Services Australia considers terminating KPMG contracts over data handling breach

Services Australia, the agency managing Australia’s public health and welfare systems, considered terminating contracts with KPMG following a breach of sensitive information-handling protocols. Documents reveal that a KPMG employee transferred a draft audit report marked ‘OFFICIAL: Sensitive’ outside of the agency’s secure environment using a standard email account rather than a specifically assigned secure account.

While both KPMG and Services Australia stated that the incident did not constitute a data breach, the agency has not awarded any new audit work to the firm since the event. This follows previous scandals involving KPMG Australia, where the firm admitted to using confidential private-sector client information to secure new business.

A report by Dr. Ian Watt highlighted significant risks in the Commonwealth procurement framework, noting a lack of assurance mechanisms to identify and manage non-compliance by unethical suppliers. Despite KPMG implementing a change program to address unethical practices, a ban on new government work for the firm is expected to continue into 2027.