If you’ve been tracking the scrutiny facing KPMG Australia following its whistleblower scandal earlier this year, two new independent reviews hold a mirror up to Citi.
They show a firm that struggled to apply basic ethics and whistleblower-handling principles—flaws that translate directly to Citi.
The recurrence of familiar failures around leadership, accountability, and ethical behavior raises an urgent question about how effectively the lessons from the past have been implemented.
The problem wasn’t a lack of policy. It was people, and the way power moved between them—a reality Jane Fraser consistently attempts to deflect by pointing to Citi’s global anti-harassment, bullying, and retaliation policies.
In October 2026, Principia Advisory published its Ethical Culture Review, which examined the gap between KPMG’s stated values and its internal reality.
It identified a stark “say-do gap”: inconsistent accountability, leadership appointments misaligned with firm values, and ethical controls that didn’t always operate as intended.
The review found that power was concentrated among a “tightly connected group,” undermining independent oversight. Employees reported that speaking up carried meaningful professional risk, and their safety depended heavily on their personal relationships with individual partners.
When a whistleblower tested the system, the Andrews Group review revealed what followed:
KPMG treated the disclosure as a legal liability rather than an ethical crisis.
It asked what the allegations might cost the firm, not what they revealed.
They focused on the whistleblower’s employment grievances while substantive misconduct allegations were sidelined and conflicts of interest went unmanaged.
It focused on the whistleblower’s employment and grievances and made assumptions about their motives, while the wider misconduct allegations got less attention than they deserved. Senior people were implicated, yet conflicts of interest went unmanaged.
Principia summed it up best: the gap between what a firm says and what it does “creates a strong signal as to what is expected and valued.”
People read those signals faster than any code of conduct.
Words to the wise:
Policies don’t hold people to account. People do, and that starts at the top.
A code of conduct is only as strong as the leaders willing to enforce it on themselves.
Earlier this year, Citi’s CFO offered this leadership advice: “Own it. Lead with clarity. Take accountability. Stay close to what matters most.”
Is Citi taking its own advice?