Regulating for culture

Sometimes, the questions not asked can matter more than the answer.

At the parliamentary inquiry into KPMG in August, Macquarie chair Glenn Stevens was asked whether he had ever questioned his audit committee chair about her contact with the firm during the investment giant's audit tender.

"I have not put that question to her, and I'm assuming the answer would be no, because that was the protocol," Stevens said.

Michelle Hinchliffe spent 37 years at KPMG, leading its audit practice in Australia and the UK.

She left in February 2022 and soon joined the boards of Macquarie and BHP as a non-executive director. At Macquarie, she chairs the audit committee.

Pushed by the inquiry to put the question to her, Stevens did.

Macquarie's answer disclosed three contacts with members of the KPMG audit team while the tender was live.

In March 2025, Hinchliffe and her husband briefly met with KPMG audit director Charles Hatchman at a restaurant, where he came to excuse himself and his wife from a planned dinner on account of her illness.

In May, Hinchliffe met KPMG chair Martin Sheppard in her capacity as a BHP director. Two days later, she and her husband shared a meal with KPMG audit partner Patricia Stebbens and Stebbens' daughter.

Hinchliffe did recuse herself from the final decision on KPMG's appointment.

Before the tender, PwC had audited Macquarie's books for more than three decades. This time around, KPMG emerged as the preferred auditor, subject to a shareholder vote in 2027.

This was before KPMG started unravelling after a whistleblower came forward. The auditor has since been engulfed in a crisis over the misuse of confidential client data - including that of Lendlease, Dexus and Optus - to pursue audit tenders.

In June, KPMG published an action plan acknowledging unethical behaviour by senior people and failings in its handling of the whistleblower, alongside the departure of its chair, chief executive and several senior partners.

Australian Shareholders' Association chief executive Rachel Waterhouse was present at Macquarie's annual general meeting (AGM) last year and noted there were concerns raised over Hinchliffe's prior experience and the conflict it created.

"I have been in two of those AGMs... And no one said to the chair, 'Can you confirm she's not engaging directly in any kind of personal connections, or how do you ensure there's no conflicts of interest?' There was never that level of detail," Waterhouse recalls.

Ownership Matters director Martin Lawrence says the problem isn't what happened at the meetings, it's how they look.

"It doesn't matter if Michelle Hinchliffe actually did nothing wrong at all. Anyone looking at that process goes: how did EY not even make it to the final pitch?" Lawrence says.

"Caesar's wife must be above suspicion, and when you're running these processes, you have to run them on that basis so that no one can say you put your finger on the scale."

Lawrence gives Hinchliffe a pass on the Sheppard meeting as it was in her capacity as a  BHP director, but says the other two were clearly social gatherings with people she knew well and harder to cut her slack on such interactions.

Australian Council of Superannuation Investors (ACSI) chief executive Louise Davidson says the ASX Corporate Governance Principles set a clear benchmark that a director who has worked for a supplier to the company within the last three years is not considered independent.

"They would not be considered an independent member of the audit committee if they've worked for that company within the last three years," Davidson says.

"That's a really key point. We think it's really important for auditors to be, and also seen to be, independent from the company.

"To achieve this, it is critical that directors themselves can demonstrate independence from the audit company."

At Dexus, the relationship played out on a golf course. Its former chief executive, Darren Steinberg, played golf with former KPMG chief executive Andrew Yates while the tender for the external audit was live, which KPMG eventually won.

"Our previous chief executive did play golf with Andrew Yates... He had announced his retirement and was largely absent from the process, largely absent from the office and completely absent from the process of tendering," Dexus chair Warwick Negus told the parliamentary committee.

Questioned whether the golf game was reported to the Dexus audit committee, Negus answered: "No."

"My guess is he probably did say, without knowing what even the bid price was, 'your price should be lower'. It was a very natural reaction for him. At worst it was inappropriate that they should be playing golf whilst this process was going on," Negus said.

Then there was Westpac's audit committee chair Peter Nash, a former KPMG chair, who resigned in July over social contact with KPMG personnel during the tender, including reports of overnight stay at Sheppard's home.

"The institutional problem at Westpac was that they did not fully understand just how deeply embedded someone who has been a lifelong partner of one of these professional services firms is in the partnership. They sort of never leave," Lawrence says.

Stevens, however, notes the choice for big firms like Macquarie when it comes to audit services is limited.

"For a company like Macquarie, which is global, operates in many jurisdictions and has some hundreds of entities that have to be part of the audit, we really have no choice but to use a globally capable firm - genuinely global - which really restricts our choice to the four big global firms," Stevens says.

"That's the reality that we face. Obviously, it's really important that those four be capable and ethical. That's the world that we're in."

Lawrence agrees.

"Australia is a small market... Often the people who end up on audit committees are people who are former partners of these firms," Lawrence says.

The result, he says, is "a small circle of people, the kind of upper echelons of corporate Australia, who all live in the same suburbs, all see each other socially, in many cases have known each other for years."

He adds there is a cultural difference between how public officials and private firms interact with the probity rules.

"Much as the private sector in general likes to talk about strict probity rules, it doesn't have the kind of really strict probity rules that the public sector does," Lawrence notes.

"If you try and buy someone who works for one of the public sector funds management firms a cup of coffee, they won't let you. They're not allowed. It's just a different set of rules, and they're very rigorous."

Waterhouse notes that sometimes there is real value in having a former auditor on a board's audit and risk committee, provided the bias is managed.

"Where a director has a former relationship with the audit firm, shareholders need more than a generic independence statement," Waterhouse says.

"They are entitled to understand how the board assessed that relationship, what safeguards were used, and whether the director was excluded from decisions involving an actual or perceived conflict."

Under current rules, firms must rotate the lead auditor every five years, but the audit firm itself can continue as auditor for as many years as the board considers appropriate.

Lawrence notes at present, there are more incentives to cheat as tenders come less often and once you win them, you are set for a long period.

"Once you've got it, you've probably got it for 30 years at least. So that's a pretty decent incentive - one, that they don't come up very often, and two, when they do, if you win it, you're sorted for a long, long time," Lawrence says.

Davidson says ACSI prefers not to support a hard deadline for auditor rotation, given the work involved in switching, but considers regular review of the process important.

"We think there's benefit in regular audit tenders, even if that doesn't result in a change of auditor. There's still benefit in that, and benefit in some disclosure about it, so that shareholders can have confidence there is some probing of the audit process taking place," Davidson says.

Waterhouse notes that mandatory firm rotation is not without critics.

"It can in some instances increase costs and reduce company-specific knowledge. However, long auditor tenure can create familiarity risks and weaken the perception of independence, particularly where consulting services are provided by the same firm," Waterhouse says.

"At a minimum, boards should explain why retaining a long-serving audit firm remains in shareholders' best interests and how they have tested the market through periodic competitive tendering."

Macquarie has now decided to no longer recommend KPMG as the auditor at its 2027 AGM and would instead retain incumbent auditor PwC.

It attributed the decision to two reasons: capacity to deliver the audit given several key members of the proposed audit team have departed; and culture, including a culture that transparently discloses issues.

It will then review its auditor in 2031.

Stevens told the parliamentary committee that culture in the audit sector can be "hard to regulate".

"We need higher-integrity behaviour than has apparently occurred; there's no question that that's true... My gratuitous observation to you would be that that's a tricky thing to do," Stevens said.

Meanwhile, Hinchliffe remains a director and chair of Macquarie's audit committee.