KPMG Australia faces contract scrutiny after Services Australia data-handling breach

Traders Union
All News
Business & Wealth
Companies
KPMG contract scrutiny 2025

Highlights

KPMG Australia breached its Services Australia contract in December 2023 by emailing sensitive audit material from a standard KPMG account, prompting potential contract termination discussions.
Despite the breach, Services Australia decided not to terminate KPMG's engagement because the audit was nearly complete and KPMG took remedial action including staff training.
Following the incident, Services Australia awarded KPMG a A$12 million multi-year program assurance contract in 2024 but extended a federal bidding ban on KPMG until Feb. 28 amid wider scrutiny.

Contract breach review and agency response

As reported by Reuters, internal documents show Services Australia considered ending KPMG's contract after a staff member sent a draft audit report marked "OFFICIAL: Sensitive" from a standard KPMG email account instead of a dedicated agency account.

In a Dec. 17 email obtained under Freedom of Information law, a director in the agency's audit branch wrote that KPMG appeared to have taken agency materials outside the network in breach of its contractual obligations. The director recommended seeking an explanation from KPMG and then assessing further action, including contract termination, because no remedy was available for that type of breach.

Sally Bond, the agency's national audit manager, wrote to KPMG on Dec. 23 that information had been transferred outside the Services Australia environment during the engagement and that such transfer was explicitly prohibited under the contract. In a separate email the same day, Bond said the material taken outside the government system was not of particular concern, but added she was more troubled that KPMG had acted outside the contract and had not proactively assured the agency of the breach.

KPMG replied on Dec. 23 that the only document moved outside the agency environment was an internal audit report template, which had been deleted, and that the employee involved would face follow-up action including additional training. An internal cybersecurity review concluded in January that the risk of a data breach was low and closed the matter.

Federal contracting impact and wider scrutiny

Services Australia said KPMG used its own network and email system, rather than the agency's, to develop and distribute a draft internal audit report, but maintained the incident did not amount to a data breach. The agency said it considered its contractual options and chose to complete the engagement instead of terminating it because the work was substantially complete and remedial action had been taken.

The agency added that this was the only known instance of its kind and that it has not awarded KPMG any additional internal audit work since the incident. At the same time, published government tender data show Services Australia awarded KPMG a A$12 million multi-year contract in 2024 for program assurance services and an A$69,850 actuarial services contract in April.

The matter marks the first apparent breach involving KPMG's handling of Australian government client information across a federal contract portfolio worth A$650 million as of 2026. The firm's Australian practice is already under pressure over its admitted sharing of confidential private-sector client information to help pitch for work, while the government said on Thursday it had extended a ban on KPMG bidding for new federal work until Feb. 28 as the firm addresses cultural and governance weaknesses.

Gary Monroe, a University of New South Wales professor specialising in audit, said that regardless of what material was taken outside the government system, the episode represented a breach of trust with the client.

Our earlier article on CTOS Digital’s cybersecurity incident outlined how the breach and resulting service disruptions fueled analyst downgrades and a slide in the company’s share price. We noted management’s estimate that the disruption could cut net profit by RM12 million and revenue by RM16 million, with the risk that extended outages could further pressure earnings and customer confidence.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.