How do you manage a reputation crisis?

You manage a reputation crisis by confirming the truth before you speak, staying transparent enough that a paper trail never reads as a cover-up, and moving at the speed the story’s already moving, not the speed legal caution prefers.

Most guidance treats a reputation crisis as a messaging problem. Get the statement right, engage the right agency, control the narrative. That’s backwards. Organisations rarely fail because a statement was worded poorly. They fail because it arrived too late, from the wrong person, after someone else had already reframed the story. Getting the wording right matters far less than deciding, before those words are needed, who’s personally accountable and how fast they’ll speak.

The starting point isn’t a draft press release. It’s a decision made in advance: who’s the named, personally accountable person who’ll speak if a serious allegation becomes public, and how quickly can they be in front of it. An organisation working that out for the first time under deadline pressure has already lost time it didn’t need to lose. That decision, made before a crisis, is what separates a considered response from a reactive one.

KPMG Australia’s 2026 crisis shows what happens when that decision gets made too late. In June, chairman Martin Sheppard and senior partners Paul Rogers and Eileen Hoggett resigned after a parliamentary committee, Australia’s equivalent of a US congressional hearing or a UK select committee, heard whistleblower allegations that staff had used confidential Optus information to help win a rival Telstra audit tender, and had allegedly drawn on Lendlease board papers to support other bids. The firm’s chief executive and audit chief had already departed before that. Sheppard initially placed key documents behind legal professional privilege, a move the committee treated as concealment. He later reversed the decision, but only after the damage was done.

The consequences kept compounding. The Department of Finance, the federal agency responsible for government contracts and procurement, labelled the matter a significant event and placed more than $270 million in KPMG’s government contracts under review. By July, KPMG had been barred from bidding for new federal contracts until 30 September 2026, Canberra Times 1. Delay didn’t cause KPMG’s crisis. It made an existing crisis considerably more expensive, and it’s the same pattern that turns ordinary crisis communications pressure into a much longer, costlier story.

Trust breaks down through three named failures, and each one needs a different fix. Truth is what you know. Transparency is what you show. Traceability is what you can’t hide.

Truth means confirming what actually happened before you say anything publicly, not stating what you hope happened and correcting it later. It isn’t the same as releasing every internal detail, only the material facts you can stand behind. Optus’s 2022 data breach shows the cost of getting this wrong. The attack ultimately compromised identification documents for more than two million customers, ABC News 2, and the picture of exactly who was affected, and how badly, kept shifting in the days after the breach was first confirmed. That shifting picture did almost as much damage to public confidence as the breach itself.

Transparency means showing your actual chain of accountability, not managing how much of it becomes visible. It isn’t the same as transparency in general terms, like issuing regular updates. When PwC Australia’s tax leaks scandal broke in 2023, the firm initially treated the leak as an isolated incident and declined to name every partner whose details had been redacted from the leaked emails, ABC News 3. That partial transparency read, fair or not, as continued concealment, and it cost the firm its chief executive within weeks.

Traceability means accepting that a regulator, journalist, or committee will eventually reconstruct what happened, whether or not you volunteer it first. It isn’t the same as hoping a sensitive detail stays buried. At KPMG, a parliamentary committee, not the firm itself, ended up supplying the proof. Board papers, internal emails, and tender documents now sit in searchable systems a committee or journalist can query in minutes, not months.

The same logic scales down to individuals. Wondering how to change your reputation at work means facing a smaller version of the same problem: other people’s account of you outlasts your own until you supply a better one, consistently, over time. That’s how to change your reputation, whether the setting’s a boardroom or a single team. There’s no shortcut for how to get back your reputation once it’s lost, and this is where CEO reputation management in Australia diverges from standard advice: a chief executive needs a personal message, not just a company one, stating what they knew, when they knew it, and what changes now.

A weak opening line reads like this: “We take this matter extremely seriously and are cooperating fully with all relevant parties.” It says nothing specific and commits to nothing.

A strong opening line reads like this: “On Tuesday we confirmed that two client files were accessed without authorisation. Here’s what we know, what we don’t yet know, and when we’ll update you next.” The strong version states a fact, a boundary, and a deadline. The weak version states an intention with no content behind it.

• The chair or chief executive must establish personal accountability by delivering the first public statement themselves, not through a spokesperson.
• General counsel must protect the organisation’s legal position without using it to block the disclosure timeline.
• The communications lead must ensure one consistent public message travels across every channel, including internal ones.
• The board must restore stakeholder confidence by committing to a named, dated remediation plan, not a general assurance.

Who in your organisation is actually authorised to say something true in the first hour, before legal has cleared a single word? Most boards don’t know the answer until they need it.