Resilience as a success factor in risk management

In an increasingly complex world, simply recognising and understanding risks at an early stage is no longer enough to protect companies in the long term. Active, strategic management of risks that threaten a company's existence is crucial - and this is precisely where Enterprise Resilience comes in.

Enterprise resilience describes the ability of companies to prepare for crises, react flexibly and recover quickly. The aim is to recognise potential disruptions at an early stage and develop strategies to overcome them.

By analysing the potential consequences of risks rather than isolating them, companies can develop measures at an early stage that not only combat the acute danger, but also contribute to long-term stability. By analysing potential risks holistically, companies can not only overcome acute dangers, but also ensure long-term stability and remain competitive.

With the new version of IDW PS 340 as amended, the audit of the risk early warning system as part of the annual financial statements is mandatory from the financial year under review. The aim is to ensure that the system adequately safeguards the continued existence of the company. In particular, the auditor examines compliance with legal requirements - for example in accordance with Section 91 (2) AktG - and the effectiveness of the system for recognising and managing risks at an early stage. These requirements also apply to GmbHs (Section 43 (1) GmbHG) and cooperatives (Section 34 (1) GenG).

On 28 February 2025, the Institute of Public Auditors in Germany (IDW) also published the draft of IDW ES 16 on early crisis detection and crisis management in accordance with Section 1 StaRUG. The standard requires structured planning for the identification, assessment and monitoring of risks that could jeopardise the company's existence as well as the implementation of suitable countermeasures - regardless of the legal form and size of the company.

This risk-based approach strengthens resilience as it enables early identification and targeted management - to safeguard business operations and mitigate the potential effects of crises.

In view of the wide range of risks, it is essential for companies to address the topic of enterprise resilience in order to safeguard business processes and the achievement of objectives.

The main risks that jeopardise the continued existence of the company include

1. Cyber incidents
2. Business interruptions
3. Natural disasters 
4. Significant changes to laws and regulations 
5. Climate change 
6. Fire and explosion
7. Political risks and violence
8. Pandemic
9. Market development
10. Critical infrastructure failures

Many risks are interlinked - for example, when natural disasters or cyber attacks lead to business interruptions. An isolated view therefore falls short; a holistic, networked view of risk is required.

In addition, risks that jeopardise the company as a going concern can have serious consequences, including

• Total economic failure
• Serious loss of sales
• Liquidity problems, inability to pay, insolvency
• Legal and regulatory consequences
• Reduced productivity
• Loss of market share
• Damage to reputation
• Occurrence of customer complaints

In order to adequately prepare for these risks that jeopardise the company's existence, companies should generate resilience in the following corporate functions in particular.

• Corporate resilience:

Development of cross-functional solutions for coping with structural changes, uncertainties and disruptions

• Business and operational resilience:

The focus here is on the continuity of operations and restoring them after sudden disruptions

• Organisational resilience:

Essentially, this is about the adaptation and further development of the entire organisation in response to challenges and changes

KPMG provides companies with comprehensive support in the development and implementation of enterprise resilience strategies. Our services range from technology-based solutions and the development of resilience platforms to the selection of suitable alliance partners.

Thanks to our global network and proven approaches, we address all key aspects of resilience and continuously develop new solutions. Our validated methodologies and frameworks are designed to fulfil the specific requirements of our clients.

We use advanced risk analyses and AI-supported algorithms to assess the impact on the business and enable well-founded, strategic decisions. Our expertise in risk analysis and industry knowledge strengthens the strategic dialogue with executives and contributes to the further development of their resilience skills.

KPMG support organisations in several key resilience management processes:

1. Strategic alignment: we help define strategic objectives and identify key enablers and activities that support these objectives. This includes developing technology-based solutions and mobilising our global network to cover other aspects of organisational resilience.
2. Modelling: We define key performance indicators and use quantitative modelling to perform predictive analyses and simulations. This enables companies to recognise potential risks at an early stage and take appropriate action.
3. Reporting: KPMG builds centralised platforms for executives that provide strategic insights into current situations. This includes the use of data-driven and AI-supported "ER" dashboard risk analyses and AI algorithms to assess the impact on the business and overcome challenges.

Strategy to improve resilience: We identify strategic options to improve resilience and the optimal strategy based on ROI and confidence levels.

We would be happy to explain our concept of enterprise resilience to you in detail and develop a customised process model with you. Get in touch with us.