KPMG Roles and Responsibility

These questions assess your foundational knowledge of risk concepts and your ability to analyze business processes.

Q1: What do you understand by the term 'risk management' in a business context?

In a business context, risk management is the systematic process of identifying, assessing, and controlling threats or risks to an organization's capital and earnings. It's not about eliminating all risk, as taking risks is necessary for growth. Instead, it's about making informed decisions to manage those risks. The goal is to ensure that the organization understands the potential upside and downside of its actions and has a plan in place to mitigate the negative impacts and maximize the opportunities.

Dos ✅

• Define it as a systematic process (identify, assess, control).
• Show a mature understanding that it's not about eliminating risk, but managing it.
• Link it to the ultimate goal of protecting and creating value for the organization.

Don’ts ❌

• Give a simplistic definition like "avoiding bad things."
• Suggest that the goal is to eliminate all risks.
• Be unable to explain its purpose in a business context.

💡 Why This Answer Works: This answer demonstrates a strong conceptual understanding of risk management. It's a mature, business-oriented definition that proves you grasp the strategic purpose of the function, which is exactly the mindset required for a risk advisor.

Q2: What are the different types of risks a company faces? Can you name a few?

Companies face a wide spectrum of risks, which can be broadly categorized. Some of the main types are:

1. Strategic Risk: The risk that the company's core strategy becomes less effective, such as a new competitor entering the market or a major shift in technology that makes their products obsolete.
2. Operational Risk: The risk of loss resulting from failed internal processes, people, or systems. This could be anything from a factory breakdown to employee fraud.
3. Financial Risk: The risk related to the financial structure of a company, such as credit risk (customers not paying), liquidity risk (not having enough cash), or market risk (losses from changes in interest rates or foreign exchange rates).
4. Compliance Risk: The risk of legal or regulatory sanctions, financial loss, or reputational damage a company may suffer as a result of its failure to comply with laws, regulations, and internal policies.

Dos ✅

• Name several distinct and relevant categories of risk.
• Provide a simple and clear explanation for each category.
• Show a holistic view of the different threats a business can face.

Don’ts ❌

• Only name one type of risk (e.g., "financial risk").
• Give vague or overlapping examples.
• Be unable to define the categories you name.

💡 Why This Answer Works: This question tests the breadth of your business awareness. This structured answer, using clear categories and definitions, demonstrates a comprehensive understanding of the risk landscape. It shows you can think holistically about a client's business.

Q3: Imagine you are asked to map a business process, like 'procure-to-pay'. What would be your approach?

I would use a structured approach to ensure the process map is accurate and comprehensive.

1. Understand the Scope: First, I would clarify the start and end points of the process with the project manager.
2. Gather Information: I would review any existing process documentation. Then, I would conduct interviews with the people who actually perform the process at different stages—from the person who raises a purchase requisition to the person who makes the final payment.
3. Draft the "As-Is" Map: I would create a visual flowchart of the current ("as-is") process. I would use standard symbols to represent tasks, decisions, inputs, and outputs.
4. Validate: The most important step is to validate the draft map. I would walk through it with the people I interviewed to confirm that it accurately reflects what really happens on the ground, not just what the old manual says.

Dos ✅

• Describe a clear, step-by-step methodology.
• Emphasize the importance of interviewing the actual process owners.
• Include the critical final step of validating your process map.

Don’ts ❌

• Just say "I would draw a flowchart."
• Suggest you would only rely on existing documentation without talking to people.
• Forget the validation step, which can lead to an inaccurate map.

💡 Why This Answer Works: This answer demonstrates a strong process analysis mindset, which is a core skill in Risk Consulting. It's a practical, detailed, and professional methodology that proves you can be trusted to accurately document and understand a client's complex business processes.

Q4: What is an 'internal control,' and why is it important?

An internal control is a process, rule, or mechanism implemented by a company to achieve a specific objective. It's a safeguard put in place by management.

Controls are important for several key reasons:

1. Preventing & Detecting Errors and Fraud: This is a primary purpose. For example, the control requiring a manager's approval for any payment over ₹50,000 helps prevent unauthorized or fraudulent payments.
2. Ensuring Accurate Financial Reporting: Controls ensure that the data in the company's financial systems is reliable and accurate. A bank reconciliation is a key control for this.
3. Promoting Operational Efficiency: Good controls can actually make a business more efficient by preventing rework and standardizing processes.
4. Ensuring Compliance: Controls are essential to ensure the company is complying with all relevant laws and regulations.

Dos ✅

• Provide a clear and simple definition.
• List several distinct and important objectives of controls.
• Use a simple, practical example (like a payment approval) to illustrate your point.

Don’ts ❌

• Give a vague or overly academic definition.
• See controls as just "bureaucracy" or "rules."
• Be unable to explain their purpose in a business context.

💡 Why This Answer Works: This answer demonstrates a solid understanding of a foundational business concept. It proves you understand the purpose and value of internal controls from multiple perspectives (fraud, accuracy, efficiency, compliance), which is a core part of the work in Risk Consulting.

Q5: How can data analytics be used to identify potential risks in a large dataset of transactions?

Data analytics is a powerful tool for risk identification because it allows us to test 100% of a population, not just a small sample. We can use it to find anomalies and red flags. For example, in a large set of payment data, I could use analytics to:

1. Identify Outliers: Isolate the top 10 largest payments or payments that are significantly larger than the average.
2. Look for Duplicates: Search for duplicate invoice numbers or duplicate payments to the same vendor for the same amount.
3. Test for Compliance: Test for payments made without a valid purchase order, which could indicate a control weakness.
4. Pattern Analysis: Analyze payments by time of day or day of the week to identify any unusual patterns, such as a high volume of payments being processed on a Sunday, which might warrant further investigation.

Dos ✅

• Explain the key benefit: testing 100% of the data.
• Provide several specific and practical examples of the types of tests you would run.
• Link the analytical test directly to a specific business risk (e.g., duplicate payments, control weakness).

Don’ts ❌

• Just say "you can find risks" without giving specific examples.
• Use overly technical jargon without explaining the purpose of the test.
• Be unaware of the basic capabilities of data analytics in a risk context.

💡 Why This Answer Works: This question tests your awareness of modern risk management techniques. This answer is strong because it's specific, practical, and demonstrates a clear understanding of how to apply data analytics to achieve a tangible risk management objective. It shows you have a modern, data-driven mindset.

This section focuses on your past experiences and how you have handled specific situations, demonstrating your analytical skills, learning agility, and professional mindset.

Q6: Tell me about a time you had to analyze a complex problem to understand its root cause.

• S (Situation): In an academic project, our team was analyzing a case study of a company whose customer satisfaction scores were dropping, but we didn't know why.
• T (Task): My specific task was to analyze the customer complaint data to identify the root cause.
• A (Action): The data was just a long list of unstructured text complaints. I first read through a sample of 100 complaints and created a set of categories (e.g., "Late Delivery," "Product Quality," "Poor Service"). I then went through all the data and tagged each complaint into one of these categories.
• R (Result): My analysis clearly showed that over 60% of all complaints were related to "Late Delivery." This allowed the team to focus our recommendations on solving the client's logistics and supply chain issues, rather than other areas. I learned the importance of structuring data to find the root cause.

Dos ✅

• Choose an example that showcases your analytical process.
• Describe a structured approach to solving the problem (e.g., categorizing data).
• Show how your analysis led to a specific and valuable insight.

Don’ts ❌

• Just describe the problem without explaining your specific analytical steps.
• Choose an example where your analysis didn't lead to a clear conclusion.
• Take credit for the entire team's work.

💡 Why This Answer Works: This answer demonstrates a core analytical and problem-solving mindset. It's a practical example that shows a clear, logical process for taking an ambiguous problem and a messy dataset and driving to a clear, data-driven insight. This is the essence of what a Risk Consulting Analyst does.

Q7: Describe a time you had to learn a new subject or skill quickly.

• S (Situation): For a college presentation, I was assigned the topic of blockchain technology, which I knew very little about at the time.
• T (Task): I had one week to learn enough about the topic to be able to explain it simply and present a business use case.
• A (Action): I created a structured learning plan. I started with high-level explainer videos to understand the core concepts. I then read a few key articles from reputable sources to understand the business implications. To solidify my understanding, I created a simple one-page visual that explained how a blockchain works, which forced me to simplify the concepts.
• R (Result): I was able to deliver a clear and confident presentation. The professor was impressed with my ability to explain a complex topic in a simple way. The experience taught me that I can learn any new subject quickly if I use a structured approach.

Dos ✅

• Show a structured approach to learning.
• Demonstrate resourcefulness by using multiple sources of information.
• Emphasize the skill of simplifying complex topics, which is a key consulting skill.

Don’ts ❌

• Just say "I'm a fast learner" without a concrete example.
• Make it sound like you learned it effortlessly; showing the process is important.
• Seem reluctant to learn a new and challenging subject.

💡 Why This Answer Works: A career in Risk Consulting requires you to be a constant learner as new risks and technologies emerge. This answer proves you are a proactive and self-directed learner. It shows a clear, effective process for acquiring and synthesizing new knowledge, a critical skill for success.

Q8: Tell me about a time your attention to detail helped you identify an issue.

• S (Situation): I was reviewing a set of financial spreadsheets for a group project.
• T (Task): My task was to consolidate the data for our final report.
• A (Action): As I was reviewing the numbers, I noticed that the total for one department's budget seemed unusually high compared to the others. It wasn't a formula error, so I dug deeper into the input data. I found that a single expense line item had been accidentally entered in dollars instead of rupees, which was inflating the total by a factor of 80.
• R (Result): I corrected the error before we submitted our report. If I hadn't been paying close attention to the details and just accepted the totals, our entire analysis and recommendations would have been based on incorrect data.

Dos ✅

• Use a specific, clear example.
• Show the potential impact of the error if you hadn't caught it.
• Demonstrate that you go beyond a surface-level review and dig deeper when something doesn't seem right.

Don’ts ❌

• Describe a trivial error like a small typo.
• Be unable to explain why catching the error was important.
• Sound like you are blaming the person who made the initial error.

💡 Why This Answer Works: Attention to detail is a non-negotiable skill in any risk or audit-related field. This answer provides concrete proof of that skill. It's a simple, powerful story that clearly demonstrates your diligence and the tangible value it can create by preventing bad decisions based on bad data.

Q9: How do you stay informed about current business and economic trends?

I have a few daily and weekly habits. I start my day by reading the headlines and one or two key articles in a major business newspaper like The Economic Times or Mint to get a high-level view. I also follow a few specific business and technology thought leaders on LinkedIn, as they often provide interesting analysis on emerging trends. Finally, I enjoy listening to a weekly business podcast during my commute, as it helps me understand the bigger picture and how different global events are connected.

Dos ✅

• Show that you have a consistent habit, not just something you do occasionally.
• Mention specific, credible sources.
• Include a mix of different media (newspapers, social media, podcasts).

Don’ts ❌

• Just say "I read the news."
• Be unable to name any specific sources you follow.
• Seem uninterested in the world of business outside of your academic work.

💡 Why This Answer Works: This question tests your commercial awareness. This answer is strong because it's specific and demonstrates a proactive and multi-channel approach to staying informed. It shows you are an intellectually curious person who has a genuine interest in the business world, a key attribute for a consultant.

Q10: Tell me about your most significant team project. What was your role?

• S (Situation): Our most significant project was our final-year engineering capstone project, where our team of four had to design and build a small-scale automated drone for warehouse stock-taking.
• T (Task): We had to manage the entire project, from design to a working prototype, in six months. My specific role was to develop the navigation software for the drone using Python.
• A (Action): I was responsible for writing the code that would allow the drone to navigate the warehouse aisles autonomously. I had to work very closely with the hardware lead on my team to ensure my software was compatible with the sensors and motors he was using. We had weekly integration meetings to make sure our parts worked together.
• R (Result): Our team successfully delivered a working prototype that could navigate a designated path and scan QR codes. We received the highest grade in our class for the project. It taught me the critical importance of close collaboration and constant communication between the software and hardware parts of a project team.

Dos ✅

• Choose a substantial project.
• Clearly define your specific role and responsibilities.
• Emphasize your collaboration and communication with other team members.
• End with a clear, positive outcome.

Don’ts ❌

• Be vague about your own contribution ("I was a member of the team").
• Only talk about your own work without mentioning how it integrated with the team.
• Choose a project where the team was not successful.

💡 Why This Answer Works: This answer is a great way to showcase teamwork, technical skills, and a results-orientation. It clearly articulates your individual contribution while demonstrating that you understand how to work collaboratively to achieve a shared goal. It's a strong, well-structured story of a successful project.

This section focuses on future hypothetical scenarios to test your judgment, professional instincts, and problem-solving skills.

Q11: You are testing a set of controls and find a significant number of exceptions. What are your next steps?

My next steps would be to investigate, quantify, and then escalate.

1. Investigate: I would first analyze the exceptions to understand their nature. Is it the same type of error happening repeatedly? Is it happening with the same person or in the same department? This helps to understand the potential root cause.
2. Quantify: I would quantify the impact of the exceptions.
3. Escalate: I would then prepare a clear, factual summary of my findings and present it to my senior or manager. I would report on the number of exceptions, the nature of the exceptions, and their potential impact. I would then ask for their guidance on the next steps, which might include expanding our sample size or having a meeting with the client process owner.

Dos ✅

• Describe a structured and logical process.
• Show that you would analyze the exceptions before just reporting the number.
• Follow a clear and appropriate escalation path.

Don’ts ❌

• Immediately go to the client and tell them their process is failing.
• Just report the number of exceptions without any analysis of why they are happening.
• Do nothing and just document the exceptions in your workpaper without flagging them.

💡 Why This Answer Works: This answer demonstrates a mature and professional approach to handling a difficult finding. It shows you can be analytical in your investigation and that you understand the correct protocol for escalating a significant issue. It proves you can be a reliable and responsible member of a risk advisory team.

Q12: How would you explain a complex business risk to a non-expert?

I would use a simple, relatable analogy and focus on the potential impact. For example, if I had to explain "supply chain concentration risk," I would avoid the jargon. I would say, "Imagine you are making a pizza, and you only buy your cheese from one single shop in the entire city. That shop gives you a great price. But what happens if that one shop closes down for a week? You can't make any pizzas, and your business stops. That's concentration risk. Our client has the same situation with a key component for their product. Our recommendation is that they find a second or third 'cheese shop' as a backup, even if it costs a little more."

Dos ✅

• Use a simple and powerful analogy.
• Avoid all technical risk management jargon.
• Focus on explaining the tangible impact or consequence of the risk.

Don’ts ❌

• Use a complex or academic definition.
• Try to impress the person with your technical knowledge.
• Fail to make the risk feel real and understandable.

💡 Why This Answer Works: This answer showcases excellent communication and simplification skills. The ability to explain a complex risk in simple, understandable terms is a critical skill for a risk advisor. It proves you can communicate effectively with clients who may not be risk experts.

Q13: You are in a client meeting, and they seem to be downplaying a risk that you believe is significant. What would you do?

As an analyst, my role would be to support my manager in that meeting. I would not challenge the client directly. However, I would find an appropriate moment to ask a clarifying, data-driven question. I might say something like, "That's an interesting perspective. Could we quickly look at the data on slide 10 again? It shows that this issue has occurred 25 times in the last quarter, with an estimated financial impact of X. I want to make sure I'm understanding correctly how the current process mitigates this." This approach respectfully brings the conversation back to the objective data and allows my manager to lead the strategic conversation.

Dos ✅

• Understand and respect your role as an analyst in a senior meeting.
• Use a data-driven, non-confrontational question to re-introduce the facts.
• Be a supportive team player to your manager.

Don’ts ❌

• Directly confront or argue with the senior client.
• Stay completely silent if a significant risk is being dismissed.
• Put your manager in a difficult position.

💡 Why This Answer Works: This is a test of your professional judgment and situational awareness. This answer is very mature because it shows you know how to be assertive and uphold your analysis without overstepping the boundaries of your role. It proves you can be an effective and politically savvy member of a client-facing team.

Q14: Why are you interested in a career in Risk Consulting specifically, as opposed to Audit or Advisory?

I'm specifically interested in Risk Consulting because I am fascinated by the forward-looking nature of the work. While Audit often looks at historical financial statements, and Management Consulting might solve a specific strategic problem, Risk Consulting seems to be about understanding the complex web of threats and opportunities a business will face in the future. I am drawn to the challenge of helping clients prepare for what's around the corner, whether that's a new cybersecurity threat, a supply chain disruption, or a new regulation. I believe this proactive, forward-looking perspective is the most interesting and impactful area to build a career.

Dos ✅

• Clearly and respectfully differentiate between the service lines.
• Show a clear understanding of the forward-looking nature of Risk Consulting.
• Align your personal interests (e.g., being proactive, thinking about the future) with the nature of the role.

Don’ts ❌

• Speak negatively about the other service lines.
• Give a vague answer like "it seems interesting."
• Show that you don't really understand the difference between the domains.

💡 Why This Answer Works: This is a key motivation question. This answer is strong because it is specific and insightful. It demonstrates a sophisticated understanding of the different professional services and a genuine, well-reasoned interest in the unique nature of Risk Consulting.

Q15: Why KPMG?

I am specifically targeting KPMG's Risk Consulting practice for a few key reasons.

1. Values and Trust: Risk Consulting is fundamentally about building trust. KPMG's strong global brand and its core value of 'Integrity' make it the ideal platform to build a career in this field.
2. Market Reputation: KPMG is consistently ranked as a market leader in Risk Advisory services. I'm excited by the opportunity to learn from the best and work on complex risk challenges for the firm's top-tier clients.
3. Integrated Approach: I'm drawn to the collaborative culture at KPMG. The chance to work on risk engagements that involve our experts in Cyber, Deals, and Tax provides a holistic learning experience that is very appealing.

Dos ✅

• Be specific and reference KPMG's values and market position.
• Show that your reasons are aligned with your own career goals (learning, working on complex problems).
• Demonstrate a genuine, well-researched interest in the firm's specific strengths.

Don’ts ❌

• Give generic praise that could apply to any Big 4 firm.
• Say it's your "top choice" without being able to say why.
• Focus on superficial aspects like the size of the firm.

💡 Why This Answer Works: This answer is strong because it is specific, well-researched, and tailored. It proves you have made an active, informed choice to apply to KPMG's Risk Consulting practice. It shows genuine interest in the specific things that differentiate the firm, which makes you a much more compelling candidate.

Mini-FAQ — KPMG Risk Consulting Analyst Role

• Q: What is the career path after the Analyst role?

A: The path is typically Analyst → Consultant → Assistant Manager → Manager. As you progress, you will start to specialize in a specific area of risk (like Cyber, Financial, or Internal Audit) and take on more responsibility for managing parts of an engagement.

• Q: What kind of projects would I work on?

A: The projects are incredibly diverse. In one month, you could be helping a bank test its financial controls, and in the next, you could be helping a manufacturing company map its supply chain to identify disruption risks.

• Q: Do I need to be a CA for this role?

A: Unlike Audit, it is not always mandatory. While CAs are highly valued, especially in financial and internal audit-related risk services, KPMG's Risk Consulting practice hires from a wide range of backgrounds, including engineering and business graduates, for roles in areas like Cyber and Strategic Risk.

• Q: What is the most important skill for a new Risk Consulting Analyst?

A: Intellectual curiosity. The ability to learn quickly, ask smart questions, and think critically about a wide variety of business problems and risks is the most important skill for success.

Next Steps: Ace Your KPMG Interview

Great preparation is the key to confidence. Take the next step in your journey:

• ➡️ Explore Other Guides: Get ready for any opportunity by reading our interview guides for the Risk Advisory teams at PwC, Deloitte, and EY.
• 📚 Master the Fundamentals: Deepen your knowledge with our comprehensive articles on Business Process Mapping and The COSO Framework for Internal Controls.
• 🚀 Get Expert Feedback: Want to test your skills in a realistic setting? Learn more about our 1-on-1 Mock Interview Coaching with former Big 4 risk advisors.