EY's $100 million exam cheating fine, and the KPMG cases: what cheating on a licensing exam cost accountants

What did EY admit to the SEC?

The record here is unusually clear, because EY did not settle on a "neither admit nor deny" basis. In the SEC's order of 28 June 2022, Ernst & Young LLP "admits the facts" in the findings and acknowledges that its conduct violated PCAOB Rule 3500T, the rule that requires auditors to act with integrity.

Those admitted facts, in the SEC's words and figures:

• "From 2017 to 2021, 49 EY audit professionals sent and/or received answer keys to CPA ethics exams."
• "hundreds of other audit professionals cheated on CPE courses, including those addressing CPAs' ethical obligations."
• From 2012 to 2015, over 200 EY audit professionals exploited a software flaw in the firm's continuing education testing platform that let them pass "while answering as little as one question correctly".
• 91 audit professionals "requested, used, or shared answer keys" after EY's US chair had personally warned all staff not to cheat in June 2019.
• A significant number of people who did not cheat knew about it and did not report it, which broke the firm's own Code of Conduct.

The ethics exam matters because most US states require one before they issue a CPA licence. The SEC put it plainly: these exams "are designed to keep accountants who do not sufficiently understand their ethical responsibilities from the essential role CPAs play in serving the public interest." The courses people cheated on also included technical audit topics, such as how to judge whether a client's financial statements comply with US accounting rules.

The SEC censured EY, ordered it to stop, fined it $100 million and imposed a long list of undertakings. EY had to hire two independent consultants at its own cost, review its ethics training and culture, set up a committee to look at who was responsible for misleading the SEC, and send a copy of the order to every public company and broker-dealer it audits within 10 business days. The SEC's press release called it the "Largest Penalty Ever Imposed by SEC Against an Audit Firm".

Gurbir Grewal, then the SEC's enforcement director, said: "It's simply outrageous that the very professionals responsible for catching cheating by clients cheated on ethics exams of all things."

Why the fine was $100 million: the misleading answer

The SEC's headline names two failings: employees cheating, and EY misleading the investigation. The order spends most of its pages on the second, and lays out a sequence of days that reads like a warning to anyone tempted to hide a problem.

1. 17 June 2019. The SEC fines KPMG $50 million, partly for cheating on training exams.
2. 19 June 2019. EY's US Chair and Managing Partner emails all US staff that "[s]haring answers on internal or external tests or evaluations is highly unethical behavior" and "will not be tolerated at EY." The same day, the SEC's enforcement division formally asks EY whether it has had any complaints about cheating on training. Also the same day, an EY employee reports that a colleague emailed them the answers to a CPA ethics exam.
3. 20 June 2019. EY answers the SEC. Its submission lists five old matters and gives the impression that the firm has no current cheating problem. The SEC found it "materially misleading" in light of the tip.
4. By 21 June 2019. Senior EY attorneys who had reviewed the submission know about the tip.
5. Autumn 2019. EY's own investigation confirms cheating on CPA ethics exams in multiple offices. The firm's Executive Committee discusses it in October 2019. EY decides to tell the PCAOB, but only once "the extent of the misconduct within the Firm was clearer". That takes four more months.
6. March 2020. The SEC finds out, almost nine months after its request, because the PCAOB tells it.

The order gives EY credit for a "robust investigation" of the cheating itself and for disciplining staff, "up to and including terminating employees". On the misleading submission, it says EY did not self-police, self-report, remediate or cooperate. Melissa Hodgman, an SEC associate enforcement director, said the agency "will not permit the submission of misleading information or any action that delays or frustrates our mandate to protect investors and our markets."

EY's response, given to NPR on the day of the order, came from spokesperson Brendan Mullin: "At EY, nothing is more important than our integrity and our ethics. These core values are at the forefront of everything we do. Our response to this unacceptable past behavior has been thorough, extensive, and effective."

How did KPMG get caught cheating?

KPMG has been sanctioned for training test cheating in three countries, each time by a regulator, and in a fourth case by the firm itself.

The SEC's order of 17 June 2019 covered two schemes, and KPMG admitted the facts of both. The first was the theft of confidential PCAOB inspection lists by senior people in KPMG's National Office, which led to criminal convictions. The second was exam cheating. KPMG audit professionals "at all levels of seniority" shared answers to internal training exams, and lead audit engagement partners "solicited answers from and sent answers to their subordinates." Until November 2015, some auditors edited the web address of their exams, which contained a setting such as "MasteryScore=70", to lower the pass mark. Twenty-eight of them did it four or more times, and some passed "while answering less than 25 percent of the questions correctly."

The order describes what happened when the firm investigated. One partner who had received answers by text deleted the messages after a document preservation notice and told a junior colleague to say they were deleted by accident. Another partner answered "no" on a December 2018 questionnaire about sharing answers, when he had received answers seven times and sent them three times in the previous eight months. Steven Peikin, then co-director of SEC enforcement, called the breadth and seriousness of the misconduct "frankly, astonishing."

The PCAOB fined KPMG Australia US$450,000 (A$615,000) in September 2021. The Guardian reported on 15 September 2021 that more than 1,100 staff, including 250 auditors, were involved in "improper answer sharing" from at least 2016 until early 2020. Two partners left the firm, 46 people had their pay cut, and 1,131 people, about 12% of staff, received some disciplinary action. The PCAOB acknowledged the firm's "extraordinary cooperation" and that it reported itself within 15 days. Chief executive Andrew Yates said the behaviour was "totally unacceptable".

On 10 April 2024 the PCAOB fined KPMG Netherlands $25 million, the largest fine it had ever imposed. It found that hundreds of professionals shared answers on mandatory training tests from 2017 to 2022, on subjects including US auditing standards, ethics and independence, and that the sharing "reached as far as partners and senior firm leaders". The firm also told the PCAOB it knew nothing of answer sharing before a July 2022 whistleblower report, which was false because members of its own boards had shared answers before then. The firm and its former Head of Assurance, Marc Hogeboom, settled without admitting or denying the findings. He was permanently barred from being associated with a PCAOB-registered firm and agreed to pay $150,000.

KPMG Netherlands' own statement says more than five hundred people were involved from at least October 2017, and that the chair of its Supervisory Board resigned "after admitting that he had received assistance in completing a training test." Its chief executive, Stephanie Hottenhuis, said: "The conclusions are damning, and the penalty is a reflection of that. I deeply regret that this misconduct happened in our firm."

On 16 February 2026 the Guardian reported, following the Australian Financial Review, that KPMG Australia had fined an unnamed partner A$10,000 for using AI to cheat on an internal training course about AI. The firm said more than two dozen staff had been caught using AI on internal exams since July, and that it found them with its own detection tools. Andrew Yates said: "Given the everyday use of these tools, some people breach our policy. We take it seriously when they do."

EY and KPMG side by side

• The method. Answer keys passed around by email, printouts and chat. Software gaps used to pass with most answers wrong (EY from 2012 to 2015, KPMG until 2015). In 2026, AI tools fed with course material.
• Who did it. Mostly junior staff, but never only junior staff. Partners shared answers at KPMG in the US and the Netherlands, and two partners were involved at EY Canada.
• What made it worse. A false or incomplete answer to the regulator. EY's uncorrected June 2019 submission and KPMG Netherlands' claim that it knew nothing before July 2022 both turned a training scandal into a candour scandal, and both cases ended in record penalties.
• How it was found. A tip from an employee at EY, a whistleblower at KPMG Netherlands, and the firm's own detection tools at KPMG Australia in 2026.
• The admission. EY and KPMG US admitted the facts to the SEC. KPMG Netherlands and EY Canada settled without admitting or denying them.

The pattern is wider than two firms. When the PCAOB fined PwC Israel $2.75 million for the same kind of misconduct on 25 February 2025, Accounting Today reported that the PCAOB had sanctioned 10 registered firms for training exam misconduct since 2021, including $2 million in fines against Deloitte's firms in Indonesia and the Philippines in April 2024.

If you have read our page on exam dump sites like ExamTopics, the logic is familiar. Leaked answers feel harmless because the test feels like a formality. The people who set the test do not treat it as one.

Why would auditors cheat on an ethics test?

Nobody in these cases sold a pass for cash, so there is no seller's price list to show you. The pay-off was time, and the cost of failing was real money.

The SEC's EY order says many professionals "acknowledged during the firm's investigation that they knew their conduct violated EY's Code of Conduct, but they cheated because of work commitments or an inability to pass training exams after multiple attempts." Those who stayed silent blamed "a desire to avoid getting colleagues in trouble" and not seeing answer sharing as cheating.

The KPMG order explains the stakes. Auditors had three attempts at each training exam. After two failures their performance manager was told. After three they had to retake the training and were "prohibited from conducting audit work until they pass the exam", and they understood that failing "could lead to their compensation being reduced." For a junior auditor in busy season, a shared answer key looked like a way to protect billable hours and a bonus.

Canada's regulator found the same mindset at EY Canada. Its order effective 31 July 2026 says many professionals considered answer sharing "common" and not a "big deal", that it happened "out in the open, with professionals collaborating in classrooms", and that most incidents involved technical courses on US GAAP and IFRS around the annual core audit training.

The firms paid $100 million, $50 million and $25 million in US penalties, plus consultants and years of monitoring. The individuals swapped an hour of study for a disciplinary file.

What happened to the accountants who cheated?

The public record on individuals is thinner than the headlines.

Inside the firms. EY imposed "a range of disciplinary actions on numerous professionals", up to termination, according to the SEC. KPMG Australia's 2021 action covered 1,131 people, with two partners leaving and 46 people losing pay. KPMG Netherlands says people "at all levels of seniority" were sanctioned and "some of them had to leave the firm". The orders do not name the junior staff, and neither do we.

Senior people, by name. Marc Hogeboom, the former Head of Assurance at KPMG Netherlands, was permanently barred by the PCAOB and agreed to pay $150,000, without admitting or denying the findings. In the separate KPMG scheme to obtain PCAOB inspection lists, David Middendorf, the former head of KPMG's National Office, was convicted of wire fraud in March 2019 after a month-long trial and was sentenced on 11 September 2019 to one year and one day in prison, according to the US Attorney for the Southern District of New York. That case was about stolen regulator data rather than training tests, but it came out of the same 2019 SEC order.

Licences. The California Board of Accountancy announced on 6 March 2023 that it had disciplined EY as a firm: 24 months' probation, a stayed 30-day licence suspension, a $1.8 million penalty and at least $300,000 on a public outreach campaign. It also said EY gave it information about personnel involved in the ethics exam conduct. We found no published list of individual licence actions from the EY case, so we make no claim about any person's licence.

The rules that apply to you are public. NASBA's CPA Exam Candidate Guide of January 2026 says a candidate found to have cheated faces penalties including "invalidation of grades, disqualification from subsequent examination administrations, and civil and criminal penalties", and that if cheating is discovered after licensing, "a Board of Accountancy may rescind the license or certificate." Discovery can come years later. EY's 2017 answer keys were still being examined by regulators in 2022, and EY Canada's 2017 conduct was ruled on in 2026.

Is it still happening in 2026?

Yes, and the method is changing.

• February 2026. KPMG Australia fines a partner A$10,000 for using AI on an AI course and says more than two dozen staff have been caught using AI on internal exams since July 2025, according to the Guardian.
• May 2026. The Mandarin reported on 1 May 2026 that Australia's corporate regulator, ASIC, told Senate estimates it was reviewing information about three registered auditors whom Chartered Accountants Australia and New Zealand had investigated for alleged exam cheating. Those are allegations, and no outcome has been published.
• July 2026. Canada's audit regulator, CPAB, censures EY Canada. Its order finds over 500 current and former professionals engaged in improper answer sharing, mostly from 2017 to mid-2020, with fewer incidents continuing until 2024, and that the firm had no monitoring system designed to detect cheating until mid-2024. EY Canada settled without admitting or denying the facts, and CPAB credited its "continuous cooperation".

Professional bodies are reacting to AI in the same way. The UK's ACCA moved to in-person exams after deciding remote exams were too hard to protect, a change we cover in why ACCA scrapped remote exams. The answer key has moved from an email attachment to a chatbot window, and the firms are now scanning for that too.

Red flags: tests to run before you touch a shared answer

These come straight from the orders. If one applies to you, the regulators have already described your situation.

1. Someone sends you an "answers" file for a required test. Opening and using it is the conduct the SEC described at EY. At KPMG Netherlands, simply receiving access without reporting it counted as improper answer sharing.
2. You hear "everyone does it" or "it's not a big deal". That was the culture CPAB described at EY Canada, and it was how 500 people ended up in an enforcement order.
3. The test lets you pass with most answers wrong. A broken pass mark is a bug to report. Using it was cheating at EY from 2012 to 2015 and at KPMG until 2015.
4. You are about to paste the course into an AI tool during a closed assessment. KPMG Australia fined a partner A$10,000 for exactly that in 2026, and its detection tools found the rest.
5. A website sells "AICPA ethics exam answers". The state ethics exam is a licensing requirement, and NASBA's guide allows a board to rescind a licence when cheating comes to light later.
6. Someone asks you to delete messages or tick "no" on a questionnaire. At KPMG the order cites two partners who did this as examples of concealment. In both record cases, EY and KPMG Netherlands, the regulator also found that the firm had misled it.
7. You saw it happen and said nothing. EY's order treats knowing and not reporting as a Code of Conduct breach in its own right. Report it through the firm's ethics hotline.

The honest route: pass the CPA, and its ethics exam, on your own work

The people in these orders were good enough to be hired by a Big Four firm. Most told investigators they ran out of time. The fix is a plan that leaves room for every test you have to take, including the dull ones.

If you are still working towards the licence, the CPA guide covers the four sections, how scoring works and how long candidates usually need. Put your target date into the free study plan tool on this page and it will tell you whether your weekly hours are enough. If you are still choosing a qualification, CPA vs CFA sets out the difference. For management accounting, internal audit or tax roles, the CMA, CIA and EA guides do the same job.

Employers do check. Our page on whether employers verify certifications explains how. The nurses in Operation Nightingale learned how long a fraud flag follows a licence.

If you want more structure, CPA Pro adds a week by week plan, the topics that carry the most marks and practice questions, for a one-time fee. It does the planning. The answers have to be yours.