client board papers. On the same day, the firm’s head of audit authorised a search of his work laptop. Within weeks he was told to relocate or be terminated. That November, the firm covertly searched his machine twice more, found documents setting out further allegations, copied them, and circulated them to the chief executive.

Read that again. The firm did not investigate the allegations. It acquired them. It obtained a fuller picture of its own misconduct by reading the whistleblower’s files than it ever obtained by asking its partners questions. And when it later engaged external lawyers, it gave them the narrower picture.

The Macquarie thread.

Macquarie’s audit had been with PwC for more than three decades, which is itself a governance embarrassment, since thirty years is about three times the tenure contemporary practice tolerates. In late two thousand and twenty-five the group ran a tender and announced that KPMG would take over. Reported figures range from seventy-five to a hundred million Australian dollars a year.

What the whistleblower alleges is that, as early as two thousand and twenty-three, well before the formal tender opened, Hinchliffe told KPMG which areas of expertise would matter to Macquarie in choosing an auditor, recommended particular partners, shared internal data on what the group spent with each of the four large firms, and advised on how a preferred candidate’s credentials might be strengthened before the pitch. Every one of those allegations traces to the same source, and none has been tested by a court.

What is not allegation is this. She personally attended early-stage bid meetings when a rival firm pitched Macquarie’s executives, asking questions and taking detailed notes. Macquarie has disclosed that she recalled six meetings or calls with KPMG partners during the tender period, three in a personal capacity, and added that it was not practicable for her to keep a comprehensive record of every contact, formal and informal. That is an odd thing for a career auditor to write. It is precisely the answer no auditor would accept from a client. And Macquarie’s chairman has conceded to the parliamentary inquiry that the contacts breached the group’s own tender protocol.

In August of this year, Macquarie abandoned KPMG altogether and retained PwC, citing concerns about capacity and about culture. Specifically, a culture that transparently discloses issues. The next comprehensive audit review is not due until two thousand and thirty-one, which means PwC, already three decades in the chair, gets another five years by default. The cure restored the disease.

What kind of wrongdoing this actually is.

Be precise here, because the precision is the lesson. Nobody forged a signature. Nobody took a bribe. No auditor signed a false certificate. This is the conversion of relationship capital into competitive advantage, using information that belonged to somebody else.

It has three moving parts. First, the audit relationship as an intelligence asset. An auditor sits inside the client’s board papers by right, and those papers contain the client’s assessment of the auditor’s competitors. The temptation is not to steal. It is simply not to look away. Lendlease’s folder was not hacked. It was opened by people entitled to open it, for a purpose they were not entitled to pursue.

Second, the alumni network as distribution infrastructure. The large firms’ partner cohorts graduate, over two decades, into precisely the audit committee chairs and chief financial officers who select auditors. We call this a benefit. Financial literacy on boards. It is also a channel. And when the channel and the asset run in the same direction, the result is an information asymmetry no scoring matrix can detect. Hinchliffe did not score the bids. She did not need to. If the allegations are made out, the shaping happened eighteen months upstream of the scoring.

Third, the conflation of disclosure with management. Every actor here did the compliance thing. The conflict was declared. Recusal was performed at the decision point. And none of it mattered, because a conflict of interest is not discharged by announcing it. It is discharged by ceasing to act on it. Indian audit committees, which produce declarations of independence by the crate, should have that sentence framed.

Coforge Board Row: What the Independent Director Crisis Reveals About Corporate Governance

Why nobody noticed, for thirty-three months.

Five design failures explain it, and all five have Indian analogues.

The first is the self-commissioned investigation. KPMG engaged one law firm and later portrayed it as having externally investigated the allegations. That firm told Parliament flatly that it had never been engaged to examine the substance of the claims. A second review, code-named Project Magenta, ran under a scope approved by a subcommittee of KPMG’s own board. It rested on fourteen interviews with senior KPMG figures, twelve of them about thirty minutes long. It did not interview the whistleblower, junior staff, affected clients or rival firms. It accepted interviewees’ credibility partly because of their positions of authority. And it found the allegations unsubstantiated. It became the most damaging exhibit in the affair, not because of what KPMG did, but because of what an independent investigation turned out to mean.

The second is legal professional privilege used as a shield. KPMG asked for the parliamentary examination to be held behind closed doors, reversing only after hours of hostile questioning. Privilege is a legitimate right. It is not a legitimate answer to a legislature.

The third is the partnership form. Australia’s large accounting firms are partnerships, not companies, and so fall outside the direct supervision of the Australian Securities and Investments Commission. Its chair told Parliament that she needs powers to act against the firms themselves, rather than only against individual registered auditors. A regulator that can discipline the surgeon but not the hospital is not a regulator of hospitals.

The fourth is the treatment of the whistleblower as an employment problem. Every other failure was recoverable until the global network declined to investigate, closing the last internal route.

The fifth is the clubby board. Former partners of the same firm chairing audit committees at two of its largest targets. A chairman hosting one of them at his home during a pitch. A salesman from the firm advising a client on how to run the very tender his firm would win. None of this is illegal. All of it is the ordinary social texture of a small elite market. That is exactly the problem. In a market of four firms and a few hundred large listed clients, ordinary social texture is a structural conflict.

How it was actually noticed.

Not by the audit committee. Not by the independent directors, who, it later emerged, had full and unrestricted powers to investigate and did not adequately use them. Not by the global network. Not by the regulator. Not by the external lawyers, two sets of whom produced comfort rather than findings.

It was noticed because one audit director would not stop, and because in March of this year Senator Deborah O’Neill used parliamentary privilege to put his allegations on the public record. Everything that followed flows from that one speech. The resignation of a chief executive, a head of audit, a chairman and a general counsel. The expulsion of a former chief operating officer. Four regulatory investigations. A Commonwealth procurement pause. A Treasury paper contemplating the structural separation of audit from consulting. And the loss of Lendlease, of Macquarie, and of Insurance Australia Group.

For an Indian listener, and particularly for anyone who has served in an audit institution, this is the single most important fact in the file. The detection mechanism that worked was not any of the ones designed to work. It was a legislature with the appetite and the power to compel testimony in public, coupled with a press that would not let go.

The punishment, and whether it fits.

Three senior partners were fined. Roughly forty thousand Australian dollars on one, twenty-two thousand on another, nineteen thousand on a third. Two of those penalties had been reduced after the chief executive intervened, and all came sixteen days after the allegations became public, having been recommended nine months earlier.

Put the defence at its strongest, because it is not frivolous. No financial statement was falsified. No investor lost money. The firm self-corrected, eventually, repudiating its own investigations, apologising, expelling a partner and replacing its entire senior leadership. Roughly four hundred people have lost their jobs for conduct they had nothing to do with. On this reading the sanction is not too light. It is over-determined, and it falls hardest on the innocent.

That case fails, on three grounds. The materiality of a client’s confidential information is assessed by the client, not by the party that misappropriated it. A forty-thousand-dollar fine in a firm with two and a quarter billion dollars of revenue, against mandates worth up to a hundred million a year, is not a deterrent. It is a licensing fee. And the gravamen of the offence is not the leak at all. It is the eighteen-month cover-up, for which not one person has faced a criminal charge. The entity itself walks, because a partnership lies beyond the regulator’s direct reach. The commercial punishment has been severe, but commercial punishment is not accountability. It is the market pricing a risk. The law has been a spectator at its own trial.

UPI MDR Explained: Who Really Pays for “Free” Payments in India?

The Indian mirror.

An Indian listener might file this as Antipodean theatre. That would be a mistake, for two reasons. The firms are the same firms, and the architecture of failure is the same architecture.

Begin with our founding wound. Satyam collapsed in two thousand and nine. The auditors were affiliates of the Price Waterhouse network. Nine years later the Securities and Exchange Board of India barred entities practising under that banner from certifying listed companies. The Securities Appellate Tribunal quashed the ban, holding that the regulator had no jurisdiction over audit quality. The Supreme Court stayed that finding. A decade of litigation produced a jurisdictional muddle and a disgorgement. It is our version of the Australian discovery that nobody can reach the firm.

The National Financial Reporting Authority was the institutional answer, and here India is genuinely ahead. Unlike its Australian counterpart, it can act against audit firms as well as individual partners. Two crore rupees on a Big Four firm in the Zee Entertainment matter. Four and a half crore in Reliance Capital, with ten-year and five-year debarments. Set against forty thousand Australian dollars, these are serious numbers.

But the mirror reflects the Australian defects faithfully on independence. The Authority’s inspection reports this year flagged that one Big Four firm’s non-audit-services policy applied only to its Indian entities, leaving the network’s foreign members free to sell services to Indian clients’ group companies. The firm’s response was to cite guidance that section one hundred and forty-four of the Companies Act applies only to domestic networks. If the prohibition stops at the border of a global network, it is a prohibition on the letterhead rather than on the conduct.

And now the point I want you to carry away. India has a revolving-door rule, and it is a good one. Section one hundred and forty-nine, sub-section six, clause e, disqualifies from independent directorship anyone who was a partner of a firm of auditors of the company in any of the three preceding financial years. But it attaches to the firm that audits you. It says nothing about the firm bidding to audit you. An Indian audit committee chair who spent thirty-seven years at firm X, and whose company is audited by firm Y, is perfectly eligible today to chair the committee that evaluates firm X’s bid to replace firm Y. Our statute would not have stopped the Macquarie situation. It would only have stopped it after the bidder won.

Where India does lead is rotation. We have mandated since two thousand and thirteen that listed companies rotate audit partners every five years and audit firms every ten. Australia is only now debating tendering every decade. Had our rule applied in Sydney, the sixty-eight-year and thirty-year engagements that made those board papers so valuable would have been impossible. And for government companies, the Comptroller and Auditor General appoints the statutory auditor. Whatever the shortcomings of empanelment, the design principle is exactly right, and this affair vindicates it. The auditee should not choose its own examiner.

What India should do, and the final word.

On the statute book, India is ahead of Australia on nearly every dimension this scandal exposed. And yet the Australian profession has in six months faced two eleven-hour public hearings, thirty-odd witnesses under oath and a government review of a firm’s culture. India has had nothing comparable. Our committees have never put the managing partners of the Indian member firms in a public chair and asked them, under oath, what happened to the last whistleblower who wrote to them.

So, four things. Close the bidding-firm hole in section one hundred and forty-nine. The Corporate Laws Amendment Bill is still before Parliament, which makes this a drafting amendment available now, at no cost. Require, through the listing regulations, that every audit tender run under a published protocol with a no-contact rule, a contact log and disqualification for breach, because a protocol with no consequence attached is not a control. Make investigation independence a matter of law rather than of taste. And settle the network question on non-audit services, because the present position is an invitation to arbitrage.

A word, finally, to audit committees, since they are the only actors here who could have stopped this at any point and did not. An audit committee that treats a declared conflict as a resolved conflict has misunderstood its function. If a member has spent a professional lifetime inside a bidder, the duty is not to record the fact and move on. It is to remove that member from the room, in writing, for the whole of the process, and to say so publicly. The cost of doing that is one uncomfortable meeting. The cost of not doing it, as Macquarie has now demonstrated, is a hundred million dollars a year and a question its investors are asking out loud.

This affair will be taught, eventually, as a case about confidential information. That will be a pity, because it is really a case about the difference between a virtue and a control. Every person in this story believed themselves to possess the virtue. The head of audit who told Parliament that independence was a mindset believed it. The chairman who assured shareholders the conflicts had been managed believed it. The law firms that produced comfort believed they had done careful work. The only person who behaved as though independence were a rule rather than a feeling was the audit director who wrote it down, had his laptop searched the same day, and was told to move cities.

India is, at this moment, holding a Bill that would give its audit regulator something close to the powers Australia’s regulator is publicly begging for. A parliamentary committee has recommended trimming it. There will be a season of submissions explaining that the cooling-off is onerous, that the non-audit ban is disproportionate, that a risk-based approach would be more mature. Every one of those submissions will be written by people who sincerely believe that independence is a mindset. They are not lying. That is exactly the difficulty.

(This is an opinion piece. Views expressed are the author’s own.)

How 303 Gold Bars Exposed a Fake CIA Programme and a $40 Million Control Failure

Follow The Raisina Hills on WhatsApp, Instagram, YouTube, Facebook, and LinkedIn

About The Author