SYDNEY, Oct 23 (Reuters) – KPMG Australia breached a contract with the country’s biggest federal agency by transferring sensitive government material outside its secure environment, prompting officials to consider firing the firm, documents reviewed by Reuters show.
The incident is the global accounting firm’s first apparent violation of client information-handling protocols regarding its vast portfolio of Australian government work — A$650 million ($456 million) in active federal contracts as of 2026.
KPMG’s Australian unit has been at the centre of a scandal over accusations it shared confidential private-sector client information to pitch for work, which it has admitted, but has maintained the conduct did not extend to government contracts.
The government incident in late 2025 involved Services Australia, which operates the country’s public health and welfare systems and handles data of most of the country’s population of 27 million.
Both KPMG and Services Australia said in comments to Reuters the matter did not involve any data breach, however the government agency has not awarded any new audit work to the firm since.
The incident came to light when a KPMG employee sent a draft audit report marked “OFFICIAL: Sensitive” from a KPMG email account rather than from a specifically-assigned account for Services Australia.
“It appears KPMG has taken agency materials outside of the network which is in breach of their obligations under the contract,” a director of the Services Australia audit branch wrote to the agency’s national audit manager, Sally Bond, in a December 17 email obtained under Freedom of Information law.
The director, whose name was redacted, recommended the agency demand an explanation from KPMG then “assess whether any further action is required … including termination of contracts, noting there is no remedy available for a breach of this nature”.
Bond wrote to KPMG a week later saying “information was transferred outside of the Services Australia environment by KPMG during our engagement”, adding the transferral was “explicitly prohibited under the contract”.
“Services Australia takes a breach of this nature extremely seriously,” Bond wrote in the email dated December 23. “We will be in parallel engaging with our relevant agency teams to undertake a review of the situation.”
In an email the same day to another Services Australia general manager, Bond wrote that the information taken outside the government system was not of “particular concern”, but said: “I am more concerned that KPMG has acted outside the contract and has not taken any proactive steps to assure us of this fact”.
In a response to Bond on December 23, KPMG said the only document transferred outside the agency was an internal audit report template which had been deleted, and the KPMG employee involved would face follow-up action, including additional training.
The documents didn’t show whether Services Australia took additional measures, but an internal cybersecurity review into the incident concluded in January that the risk of data breach was low and closed it off.
NO NEW AUDIT WORK FOR KPMG FROM SERVICES AUSTRALIA
KPMG said in a statement to Reuters it “confirmed with Services Australia that no confidential information was exchanged and reminded our people of their obligations in relation to data protocols”.
A Services Australia spokesperson told Reuters KPMG had “used its own network and email system, rather than the agency’s, to develop and distribute a draft internal audit report”, but the incident did not amount to a data breach.
The agency “considered the available contractual options”, the spokesperson added. Since “the work was substantially complete and remedial action had been taken, the agency finalised the engagement rather than terminate the contract”.
“This was the only instance of this type occurring and Services Australia has not awarded KPMG additional internal audit work since the incident,” they said.
The agency gave KPMG an A$12 million multi-year contract in 2024 for “program assurance services”, and in April awarded the firm an A$69,850 contract to provide actuarial services, according to published government tender data.
Gary Monroe, a University of New South Wales professor who specialises in audit, said regardless of what material was taken outside the government system, “it’s a breach of trust with the client”.
On Thursday, the government said it had extended a ban on KPMG bidding for new federal work until February 28, while the firm fixes cultural and governance weaknesses.
($1 = 1.4247 Australian dollars)
(Reporting by Byron Kaye and Christine Chen; Editing by Sonali Paul)
Comments