How do you manage a reputation crisis?

KPMG Australia is living proof of how a reputation crisis compounds when leaders hesitate. In June 2026, chairman Martin Sheppard and two senior partners, Paul Rogers and Eileen Hoggett, resigned after a parliamentary committee heard whistleblower allegations that staff had used confidential Optus information to help win a rival Telstra audit tender, and had allegedly drawn on Lendlease board papers to support other bids. The firm’s chief executive and audit chief had already departed before that. Interim chief executive Stan Stavros put it plainly, admitting the firm had not met the standards expected of it.

That admission arrived late, and lateness decides more crises than the original failure does. The Department of Finance labelled the matter a significant event and placed more than $270 million in KPMG’s government contracts under review, while Assistant Treasurer Daniel Mulino confirmed the scandal had reopened debate over capping partner numbers and bringing the Big Four under the Corporations Act. The lesson for any board facing exposure is simple: delay itself becomes a second crisis, and it is often more damaging than whatever prompted it in the first place.

When a crisis breaks, the instinct in most boardrooms is to buy time. Legal teams want to assess exposure first. Executives want the message shaped before it goes public. Sheppard’s early move to place documents behind legal privilege reads as ordinary caution on paper, but the parliamentary committee did not treat it that way. It treated it as concealment.

That reaction is not unusual. A slow, guarded response rarely earns an organisation the protection it is seeking. Instead, it creates a second narrative, the cover-up, and that narrative is frequently harder to survive than the original failure. Journalists and committees read hesitation as evidence, whether or not the reading is fair.

A newsroom producer would have asked a simpler question: what is KPMG hiding, and why does it need privilege to hide it? That is the story editors chase, not the underlying breach itself. Corporate leaders rarely think like editors, and that gap in instinct is precisely why the urge to protect information so often backfires under real crisis communications pressure.

What KPMG needed was not more legal caution. It needed three distinct messages: the facts and timeline, the firm’s commitment to fixing what failed, and a personal message from the leadership actually accountable. KPMG delivered something close to the first, through Stavros. It never really delivered the third, because by the time it might have, the leaders who needed to deliver it had already resigned.

Trust breaks down in a predictable order: truth, transparency, then traceability. KPMG’s problem was never a shortage of policy. It was a shortage of all three at once.

That sequencing matters well beyond this one case. Boards increasingly have to assume a regulator, journalist, or committee will eventually trace what happened, whether or not the organisation volunteers it first. Treating traceability as inevitable, rather than optional, changes how quickly leadership needs to get ahead of a story.

The traceability problem is only getting harder to manage. Board papers, internal emails, and tender documents now sit in searchable systems that a parliamentary committee, a regulator, or a journalist can query in minutes rather than months. Misleading people, or hoping a sensitive detail simply will not surface, is not just wrong. It is increasingly impractical, because the record survives long after the meeting that created it is forgotten.

None of this replaces sound legal advice. Legal caution and reputational judgment are different disciplines, however, and the second is too often subordinated to the first. Boards that want both should bring senior reputation management counsel into the room from the outset, not after the first resignation.

Sheppard did not just lose a chairmanship. He became the public face of a scandal that will follow him past this appointment, and boards consistently underestimate how quickly an institutional failure turns personal for the executive at the top table.

This is where CEO reputation management in Australia diverges from standard corporate crisis response. A chief executive or chair needs a personal message, not just a company one: what they knew, when they knew it, and what they are doing differently now. Stakeholders usually read silence from the top as an absence of accountability, and a statement that sounds legally cleared rather than personally meant does little better.

Peter Wilkinson has advised boards through exactly this kind of exposure for 24 years, and the pattern rarely changes. Executives who have built credibility outside the crisis they are managing recover faster than those whose reputation exists only inside the company they lead.

Boards often treat this as a communications problem to be solved after the fact, once the departure is already public. It is better understood as a governance question that should be answered well before any hearing, namely who in the organisation is prepared to stand up personally, rather than behind a prepared statement, if a serious allegation ever becomes public. An organisation that cannot answer that question quickly has already lost time it did not need to lose.

KPMG’s crisis was visible long before the parliamentary hearing made it public, which is the case for treating issues management in Australia as a standing discipline rather than a reactive scramble.

Organisations that monitor emerging risk are not inventing judgment under deadline pressure. Instead, they have already rehearsed how leadership responds to a serious allegation, so the hard decisions get made once, in calm conditions, and simply get applied when the moment arrives. That is the model behind Wilkinson Confidante, embedding senior counsel before an issue escalates rather than after it already has.

The same discipline applies to how a response is framed once an issue does surface. Clear, concise, and consistent messaging, delivered by people who are actually accountable, does more to protect an organisation than any amount of legal hedging. Consistency in particular is where firms under this kind of pressure tend to fail, because a story that changes shape from one hearing to the next reads, fairly or not, as a story still being managed rather than a story being told straight.

This is not a case for waiting until a committee is already scheduled. It is a case for building the capability well before that point, so that when an emerging issue does surface, the organisation already understands its exposure and already has a tested response ready to go.

The KPMG story is still unfolding, and further departures may follow. Even so, the sequence is already clear: delay, reframe, and eventually admit, always at a higher cost than admitting early would have carried.

Boards facing a similar moment should ask themselves a plainer version of that question now, while there is still time to answer it calmly. If the allegation KPMG faced landed on your organisation tomorrow, would your leadership speak first, or would a regulator, a journalist, or a parliamentary committee end up speaking for you.

If in doubt about spending money, don’t. If in doubt about communicating, do.