GOVERNANCE WATCH
By InsidEntity Editorial Desk · Sep 15, 2026 · 21 min read
InsidEntity’s Auditor Independence pillar scores auditor tenure. A recently appointed auditor scores 5.00. A relationship past ten years scores 0.00. Applied to Australia’s major banks, the pillar gives Westpac full marks and gives ANZ and Commonwealth Bank zero.
The scores are correct. What they measure needs saying out loud, because Westpac’s 5.00 rests on a 2024 audit tender during which, KPMG has since acknowledged, one of its partners accessed confidential documents belonging to another client without authorisation, a tender a parliamentary joint committee is now examining.
Ratings at a glance
This is a Spotlight paired with ratings. It is not investment advice and takes no position on any security. The FSR and CRR are InsidEntity assessments, produced by applying our published methodology to reported figures and disclosed records; they are not published by the banks or by any regulator.
| Bank | FSR | CRR | Financial year scored |
|---|---|---|---|
| ANZ Group Holdings | 4.7 | 2.91 | FY2025, to 30 September 2025 |
| Westpac Banking Corporation | 3.7 | 4.53 | FY2025, to 30 September 2025 |
| Commonwealth Bank of Australia | 3.7 | 2.94 | FY2026, to 30 June 2026 |
The FSR scores full-year audited statements only, so each bank is assessed on its most recent completed financial year. ANZ and Westpac close on 30 September and CommBank on 30 June, which means CommBank’s figures here are around nine months fresher than the other two. November’s FY2026 reporting for ANZ and Westpac will close that gap.
Three of the CRR’s four pillars are calculated from disclosed records. Director Independence is assessed from questionnaires signed by directors personally, and until those are in hand it is carried at the benchmark 5.00. When they are assessed, both that score and the pillar weighting change, and every CRR above moves. The full ranges are set out under How these numbers are built below, before the pillar detail.
The finding: a clock measures elapsed time, not integrity
The Auditor Independence pillar runs on a published sliding scale.
| Auditor tenure | Score |
|---|---|
| 1 to 3 years | 5 |
| 4 to 5 years | 4 |
| 6 to 7 years | 3 |
| 8 to 9 years | 2 |
| 10 years | 1 |
| More than 10 years | 0 |
On this pillar, 0.00 is an assessed score at the terminal band. It is not a missing-data flag. Applied against verified appointment records:
| Bank | Auditor | Relationship began | Band | Score |
|---|---|---|---|---|
| Westpac | KPMG | Appointed at the 13 December 2024 AGM; engagement from 1 October 2024 | 1 to 3 years | 5.00 |
| CommBank | PwC | FY2008, following a 2006 tender | 10 years plus | 0.00 |
| ANZ | KPMG | 1969, as Peat, Marwick, Mitchell & Co | 10 years plus | 0.00 |
That single pillar contributes 1.25 points of the 1.59-point spread between Westpac and CommBank, roughly four-fifths of the separation, and nearly four times the other two assessed pillars combined. The proportion survives the reweighting: under the final 40/20/20/20 scheme it accounts for 1.00 of a 1.27-point spread, the same four-fifths. However the weights fall, this pillar is doing most of the work, and it is worth understanding exactly what work that is.
Westpac’s clock reset because the bank ran a competitive tender. In November 2023 it announced the tender and stated that PwC had not been invited to participate because of its tenure, a relationship in which partners of PwC and its antecedent firms had audited the bank since 1968. KPMG was named preferred firm in March 2024 and appointed at the December 2024 annual general meeting. On the methodology, that is a textbook reset, and the maximum score follows automatically.
Here is what the clock cannot see.
In March 2026, Senator Deborah O’Neill put a whistleblower’s allegations to the Senate, among them that confidential Lendlease board papers were circulated inside KPMG and used to support the firm’s bids for the Westpac and Dexus audit tenders. O’Neill told the Senate that during the Westpac tender KPMG received feedback and positioning intelligence unavailable to competitors, including that the tender was KPMG’s to lose, guidance to cut its fee by roughly 25%, and advice on managing perception. Those remain allegations placed before parliament.
What has been established since is narrower, and follows a sequence worth keeping separate.
On 30 April 2026, Lendlease wrote to O’Neill confirming that KPMG had told it a KPMG audit partner accessed Lendlease board documents without authorisation, and describing the conduct of those responsible as unacceptable. KPMG’s own early internal investigation had not substantiated misconduct; the firm subsequently engaged external counsel to investigate again, and has since acknowledged that client information was inappropriately retained and shared internally, with implicated staff having left or been sanctioned. Its chief executive, audit head and chairman have resigned. The firm has also conceded it mishandled the original whistleblower complaint. The Parliamentary Joint Committee on Corporations and Financial Services, chaired by O’Neill, heard evidence from Macquarie, Westpac, Dexus and Optus on 14 August 2026, where the partner who worked on the Westpac tender acknowledged taking a screenshot of a Lendlease board document while disputing that she knew it was confidential or that it was used in the tender.
So the pillar’s maximum score attaches to an audit appointment now at the centre of parliamentary scrutiny.
What this does and does not mean for Westpac
It does not mean Westpac did anything wrong, and nothing here alleges that. The conduct at issue is KPMG’s. No allegation touches Westpac’s accounting records, financial statements or financial reporting, and Westpac’s chair has defended the structure of the tender as robust.
But consequences landed on Westpac’s own governance, and they belong in a governance rating.
KPMG senior partner Kim Lawry resigned after Westpac requested her removal as its lead auditor. And Peter Nash retired from the Westpac board effective 1 July 2026, not an ordinary director, but the chair of the board audit committee. Nash spent close to 25 years at KPMG, served as its Australian national chairman and sat on its global and regional boards. Westpac’s position was that he had declared his past connections and was not on the selection committee, and that he chose to retire to limit ongoing distraction while acknowledging the perception of bias his relationships may have created.
Nash had addressed the point himself. At the December 2025 annual general meeting he told shareholders that an executive career at KPMG had instilled in him the belief that auditor independence is fundamental, and noted for the record that he had formally recused himself. That is a director managing a conflict in public, on the register, in the way governance codes contemplate. It did not settle the matter.
Two pieces of committee evidence sharpen why, and both are evidence given to parliament rather than established findings. Westpac’s audit committee chair told the committee in August that Nash should not have contacted his former KPMG colleagues during the tender process. And former KPMG chairman Martin Sheppard told an earlier hearing that Nash, a long-standing friend, stayed at his house during the pitching period.
There is also a market signal that arrived before any of this became public. At that same December 2025 meeting, three months before O’Neill’s Senate statement, close to 40% of votes were cast against Nash’s re-election, after both ISS and CGI Glass Lewis recommended against him. The proxy advisers’ stated concerns centred on his six years on the board of the ASX as well as his KPMG career, so the vote is not a referendum on the tender. It is evidence that the accumulation of affiliations was already visible to institutional shareholders.
The part the clock is most blind to
Nash’s successor as audit committee chair is Michael Ullmer, and the succession illustrates the problem better than the departure does.
Ullmer joined the Westpac board in April 2023 and has sat on its audit committee since, that is, throughout the tender, from the November 2023 announcement to the December 2024 appointment. He was also chairman of Lendlease from November 2018 until November 2024: the company whose board papers a KPMG partner accessed without authorisation, and whose chair, O’Neill told the Senate, was not informed that the tender process had been compromised. Earlier in his career, before serving as Commonwealth Bank group chief financial officer and NAB deputy chief executive, he was a partner at KPMG.
None of that is an allegation against Ullmer, and nothing here suggests he did anything improper or that Westpac appointed him for any reason other than his experience. The point is about the size of the pool. Westpac addressed concerns about one director’s KPMG affiliations by handing the audit committee to a director who carries a different but overlapping set, one who sat on that committee throughout the tender, chaired the client at the centre of the allegations, and has KPMG history of his own. In a market dominated by four audit firms, with a relatively small pool of directors holding deep financial-sector experience, adjacencies of this kind are difficult to eliminate entirely. That is exactly why they need to be visible rather than assumed away.
An audit committee chair leaving over his relationship with the winning firm, and the profile of the director who replaced him, are governance events at the company, not only at the audit firm. On the tenure clock, all of it is invisible. The clock records that the relationship is young. It does not record how it came to be young, or who was in the room.
The methodology point, stated plainly
None of this argues for abandoning the tenure clock. Tenure is a real and measurable exposure, it is objective, and it does not depend on a company’s self-description. The alternative measures, mostly self-reported independence assertions, are far softer.
But a rating should be honest about what it captures.
Partner rotation and firm rotation are different controls, and only one is mandatory in Australia. Section 324DA of the Corporations Act requires the lead auditor or review auditor of a listed company to rotate after five successive financial years, extendable to seven with director approval. There is no equivalent Australian statutory requirement for a listed company to rotate its audit firm. Partner rotation changes the person. Firm rotation changes the relationship: the commercial history, the accumulated familiarity, the incentives built over decades. The clock records the stronger control, and it is the one no rule compels.
Shareholder approval is ratification, not selection. In the Australian listed-company framework, the shareholder vote generally operates as approval of an auditor the board has already chosen, which is why the pillar measures elapsed relationship rather than whether an appointment was formally approved.
The clock measures the reset, not the quality of the reset. Two banks with decades-long relationships score zero, and the bank that did the harder thing, putting a relationship dating to 1968 out to tender and changing firms, scores five, even though the tender that produced the change is now before a parliamentary committee.
The honest reading of Westpac’s 5.00 is therefore narrow: the structural exposure created by long auditor tenure has been removed. That is genuinely true and genuinely worth something. It is not a finding that the appointment process was sound, and InsidEntity does not claim it is. The same discipline cuts the other way for ANZ and CommBank: their 0.00 scores say their relationships have run past a decade, not that PwC’s CommBank work or KPMG’s ANZ work is deficient.
One detail underlines how narrow the pillar is. Westpac and ANZ are both audited by KPMG, and score 5.00 and 0.00. The pillar is not scoring the firm. It is scoring the calendar.
What we are changing, and what we are not
This case exposes a gap, and it is a design gap rather than a data one: as the pillar set currently stands, there is nowhere to record that an audit committee chair left over his relationship with the winning firm. We are closing that in two deliberately different ways.
We are adding a disclosure flag, not a scoring overlay. Where a company’s auditor tenure has reset through a tender that is itself the subject of a regulatory investigation or parliamentary inquiry, the Auditor Independence score will carry a published note recording that fact. The score will not move. Discounting Westpac’s 5.00 on the strength of an inquiry that has not reported would substitute our judgement of an unfinished process for a measurable fact, and it would reintroduce exactly the subjectivity that makes the tenure clock worth having. The reader gets the number and the circumstance, and draws their own conclusion. Westpac is the first qualifying case and this article is that note, in expanded form; from here the standing version will be a line carried on the score itself.
Audit committee composition belongs in Director Independence, not Auditor Independence. Nash’s retirement, his recusal, and his successor’s affiliations are facts about directors, not about how long an audit firm has held the engagement. Importing them into the tenure pillar would contaminate a clean objective measure with a qualitative judgement it was never built to carry. Westpac’s Director Independence assessment is where board composition during and after the tender should register, and where our current questionnaire does not reach that, we will extend the instrument rather than leave the finding homeless.
Both decisions rest on one position, which we would rather state as policy than have inferred. A governance event does not move whichever score it happens to sit nearest. It is recorded in the pillar built to carry it, and if no pillar can carry it, the instrument changes rather than the number. That is the opposite of a rating that adjusts a figure whenever a story breaks, and it is deliberate. It is not a decision to leave anything unscored: Nash’s departure, his recusal and Ullmer’s affiliations are not excluded from the CRR, they are routed away from the pillar that would misrepresent them.
We are not adding an audit-quality pillar. Audit quality is assessed by regulators with inspection powers and access we do not have, and a rating that implied otherwise would be worse than one that stays in its lane.
How these numbers are built
Until the signed questionnaires are in hand, the CRR runs in its default state: Director Independence is carried at the benchmark 5.00, the value the methodology treats as a placeholder pending assessment rather than a finding. Once those questionnaires are assessed, the published weighting takes effect: Director Independence at 40%, the other three pillars at 20% each.
So the published figures can change in two ways at once, and we would rather state that than have a reader discover it. The Director Independence score moves from a default to an assessment. And the weights move underneath it. Even if a bank’s other three pillar scores came back exactly as carried, its CRR would still shift, because the arithmetic producing it is different.
| Bank | CRR now (DI at benchmark 5.00) | Final CRR at DI = 0 | Final CRR at DI = 5 |
|---|---|---|---|
| Westpac | 4.53 | 2.62 | 4.62 |
| CommBank | 2.94 | 1.35 | 3.35 |
| ANZ | 2.91 | 1.33 | 3.33 |
Two consequences. The reweighting compresses the spread: at identical pillar scores the gap between Westpac and CommBank narrows from 1.59 to 1.27, because the pillar on which the other two score zero carries less weight in the final scheme. And Westpac’s current lead is not guaranteed to survive assessment. It holds unless CommBank’s or ANZ’s Director Independence exceeds Westpac’s by more than roughly 3.2 points on a five-point scale. That is a wide margin and we have no reason to expect it, but Director Independence is the one pillar we have not measured, and we are not going to predict it.
The floors are mathematical bounds, not forecasts. A zero assumes every director fails every criterion, which we do not expect at any of these banks. We publish the bounds rather than a likelier midpoint because a bound is checkable and a plausibility estimate would only be our guess wearing a decimal point.
The other two assessed pillars
Director Capacity: Westpac 3.10, CommBank 2.25, ANZ 2.15.
The pillar is built from two components, weighted to sum to 5.0 for a director with a full complement of relevant experience and no more than two board seats. The first component, out of 1.5, scores concurrent directorships held: one or two seats score the full 1.5, three seats score 1.0, four seats score 0.5, and five or more score zero regardless of how well a director performs at any one of them. The second component, out of 3.5, scores working experience: industry experience (1.5), industry qualification (0.5), finance experience (0.5), finance qualification (0.5) and legal experience (0.5). Both components are board-wide averages, so no single director’s profile determines the score.
This pillar is also the entire source of the 0.03 between ANZ and CommBank in the composite: a 0.10 difference here, weighted, and nothing else. A tenth of a point on a five-point scale, in one sub-pillar, is below the resolution the measure supports, so it is not a ranking. What matters is that Westpac sits materially above both.
Shareholder Influence: Westpac 5.00; ANZ 4.50; CommBank 4.50.
The pillar combines a shareholder-count component out of 3.0 with a concentration component out of 2.0, the latter counting holders at or above a 20% threshold. All three banks clear the count component in full. Westpac takes the full 2.0 on concentration, corresponding to no holder at or above the threshold; ANZ and CommBank each carry one recorded holder at or above it, costing half a point. What the pillar establishes is that Shareholder Influence is not the source of separation between ANZ and CommBank.
The financial picture
The FSR applies InsidEntity’s published methodology to full-year audited statements, testing revenue growth, profitability, net assets, liquidity and cash coverage. Four of the five indicators reward a three-year pattern rather than a single flattering period, and credit accrues per year rather than all-or-nothing. It is published to one decimal because that is the resolution the indicator set supports: the 1.0 separating ANZ from the other two is a real difference, and the tie between Westpac and CommBank at 3.7 is a genuine tie, not a rounding artefact.
It has a specific limitation for banks. Conventional current-ratio and cash-ratio measures were not designed for deposit-taking institutions, whose resilience depends on loan-book quality, deposit stability, wholesale funding access, liquidity buffers, capital requirements, stress testing and prudential supervision. Read the FSR as a reported-financial-statement signal, not as a substitute for APRA’s framework or a credit review.
CommBank reported FY2026 statutory net profit of A$10.911bn, up 8%, with cash NPAT of A$10.982bn and operating income of A$30.224bn. Net interest margin was 2.05%, three basis points lower. The counterweight is credit cost: loan impairment expense rose 9% to A$788m, a loan loss rate of 8 basis points, with the second-half charge 47% above the first half, and total provisions around A$6.5bn. Home loan 90-day-plus arrears were 0.73%. That is not distress. It is a demonstration that record profit and gently rising credit cost coexist.
ANZ reported FY2025 statutory profit of A$5.891bn, down 10%, with cash profit of A$5.787bn. Significant items of A$1.109bn, including an ASIC settlement and restructuring and redundancy charges, drove most of the fall; excluding them, cash profit was flat year on year. CET1 was 12.0% at 30 September 2025.
Westpac reported FY2025 statutory net profit of A$6.916bn against A$6.990bn the year before, with impairment charges of A$424m. CET1 was 12.5% and the average liquidity coverage ratio for the September quarter was 137%, against a regulatory minimum of 100%.
Why does the lower reported profit carry the higher FSR? ANZ and Westpac are scored on the same financial year. ANZ’s headline result fell 10% while Westpac’s was broadly flat, and ANZ still scores a full point higher. That is not an anomaly in the rating; it is the rating working as designed, and the design is worth spelling out.
Profitability is one of five areas tested, not the test. Four of the five reward a three-year pattern, and credit accrues year by year rather than all-or-nothing, so a single weak year forfeits a share of the available credit rather than the whole of it. ANZ’s FY2025 fall was concentrated in significant items of A$1.109bn, an ASIC settlement, restructuring and redundancy charges, and excluding those, cash profit was flat on the prior year. Charges of that kind hit one year’s reported profit without changing the revenue base, the net asset position or the liquidity and cash coverage the other indicators measure.
The general point matters more than this instance. A single year’s headline profit is a weak predictor of where a bank lands on the FSR, and a reader who treats the two as interchangeable will misread the rating in both directions, here, and in the next case where a record profit sits alongside an unremarkable score. We publish the FSR and the methodology behind it rather than the component scores, so this is an explanation of the gap rather than an itemisation of it.
The regulatory positions differ, and this is where the FSR leader looks least comfortable. APRA removed Westpac’s final A$500m operational-risk capital add-on in October 2025, closing out a Court Enforceable Undertaking entered in December 2020. CommBank’s equivalent add-on was removed in September 2022. ANZ’s went the other way: APRA raised it to A$1bn in April 2025 from A$750m, having already added A$250m in August 2024, criticising the bank’s failure to address wide-ranging problems in non-financial risk management, and accepting a Court Enforceable Undertaking at the same time. APRA has since approved ANZ’s root cause remediation plan, but on the latest public record the add-on and the undertaking remain in force. Of these three banks, ANZ is the only one still carrying an active APRA capital add-on.
So ANZ holds the strongest FSR at 4.7 while carrying the only live prudential capital add-on of the three. The FSR does not incorporate APRA enforcement status or prudential capital add-ons as scoring inputs; it reads audited financial statements, and a capital add-on raises the capital a bank must hold rather than weakening the figures it reports. Those are answers to different questions, which is the entire argument for not blending the two ratings.
What could change the assessment
On the numbers: signed director questionnaires, which both replace the benchmark Director Independence score and trigger the 40/20/20/20 weighting, moving every CRR in the table; and FY2026 reporting for ANZ and Westpac in November, which brings all three banks onto a comparable footing and will pick up the recovery ANZ has reported since its FY2025 close.
On the reading: adverse findings by the parliamentary joint committee, or ASIC action against registered auditors connected to the tender, would not move the tenure score but would make the disclosure flag material. Removal of ANZ’s APRA add-on would dissolve the sharpest tension between the two ratings. And a further auditor change at any of the three, Macquarie’s switch from PwC to KPMG in 2028 shows the rotation wave is still moving, would reset a clock without telling anyone what it cost to reset it.
The bottom line
ANZ leads on financial sustainability at 4.7 while carrying the only live APRA capital add-on. Westpac leads on the assessed governance pillars while the tender that produced its auditor sits before a parliamentary committee. CommBank and ANZ share the weakest assessed governance position on effectively identical pillar scores.
None of those sentences contradicts the others, because the two ratings answer different questions and the pillars inside the CRR answer different questions again. That is the case for publishing the components rather than a single blended figure.
The Auditor Independence pillar is doing what it was designed to do. It has correctly identified that CommBank has not changed audit firms since FY2008, that ANZ has not changed since 1969, and that Westpac has. That is a real and useful finding, and most readers would not have it otherwise.
It is also a clock. A clock tells you how long it has been. It does not tell you what happened.
The score is not wrong. It is narrower than the event. The useful question is not which bank has the best number, but which question that number is answering, what it leaves out, and what evidence would change the conclusion.
About the InsidEntity Company Risk Rating
The InsidEntity Company Risk Rating (CRR) scores companies on a 1 to 5 scale, weighted 40% Director Independence and 20% each for Director Capacity, Auditor Independence and Shareholder Influence. Director Independence is carried at a default of 5.00, Benchmark, pending signed director questionnaires; the other three pillars are calculated directly from disclosed records. The same scale applies to individual pillar scores and to the published overall rating: 1.00 to 1.99 is Risk, 2.00 to 2.99 is Caution, 3.00 to 3.99 is Good, 4.00 to 4.99 is Excellent, and 5.00 is Benchmark. The Financial Stability Rating is a separate instrument measuring financial condition and is not combined with the CRR. Ratings update as corporate information changes. Explore ratings for companies across 145 stock exchanges at InsidEntity.
Know more. Risk less. Decide better. This is independent research, not financial advice. Allegations described as such remain allegations; statements made in parliament and to parliamentary committees are reported as evidence given, not as established fact.
Sources: InsidEntity Company Risk Rating methodology. Corporations Act 2001 (Cth) s324DA; ASIC Regulatory Guide 187 (Auditor Rotation). Westpac ASX releases of 8 November 2023, 8 March 2024, 6 November 2024, 13 December 2024 and 1 July 2026; Westpac 2025 Notice of Annual General Meeting and 2025 AGM transcript; Westpac board of directors disclosures; Westpac 2025 Full Year Financial Results and September 2025 Pillar 3 Report. Commonwealth Bank ASX release of 12 December 2006 and FY2026 Full Year Results Profit Announcement, 12 August 2026. ANZ 2025 Annual Report and Full Year Results news release, 10 November 2025. APRA media releases on the ANZ capital add-on increases of August 2024 and April 2025, the Westpac reduction of July 2024 and removal of October 2025, and the CommBank removal of September 2022. Australian Senate Hansard, 24 March 2026. Lendlease correspondence to Senator O’Neill, 30 April 2026, released by the Parliamentary Joint Committee on Corporations and Financial Services. Parliamentary Joint Committee on Corporations and Financial Services hearing, 14 August 2026.