Australia's whistleblower protection laws under review amid KPMG audit leaks scandal

It takes a certain kind of inner strength to be a whistleblower.

Courage and determination are obvious traits that whistleblowers share, but blowing the lid on alleged misconduct in the nation's biggest companies and organisations requires a willingness to risk everything.

A whistleblower can risk losing their job, their relationships, and potentially their sanity — if they want to expose wrongdoing.

Several whistleblowers I have spoken to over the years often say that reality is what makes it hard to be a whistleblower in Australia and deters more people from coming forward.

Australia's laws just don't protect them.

The government is now reviewing those laws. The current KPMG audit leaks scandal is a reminder of just how important that review is.

In March, Labor senator Deborah O'Neill shared with parliament a whistleblower's allegations that confidential board papers from Lendlease were used to support bids for major audit tenders for Westpac and Dexus.

And earlier this month, the firm's current and former partners were hauled before a federal inquiry probing why the firm allegedly shared client information and ignored the whistleblower's allegations when they first surfaced.

Now, ahead of the regulator appearing before the inquiry today, ABC News has obtained the key email that was sent by the audit leaks whistleblower to the Australian Securities and Investments Commission (ASIC) last year to report alleged misconduct at the accounting firm.

Whistleblower tried to report in 2025

The whistleblower emailed ASIC in September 2025.

Ccd on that email were senior executives still at KPMG at the time, many of whom have since departed the firm as the scandal unfolded.

This was not the first time the whistleblower had tried contacting ASIC to seek protection for disclosures alleging that the firm had breached corporations law.

The email detailed how the person first tried to blow the whistle internally at KPMG, and that the matters were also taken to KPMG International.

But the whistleblower's serious allegations were dismissed by KPMG as a private employment matter.

As the whistleblower noted in the email to ASIC, at every turn, KPMG Australia "refused to acknowledge my whistleblower status or protections" and "reviews commissioned and controlled by KPMG — including those conducted under legal privilege — cannot credibly be presented as independent".

The whistleblower had approached ASIC "under the continuing threat of retaliatory legal action from KPMG".

"They are issues of public interest that go directly to ASIC's statutory mandate to ensure the integrity of financial reporting, uphold auditor independence, and safeguard confidence in Australian markets.

"Delay in addressing them risks allowing systemic misconduct to continue unchecked, directly undermining market integrity and investor confidence."

Regulator failed to assure whistleblower

While the whistleblower warned ASIC that "the matters I raised are urgent and warrant immediate investigation", it was not until the whistleblower's allegations were aired by Senator O'Neill under parliamentary privilege that ASIC later announced it would investigate the alleged audit leaks.

The whistleblower also tried to seek assurances from ASIC that they would be protected if they make a more detailed complaint, but this never happened.

The regulator closed the complaint days later.

ASIC told ABC News: "ASIC takes all whistleblower reports and allegations of misconduct seriously."

A KPMG spokeswoman told the ABC the firm was also looking to strengthen its whistleblower policy.

"Now, more than ever, we are focused on creating an environment where people feel safe to speak up."

Partnership loophole in whistleblower laws

While another KPMG whistleblower has been critical of ASIC saying the regulator had to be "dragged kicking and screaming to take action", the bigger issue is that laws to protect whistleblowers are inadequate.

ASIC boss Sarah Court alluded to this at the June 19 parliamentary hearing relating to the audit leaks scandal, pointing to "clear gaps in the regulatory settings" and called for the Corporations Act to extend to deal with big partnerships and sanctions applicable to be "significantly increased".

"They need to be extended so that those that are seeking to make disclosures in relation to the conduct of partnerships such as KPMG are clearly protected."

Assistant Treasurer Daniel Mullino is now considering changes to the law that could boost access to justice for whistleblowers and address gaps on who is covered.

Possible bounty-style rewards

Currently disclosures about partnerships and unincorporated associations fall outside "eligible whistleblower" protections. The government is looking to change this.

It will also look at whether anonymous/confidential disclosure protections are "fit for purpose" and whether a proposed financial rewards scheme for whistleblowers is needed.

This would be akin to a bounty-style reward that exists in the United States for some whistleblower disclosures.

Some stakeholders and prior parliamentary inquiries have backed it, but Treasury's consultation paper flags the risk that it could invite a flood of low-value or speculative reports and could make disclosures look profit-motivated rather than public-interest-motivated.

That's why a Whistleblower Protection Authority — a body responsible for investigating whistleblower complaints — remains a live issue.

This "one-stop-shop" body would also be able to conduct investigations if whistleblowers personally suffer consequences for exposing misconduct.

It would also be able to compensate them for losses suffered.

It's a change that Greens finance and public service spokesperson Senator Barbara Pocock backs.

"In the absence of regulators with teeth — ASIC and the Tax Practitioners Board — there is an urgent need for corporate whistleblower protections to extend to the Big 4 and for a new whistleblower authority that actually supports and protects whistleblowers.

"This means ensuring all entities are required to meet the whistleblower provisions of the Corporations Act 2001 and establish a whistleblower authority."

It's an idea well worth considering if Australia wants to change from a nation that penalises whistleblowers to one that values and celebrates them.