How to manage corporate reputation?

Corporate Australia has watched a masterclass in reputational self-harm play out at KPMG this year. A whistleblower alleged that senior partners had secretly accessed confidential client information to help the firm win audit work from other companies. The claims sat with KPMG for two years before the whistleblower went to the Senate. By the time the story broke publicly in March, the damage was already compounding.

The lesson arrived quickly. Reputation is not protected by an internal investigation nobody sees. It is protected by what an organisation does the moment a problem surfaces, and by whether that response matches what stakeholders can already verify for themselves.

KPMG Australia refused to sort it out themselves. As a result, under pressure, in June 2026, chairman Martin Sheppard and audit partners Paul Rogers and Eileen Hoggett announced they would leave KPMG Australia, following the earlier exits of CEO Andrew Yates and audit head Julian McPherson.

Every one of those steps was necessary. None of them arrived early enough to prevent the story from becoming a case study in delay.

ASIC opened a formal investigation. Government departments began reviewing contracts.

Corporate reputation management works on three pillars: building, protecting and recovering. Most organisations only discover the second and third pillars exist once a crisis has already broken.

Building reputation is the product of behaviour, governance and culture operating in alignment over years, not the output of a communications team working in isolation. Protecting reputation means understanding exposure before it becomes public, with a response already tested rather than improvised.

Recovering reputation, as KPMG is now finding, takes considerably longer than most boards expect, because trust rebuilds slower than it collapses. This is the discipline behind reputation management done properly: it starts long before anything goes wrong.

The comparison to PwC is instructive rather than incidental. Australia’s parliament had already spent 2023 and 2024 working through multiple recommendations arising from that firm’s confidentiality breach, including restrictions on government tendering.

When a second major firm faces near-identical allegations only a few years later, the story stops being about one organisation’s judgment. It becomes a question about whether an entire sector has learned anything at all, and that is a far harder narrative to control.

Recovery is not a communications exercise. It requires honest acknowledgement of what went wrong, visible and verifiable change, and consistent follow-through over a period stakeholders can actually observe. Consequently, the organisations that recover fastest are usually the ones that started building trust long before anything went wrong.

Issues management exists precisely to shorten this list of surprises. Continuous monitoring of media, social, regulatory and stakeholder signals means a problem is identified while there is still time to shape the outcome, rather than after it has already become a parliamentary hearing. Wilkinson Group’s approach to issues management is built on that same principle: judgment applied early, not intelligence gathered late.

For organisations already under pressure, senior counsel matters more than volume of activity. A board navigating a live reputational threat needs someone who has sat in that room before, not a team assembling a response from a template. That is the proposition behind reputation management delivered as ongoing, embedded counsel, and it is worth understanding the difference between an agency model and direct senior advice before a crisis forces the choice.

Peter Wilkinson’s three decades in newsrooms before over two decades in crisis and reputation consulting inform how he reads these situations. He has advised organisations through royal commissions, governance failures and sustained media investigations, and the pattern is consistent. The businesses that recover are the ones that told the truth early, changed something visible, and kept communicating after the headlines moved on.

If in doubt about spending money, don’t. If in doubt about communicating, do.

Reputation is built in the years before a crisis and spent in the days after one. The organisations that understand that distinction are the ones still trusted when the story is over.