How KPMG Is Using AI in Consulting and Audit (Not Specifically Actuarial)

How Clara Replaces Sampling

KPMG’s AI strategy is not one tool but two distinct architectures bolted onto different parts of the firm. In audit, Clara AI runs deterministic anomaly detection across entire ledgers, replacing the old sampling mindset. In consulting, Anthropic’s Claude handles generative reasoning—summarizing contracts, drafting tax memos, and flagging policy gaps for insurance clients.

What changed recently is the scale: the firm embedded Claude into its Digital Gateway for all employees, while Clara became the default audit workbench. But the headline promise of “100% population testing” hides a harder truth—the tools only work as well as the client’s data hygiene. This guide breaks down how each system actually functions, where governance bites, and what the auditor-client dynamic looks like when machines do the counting and humans do the judging.

Why Claude Powers Advisory

The strategic bet that separates KPMG from Deloitte and PwC is not which model is smarter, but which architecture fits the task. That is not a vendor swap. It is a structural decision to run two distinct AI systems in parallel: Clara for deterministic ledger work, Claude for the unstructured reasoning that dominates advisory delivery.

The division of labor is sharper than most coverage admits. Clara is built for numbers — anomaly detection, population testing, the kind of work where a false positive costs an audit opinion. Claude is deployed for everything that does not fit a spreadsheet: summarizing complex contracts, analyzing legal documents, and drafting client deliverables in tax and legal work. Practitioners report that automating the initial research phase compresses the timeline for strategic recommendations from weeks to days, though this is not yet documented in formal case studies.

The governance layer is where the deployment gets interesting, and where the marketing narrative diverges from practitioner reality. KPMG’s "Trusted AI" framework requires that all generative outputs pass through risk controls before reaching a client. In practice, that means the model drafts, but a human owns the final risk assessment. The common failure mode, according to financial audit practitioners who have written about KPMG’s rollout, is over-reliance on AI flags without independent verification — auditors must manually test a sample of AI-flagged items to confirm false positive rates. That is not a theoretical concern; it is the difference between using Claude as a research accelerator and using it as an oracle.

For insurance-specific work, the NLP capability changes the front end of policy review but not the back end of judgment. Claude can extract and compare policy terms across carriers, flag inconsistencies in endorsements, and summarize regulatory filings. But the actuarial interpretation — whether a coverage gap is material, whether a reserve assumption is defensible — remains a human-led exercise. The tool accelerates the reading; it does not replace the reasoning. This is the same pattern that shows up across KPMG’s advisory practice: the model handles the volume, the professional handles the variance.

The comparison across the Big Four is instructive for anyone evaluating AI tools for their own firm. Deloitte’s Omnia is a closed ecosystem built on proprietary models; PwC’s OpenAI partnership gives it frontier general-purpose capability; KPMG’s Anthropic alliance is the first Big Four-scale frontier AI deployment, spanning tax, legal, and private equity work. The tradeoff is real: Anthropic’s Claude is widely regarded for long-context reasoning and nuanced drafting, but KPMG is now dependent on a third-party model roadmap. If Anthropic changes its API pricing or model behavior, KPMG’s advisory workflow shifts with it. That is the cost of renting frontier intelligence rather than building it.

The practical takeaway for an insurance analyst or risk manager is to separate the tool from the workflow. Claude can summarize a binder of policy documents and flag unusual exclusions, but the verification step is non-negotiable. Run a manual sample of the AI’s flags against the source documents before you trust the output. That single habit — testing the tool’s false positive rate on your own data — is the difference between a useful assistant and a liability. Start with one contract type, run the extraction, and compare the AI’s summary against your own read of the original language before scaling it to the full portfolio.

The Governance Trap

The governance layer is where KPMG’s AI story gets uncomfortable, because the firm’s own marketing and the regulatory reality diverge sharply. The official line is that Clara AI enhances audit quality through a "Trusted AI" framework with governance and risk controls baked in. The practitioner reality, per financial audit experts and PCAOB guidance, is that every AI-generated finding still requires a human auditor to document exactly how the tool was used, validate the output against evidence standards, and sign off on professional skepticism that cannot be delegated to an algorithm. That documentation burden is not a formality; it is the single largest cost driver in an AI-assisted audit engagement, and it is rarely mentioned in the press releases.

The 2026 Australian scandal involving leaked board papers (as of June 2026) is the cautionary tale that should frame every governance discussion. The leak itself was not an AI failure—it was human misuse of AI tools that destroyed client trust and put KPMG’s reputation in the crosshairs. The lesson for practitioners is that governance is not about the model’s accuracy; it is about the human workflow around the model. If a partner or engagement team can paste sensitive client data into a generative tool without a data processing addendum that covers AI sub-processors, the technical safeguards in Clara are irrelevant. Clients should request that addendum explicitly, because KPMG’s default agreements do not always enumerate every AI sub-processor, and the firm’s own guidance on isolated environments with client-specific data segregation is a starting point, not a guarantee.

Junior staff are the weak link in this chain. One r/auditing thread describes a recurring failure mode: new associates struggle to distinguish between statistical noise and genuine fraud signals flagged by Clara’s anomaly detection. The tool surfaces hundreds of exceptions in a full-population test, and the junior auditor’s job is to triage them. Without training on what constitutes a material anomaly versus a data entry quirk, they either over-escalate everything, drowning the senior team in false positives, or under-escalate and miss a real control failure. The fix is not better AI; it is a structured triage protocol that forces the auditor to articulate why a flagged transaction is or is not material before it reaches the manager level.

KPMG’s "Trusted AI" framework includes bias testing and explainability requirements, which sounds robust until you map it to the actual audit workflow. The framework ensures algorithms do not systematically overlook specific transaction types, but it does not eliminate the dual-layer verification process. That proof requires documenting the model’s logic, the data inputs, and the exceptions tested—a layer of paperwork that did not exist in manual sampling audits. Firms that fail to budget for this documentation overhead find their AI efficiency gains evaporate in review cycles.

The operational rule for any client or auditor working with KPMG’s AI tools is simple: treat every AI output as a lead, not a conclusion. PCAOB standards require that professional skepticism be exercised by humans, and that skepticism must be evidenced in the work papers. If you cannot explain why the AI flagged a transaction and why you agree or disagree with it, the finding is not audit evidence—it is noise. The most efficient teams build a standard exception template that forces the auditor to state the transaction type, the anomaly metric, the client’s explanation, and the final disposition. That template is what turns Clara’s output into defensible audit documentation.

For a concrete next step, review your current engagement letter and data processing addendum with KPMG before the next audit cycle. Confirm whether AI sub-processors are explicitly named, whether client data is segregated in isolated environments, and whether the documentation burden for AI-generated findings is scoped into the fee estimate. If those three items are not addressed in writing, the governance risk sits with you, not with the tool.

Lessons Learned From Scandals

The June 2026 resignation of KPMG Australia’s chief executive and the audit partner who led the Lendlease engagement is the clearest proof that AI efficiency does not equal ethical integrity. The scandal had nothing to do with model accuracy or population testing. Former partners accessed restricted board papers to win competing work, a confidentiality breach that predates any AI deployment. Yet the lesson for anyone relying on KPMG’s AI-enabled audits is direct: the same data access that lets Clara scan a full ledger also lets a bad actor exfiltrate sensitive documents faster than any manual process ever allowed.

What most coverage misses is that the Lendlease breach was a permissions failure, not a detection failure. The partners involved didn’t hack a system; they exploited legitimate access to board-level materials that their roles should never have included. This is the exact failure mode that AI governance frameworks struggle to address because the tooling is designed to catch anomalies in transactions, not intent in humans. A machine learning model can flag an unusual journal entry. It cannot flag a senior partner who quietly downloads a restricted file because they believe winning the client justifies the risk.

Parliamentary inquiries in Australia have since forced the Big Four to re-examine internal controls around data access and AI tool usage. According to reporting on the inquiry, the focus has shifted from whether AI improves audit quality to who holds the keys to the data that feeds the AI. For KPMG specifically, this means the five-year Microsoft agreement covering AI, risk, and cyber security now carries more weight than the Clara rollout itself. The technology was never the weak point; the governance around who can query what, and why, was.

For clients, the operational takeaway is to audit the auditor. Before you sign an engagement letter, ask for a written data segregation policy that covers cloud-based AI platforms. Specifically, request the access control matrix that shows which roles can view board papers, draft financial statements, or restricted client data. If the auditor cannot produce one, or if the matrix shows broad access across senior roles, that is a red flag regardless of how sophisticated their AI tools are. One practitioner on a professional services forum noted that their firm’s post-scandal review found a significant number of partners had access to data classes they never used in engagements, a finding that should make any client pause.

The broader lesson is that AI is a force multiplier for both competence and negligence. A well-governed firm with clean data and strong ethical culture will see Clara and Claude amplify their accuracy and speed. A firm with cultural flaws — where partners believe rules apply to others — will see those flaws amplified just as quickly. The Lendlease case is the cautionary tale because the breach was mundane, not sophisticated. It was a person with access making a deliberate choice. No model can prevent that, and no model should be marketed as if it can.

Your concrete action today: pull the most recent PCAOB inspection report for your current or prospective auditor and look specifically for any findings related to data access, confidentiality, or internal control deficiencies. If the report shows repeated findings in those areas, treat it as a material risk even if the audit opinions were clean. The AI tools will catch the math errors; they will not catch the partner who decides the rules don’t apply to them.

Case Study: Insurance Policy Review

The fastest way to cut a legacy policy review from months to weeks isn't better lawyers; it's forcing the data into a structured format before a single human reads a page. That error rate is the real killer, because a missed endorsement or a misread exclusion becomes a regulatory finding or an underpriced claim years later.

The KPMG alternative splits the work across its two AI architectures, and the division of labor matters more than the raw capability. Claude then handles the generative reasoning, summarizing each policy's key terms and flagging coverage gaps against the new regulatory checklist.

The execution detail that separates a successful deployment from a failed one is the validation loop. Analysts use Claude to draft compliance memos for flagged policies, but they do not sign off on the AI's extraction without checking it against the original PDF. This is not a trust exercise; it is a control requirement. The AI flags a missing endorsement; the analyst must locate the original policy clause and document the discrepancy in the compliance memo.

The revenue protection angle is where this stops being a cost-cutting story. That is the difference between treating AI as a document summarizer and treating it as an anomaly detection engine. Clara's structured output makes those pricing gaps visible; Claude's summaries make them explainable to underwriters. The insurer converts a compliance cost center into a profit-protection function, which is the only framing that gets budget approval beyond the initial pilot.

The common failure mode in these engagements is skipping the data hygiene step. If the legacy policies are scanned images with no OCR layer, or if the policy numbers are inconsistent across systems, Clara will structure garbage and Claude will confidently summarize it. Practitioners report that the first week of any such project is usually spent cleaning and normalizing the source data, not running the AI. Budget for that. Also budget for the governance layer: every AI-generated finding must be traceable to the specific policy and clause that triggered it, because the compliance memo is only as defensible as the audit trail behind it.

What to do next

To stay current with how KPMG and other Big Four firms are operationalizing AI in audit and consulting, verify the primary sources directly and compare their approaches. The following steps outline independent actions you can take to monitor these developments and assess their implications for your own work or organization.

Also worth reading: How AI Is Reshaping Actuarial Consulting in 2026 · Actuarial vs Accounting Careers in Insurance 7 Key Differences in Compensation, Skills, and Career Paths for 2025 · How Actuarial Science Influences Modern Insurance Risk and Pricing · Underwriting vs Actuarial Science Key Differences in Insurance Risk Assessment

Sources: theguardian, goingconcern, fortune, kpmg, kpmguscareers