It seems that many organisations either have very short memories, or are unable to accept that the crises that others have grappled with could also happen to them.

The allegations that KPMG misused confidential client data in its pitch process, and then mistreated the whistleblower, have spiralled in recent weeks, not least because KPMG has managed the situation so badly.

The debacle that KPMG finds itself in is reminiscent of the crises that PwC and Qantas faced a few years ago, and which I wrote about here.  

At the time, I said, “Just because you pay your lawyers more than your PR advisers, doesn’t mean their advice is more valuable”, and yet KPMG is taking exactly the same approach to its handling of the revelations.

Of course, nothing can mitigate the facts, and KPMG has(finally, and only under pressure) admitted to serious breaches of ethics and professionalism.

But instead of facing up to its wrongdoing and apologising, it is attempting to hide behind “legal privilege” and is playing fast and loose with definitions, such as what constitutes an HR issue.

These are exactly the approaches that PwC and Qantas tried to take in 2022.  It didn’t work then, so why does KPMG think it is a good approach to take now?

I can only assume that the board and management are relying on legal advice that is telling them these approaches are correct in a court of law.  Unfortunately for KPMG, it isn’t (yet) in a law court – it is facing a parliamentary inquiry, media scrutiny and, of course, the judgement of its clients who have not held back in their criticism.

A timely acknowledgment of fault and an apology may not have prevented these things, but they may have tempered them somewhat.  As it is, KPMG’s actions have only fanned the flames and given the government, journalists and its client base, more reason to criticise. The story has become as much about how KPMG has handled the crisis, as it has about the crisis itself.

In a crisis, attempting to downplay its severity (such as underreporting the volume of clients or systems compromised), withholding key details, obfuscating, or misrepresenting the truth, will inevitably prolong public scrutiny and leave a company exposed once the reality surfaces. It is almost certain that information will leak, so it is essential to take control of the narrative by disclosing it first.

Some basic crisis management tips are:

• Be prepared. Don’t assume an issue won’t happen to you. It may not be self-inflicted like KPMG (or PwC or Qantas), but it can be just as damaging
• Be honest. It’s always the best policy.  Covering up or misleading will extend interest in the crisis
• Communicate. Keep all stakeholders – including staff – informed so they don’t feel isolated or taken by surprise
• Apologise. The lawyers may not like it, but acknowledging the problem allows you to then outline the steps being taken to correct it, and how you will prevent it from happening again
• Don’t be defensive.  Putting up barriers, or saying nothing, won’t make the story go away. It just means that others will be saying it about you.

Last but not least – don’t just call in the lawyers. Get some reputational advice as well.