Risk

The following statements articulate the principles through which we manage the risk we take across the firm, ensuring we act responsibly, in the public interest and in the interest of the entities we audit, our clients, our people, our regulators, and the markets and communities we work in.

It is the responsibility of our Board to identify, evaluate, manage and monitor the most significant risks that face our firm and could threaten the achievement of our strategic objectives, or our business model, future performance or solvency. The principal risks and uncertainties that the UK firm faces are set out in, and managed under, the firm’s Enterprise-Wide Risk Management (ERM) Framework. This framework is used by the Board throughout the year to ensure the timely identification of new and emerging risks and the development of appropriate mitigations and action planning, in line with the firm’s strategy.

The ERM framework is subject to a comprehensive review and refresh on an annual basis. This involves robust challenge of the firm’s risk taxonomy, reflecting developments in the firm’s risk landscape (current and longer term), changes made to KPMG International’s Risk Framework during the year, and the results of a Board Risk Assessment. Key developments during the prior year included:

• Incremental changes made to the enterprise risk reporting framework such as the ERM emerging risk radar and risk actions reporting.
• Enhancement of the emerging themes section to become part of the monthly watchlist for emerging risks that require separate focus.
• Further engagement with Level 1 risk owners to enhance communication/oversight of Level 2 risks and actions across the matrix of firm-wide, Markets and Capability ownership.
• Identification of any inconsistencies in the reporting of Level 2 risks by Capabilities and Markets.
• Partial rollout of the Level 3 risk taxonomy, development of system and framework training, and a full pilot conducted in People risk.
• Completion of a Board Risk Assessment to confirm the appropriateness of our principal risks and identify opportunities for further enhancement.
• Review and update of our risk matrix, risk appetite framework and supporting scenarios as part of a wider Enterprise-Wide Risk Management Framework refresh.
• Process of further identification, documentation and testing of key risk controls and metrics initiated.
• Enhancement of the risk assurance map to include L1-L3 risks, validated with function owners, and building of a dashboard accessible by the business.
• Further enhancement of the Governance, Risk and Compliance (GRC) tool.
• Further work conducted with the relevant ESG, Operations and Corporate Affairs teams to ensure that an appropriate level of information is captured in relation to climate risks to satisfy increasing external requirements such as TCFD.
• Further building of the maturity of the firm-wide risk management culture through increased engagement with capabilities and central support functions.

The Firm’s principal risks are set out within the four key risk ‘families’ of: Reputational; Strategic; Operational; and Financial. For the year ending 30 September 2024, KPMG in the UK identified 11 principal risks across these four areas:

The risks are not shown in order of priority.

Our assessment of how these risks have moved over time, the current risk landscape and the mitigating actions we have put in place to address each risk can be found hereopens in a new tab.