KPMG Australia has lost its CEO, its chairman, and its chief operating officer. It’s facing a parliamentary inquiry with powers to compel documents and examine witnesses. Lendlease, a client for 68 years, walked. Macquarie Group’s $75-95m account, gone. Hundreds of jobs cut.
None of this arrived without warning. The exposure was visible for years. What was missing wasn’t information. It was a reputation management plan.
Strategy is not a tactic
Most organisations confuse reputation management with reputation tactics. They invest in search engine optimisation, AI answer engine optimisation, generative engine optimisation (SEO, AEO, GEO). These are useful but insufficient.
Tactical tools determine how you’re found. Strategic thinking determines what people find when they get there.
KPMG had every tactical advantage: a global brand, a professional communications team, highly regarded legal advisors. None of it mattered when the parliamentary committee interrogated the chairman. Allens, one of the law firms behind the investigation, had years of reputational capital. One engagement undid it.
How long would it take your organisation to lose the trust it’s built?
The Author – Peter Wilkinson
Establish the starting point
Before setting where we want to finish, establish the starting point. What do the people who matter actually think of you? Why? Where does their experience differ from what you say about yourself?
Start with the aim
A reputation management plan begins with an answer to one question: what do we want people to believe about us, and is it true?
If the answer is true, the strategy is communication. If it isn’t, the strategy is change.
Many organisations skip this step. They draft a purpose statement, approve it at board level, and move straight to execution. Or set and forget. The gap between the statement and the behaviour is where crisis communications failure begins.
Set objectives that can be checked
Objectives should be specific to each stakeholder who matters: the board, employees, clients and suppliers, media, social media, regulators, politicians. Each group measures your credibility differently. Each needs a commitment they can trace.
Trust = truth + transparency + traceability. A promise nobody can trace is not a strategy. It’s a hope.
Weak: “Ensure seen as a trusted, ethical organisation that puts people first.”
Strong: “Ensure we are seen as a trusted, ethical organisation by publishing our safety numbers against target, every quarter, unedited.”
Only one of those can be verified. The other is decoration.
Which version sits in your current plan?
Implementation is three jobs, done all the time
Building. Earn trust through behaviour people can verify. Bunnings has topped Roy Morgan’s trust rankings for eleven consecutive quarters. No campaign got it there.
Commonwealth Bank is the counter-example that proves the model. After the 2018 Royal Commission, the bank was deep in distrust territory. It changed behaviour, reported on it, and sustained that for years. By late 2025 it had climbed to fourth most trusted brand in Australia. By 2026 it won Roy Morgan’s Most Trusted Bank award. That recovery wasn’t a tactic. It was consistency, verified.
Protecting. Know your exposure before it becomes a headline. KPMG’s whistleblower complaint was active for years before it reached parliament. The firm’s own transparency reports omitted any mention of it. An issues register, properly reviewed, catches that pattern. An annual risk workshop does not.
What sits on your risk register right now that could become a headline in six months?
Recovering. Acknowledge honestly. Change visibly. Stay consistent for years. The organisations that recover are the ones whose actions match their words long after the cameras leave.
Where the tactical work fits
Implementation involves strategy, tactics and a timeline, applied to each stakeholder or business objective.
If the stakeholder is media, the strategy might be proactive engagement; the tactic might be meeting one journalist per publisher; the timeline might be six months. If the stakeholder is the regulator, the strategy might be pre-emptive disclosure; the tactic might be quarterly briefings; the timeline starts now.
SEO, AEO and GEO sit here too. They’re real disciplines, becoming more important as AI reshapes how organisations are discovered and assessed. But they amplify what’s already there. If the underlying story is weak, optimisation helps people find the weakness faster.
Reputation follows behaviour
A reputation management plan cannot compensate for behaviour that contradicts it. Sometimes the most important reputation advice has nothing to do with communications: change the policy, fix the product, treat people differently, accept the cost.
That is the point KPMG illustrates. Reputation management is not just about managing what people think. It is about understanding why they think it, and deciding whether the organisation needs to change what it says, what it does, or both.
Update, October 2026
A reputation management plan has to hold up long after the plan is written. Two newer pieces take it further.
If you are building, how to improve your reputation puts the plan on one page: Aim, Context, Guiding Principles, Objectives, Implementation.
If the damage is already public, recovering a damaged reputation starts with the same principles. NJ Ashton owned up on the morning. PwC told the truth in instalments.
