KPMG Roles and Responsibility

These questions assess your ability to structure risk-related problems, manage projects, and apply risk management methodologies.

Q1: A client wants to develop a 'Risk Appetite Framework.' What are the key components you would include?

A Risk Appetite Framework helps a company define the amount and type of risk it is willing to take to achieve its strategic objectives. The key components I would include are:

1. Risk Appetite Statement: A high-level qualitative statement from the board that outlines the company's overall stance on risk-taking.
2. Risk Categories: Breaking down the risks into key categories relevant to their business (e.g., Strategic, Operational, Financial, Compliance).
3. Risk Limits & Tolerances: For each category, defining specific, measurable metrics and setting thresholds. For example, for financial risk, a tolerance might be "we will not take on projects with a potential loss greater than ₹10 Crores."
4. Roles & Responsibilities: Clearly defining who is responsible for monitoring these risks and what the escalation protocol is when a limit is breached.
5. Reporting & Monitoring: A process for regular reporting on the company's risk profile against its stated appetite to the board and senior management.

Dos ✅

• Describe a structured, multi-component framework.
• Differentiate between the qualitative statement and the quantitative limits.
• Emphasize the importance of clear ownership and escalation protocols.

Don’ts ❌

• Give a vague definition without any specific components.
• Only focus on the high-level statement without mentioning measurable metrics.
• Forget the crucial governance aspect of roles, responsibilities, and reporting.

💡 Why This Answer Works: This answer demonstrates a strategic understanding of risk governance. It's a comprehensive and well-structured framework that proves you can think like a senior advisor about how an organization should formally define and manage its relationship with risk.

Q2: How would you structure a project plan for a 4-week Internal Audit of the 'Order-to-Cash' cycle?

I would structure the plan to ensure a thorough review and a timely report.

• Week 1: Planning & Scoping: This involves holding a kickoff meeting with the client, understanding the key sub-processes and systems, identifying the key risks (e.g., incorrect invoicing, delayed collections), and finalizing the audit scope and program. We would also send out our initial data and documentation requests this week.
• Week 2: Fieldwork - Walkthroughs & Controls Testing: This week is focused on process walkthroughs with the client's team to understand the "as-is" process and performing detailed testing of the key internal controls to see if they are operating effectively.
• Week 3: Fieldwork - Substantive Testing & Analysis: This week would involve substantive testing of transactions and data analysis to identify any control failures or monetary errors. We would also begin to synthesize our findings.
• Week 4: Reporting & Closeout: The final week is dedicated to drafting our internal audit report, including our findings and recommendations, validating our findings with management, and holding a final closing meeting.

Dos ✅

• Break the project into logical, distinct phases.
• Show a clear progression from planning to fieldwork to reporting.
• Differentiate between controls testing and substantive testing.

Don’ts ❌

• Present a simple list of tasks without a clear timeline.
• Forget to include crucial steps like the kickoff meeting or validating findings with management.
• Have a plan that seems unrealistic for the 4-week timeline.

💡 Why This Answer Works: This question tests your project management skills in a core risk advisory context. This phased approach is a practical, realistic, and professional plan. It demonstrates that you can take a standard engagement and structure it for success, a key skill for a workstream lead.

Q3: Explain the 'Three Lines of Defense' model in risk management.

The 'Three Lines of Defense' is a widely used model for structuring risk management roles and responsibilities within an organization.

1. First Line of Defense: This is the business and process owners themselves. They are on the front line, and they own and manage the risks associated with their day-to-day operations. For example, a sales manager is responsible for the risk of giving incorrect discounts.
2. Second Line of Defense: This consists of the risk management and compliance functions. They provide the oversight, policies, and frameworks that the first line uses to manage risk. They are specialists who support and challenge the first line.
3. Third Line of Defense: This is the Internal Audit function. They provide independent and objective assurance to the board and senior management that the overall risk management and internal control framework is working effectively. They are independent of the first two lines.

Dos ✅

• Correctly identify all three lines in the correct order.
• Clearly and accurately define the role and responsibility of each line.
• Use a simple example to illustrate the role of the first line.

Don’ts ❌

• Mix up the order or the responsibilities of the different lines.
• Be unable to explain the concept of independence for the third line.
• Give a purely academic definition without showing you understand its practical application.

💡 Why This Answer Works: This question tests your knowledge of foundational risk governance frameworks. This answer is strong because it is a clear, accurate, and concise explanation of a fundamental industry model. It proves you have the core theoretical knowledge required to be a credible risk advisor.

Q4: A client in the manufacturing sector is concerned about supply chain disruptions. How would you structure an analysis to identify and prioritize their key supply chain risks?

I would structure the analysis to be both comprehensive and actionable.

1. Map the Supply Chain: My first step, working with the client, would be to visually map their end-to-end supply chain, from key Tier-2 suppliers to manufacturing, logistics, and final customers.
2. Identify Potential Risks: For each node in the map, I would lead a brainstorming workshop with the client to identify potential risks. I would categorize these risks into buckets like:

• Geopolitical Risks: e.g., over-reliance on a single country for a key component.
• Logistical Risks: e.g., dependence on a single port or shipping lane.
• Supplier Risks: e.g., the financial instability of a critical supplier.
• Operational Risks: e.g., a single point of failure in their own manufacturing process.

1. Prioritize the Risks: We can't solve everything at once. I would use a simple risk matrix to prioritize these risks based on their Likelihood (how likely they are to occur) and their Impact (the financial and operational consequence if they do occur). This allows us to focus our mitigation efforts on the most critical risks in the top-right quadrant of the matrix.

Dos ✅

• Describe a structured, multi-step approach.
• Start with a foundational step like process mapping.
• Use a recognized risk management tool like a likelihood/impact matrix for prioritization.

Don’ts ❌

• Just list a few random supply chain risks without a structured approach.
• Offer solutions before you have identified and prioritized the problems.
• Forget the crucial final step of prioritization.

💡 Why This Answer Works: This answer demonstrates a strong, structured problem-solving approach applied to a real-world business problem. The "Map -> Identify -> Prioritize" framework is a classic and effective consulting methodology. It proves you can take a broad, complex problem and break it down into a logical analysis that leads to an actionable outcome.

Q5: What is a 'Control Risk Self-Assessment' (CRSA), and what is your role in facilitating such a workshop?

A Control Risk Self-Assessment, or CRSA, is a collaborative process where we work with a business team to help them identify and evaluate the risks and controls in their own processes. It's a "do-it-with-them" rather than a "do-it-to-them" approach, which builds a stronger risk culture.

As a facilitator, my role is not to be the expert on their process, but to be the expert on the risk assessment process itself. My key actions would be:

1. Educate: I'd start the workshop with a brief training on the basic concepts of risk and control.
2. Facilitate Brainstorming: I would guide the team through a structured brainstorming session to identify the key risks in their area.
3. Guide the Assessment: I would then help them assess these risks and evaluate the effectiveness of the controls they have in place.
4. Synthesize and Document: My most important role is to listen, synthesize the discussion, and document the outputs in a clear and structured way, creating a risk and control register that the team can own and use going forward.

Dos ✅

• Correctly define a CRSA and its collaborative nature.
• Clearly define your role as a facilitator, not an auditor.
• Describe a structured approach for how you would run the workshop.

Don’ts ❌

• Confuse a CRSA with a traditional, independent internal audit.
• Describe a role where you are telling the team what their risks are.
• Underestimate the importance of the facilitation and synthesis skills required.

💡 Why This Answer Works: This question tests your knowledge of specific risk advisory methodologies. This answer is strong because it accurately describes the process and, more importantly, demonstrates a mature understanding of the consultant's role as a facilitator. This proves you have the soft skills to guide a client team to their own conclusions, which is a key to driving ownership and sustainable change.

This section focuses on your past experiences, demonstrating your ownership, coaching, and influencing skills.

Q6: Tell me about a time you managed a workstream on a risk or controls-related project.

• S (Situation): On an internal audit project for a large retail client, I was given ownership of the 'Inventory Management' workstream.
• T (Task): My task was to lead the end-to-end testing of the inventory controls over a three-week period, which included managing a junior analyst.
• A (Action): I started by creating a detailed work plan for our workstream. I delegated the initial control testing to the junior analyst, but first, I provided him with a clear set of instructions and a template. I conducted daily check-ins with him to review his progress and provide coaching. I personally handled the more complex parts of the analysis and the interviews with the senior client stakeholders.
• R (Result): We completed our workstream on schedule. Our work identified one significant control deficiency, which was included in the final report. The experience was a great opportunity to take on more responsibility for planning, execution, and guiding a junior team member.

Dos ✅

• Clearly define your scope of ownership ("Inventory Management" workstream).
• Showcase project management skills (creating a work plan).
• Demonstrate your ability to guide and leverage a junior team member.

Don’ts ❌

• Describe a project where you were just a contributor, not the owner of a workstream.
• Focus only on your own analysis without mentioning how you managed the process and the team.
• Be unable to state the specific outcome of your work.

💡 Why This Answer Works: This answer demonstrates ownership and project management, two key competencies for a Consultant. It proves you can be trusted to lead a significant piece of a project, manage the work of others, and deliver a high-quality output on a tight deadline.

Q7: Describe a time you had to present a sensitive risk-related finding to a mid-level client.

• S (Situation): During a process review, my analysis revealed that a specific team was consistently failing to perform a critical reconciliation control, creating a risk of financial misstatement.
• T (Task): I had to present this finding to the head of that team, who I knew would be defensive.
• A (Action): I didn't start the meeting by presenting the finding. I started by asking him about the challenges his team was facing. He mentioned they were understaffed. I then presented the finding, not as "your team is failing," but as "our analysis shows the reconciliation process is breaking down, likely because the team is stretched so thin. This is creating a risk of X." I then framed our recommendation as a way to help him make a business case for more resources.
• R (Result): This empathetic and solution-oriented approach worked. He was not defensive and actually partnered with us to build the case for hiring an additional team member. We addressed the risk and helped him solve his underlying problem.

Dos ✅

• Show empathy and an understanding of the client's context.
• Use a non-confrontational, data-driven approach.
• Frame your recommendation as a solution to the client's problem.

Don’ts ❌

• Be purely accusatory in your presentation.
• Present the problem without any thought about the underlying cause or potential solutions.
• Back down from your finding if the client is defensive.

💡 Why This Answer Works: This answer showcases strong influencing and client management skills. It demonstrates the ability to handle a classic consulting challenge: delivering a sensitive finding. The approach is mature, professional, and shows you can successfully guide a client from defensiveness to collaboration.

Q8: Give an example of how you used data analysis to identify a significant control weakness.

• S (Situation): I was on a project reviewing a client's HR processes. The client believed their employee termination process was well-controlled.
• T (Task): I was given a dataset of all employees who had left the company in the last year and their system access logs. My task was to analyze it for any control weaknesses.
• A (Action): Instead of just sampling, I joined the two datasets and used a simple script to look for a specific anomaly: any employee who had logged into a company system after their official termination date.
• R (Result): My analysis identified three instances where ex-employees had accessed the network after they had left. This was a significant security and data privacy risk that their manual control process had completely missed. Our finding led to the client implementing a new, automated de-provisioning control, which closed a major security gap.

Dos ✅

• Choose an example where data analysis revealed something that manual testing would have missed.
• Describe your analytical approach in a clear and logical way.
• Link your finding directly to a significant business risk and a positive process change.

Don’ts ❌

• Describe a very simple or obvious analysis.
• Be unable to explain the business risk associated with your finding.
• Use an example where your analysis had no real impact.

💡 Why This Answer Works: This is a powerful story that demonstrates your analytical and critical thinking skills. It's a perfect example of how a risk advisor can use data to uncover hidden risks and provide significant value to a client. It positions you as a modern, data-savvy professional.

Q9: Describe a time you had to work with a client team that was resistant to implementing a new control you recommended.

• S (Situation): We recommended that a client's sales team implement a new control that required an extra level of approval for large discounts. The sales team was very resistant, arguing that it would slow them down and cause them to lose deals.
• T (Task): My task was to get their buy-in to implement this important control.
• A (Action): I asked for a meeting with the sales manager. I started by acknowledging their primary goal: "I understand that your top priority is speed and winning deals, and you're concerned this will get in the way." I then presented an analysis showing that the company's margins were being significantly eroded by a few very large, uncontrolled discounts. I framed the new control not as a bureaucratic hurdle, but as a "guardrail to protect profitability" and ensure they were winning profitable deals.
• R (Result): By reframing the control from a "blocker" to a "protector of profitability" and showing them the data, the manager understood the rationale. We worked together to design an approval process that was fast and digital, and they agreed to implement it.

Dos ✅

• Start by showing empathy for the client's concerns.
• Reframe the control to align with what the stakeholder cares about (e.g., profitability).
• Use data to support your argument.

Don’ts ❌

• Just push the control as "best practice" without addressing their concerns.
• Get into an argument about whether the control is "good" or "bad."
• Escalate the issue to their boss without first trying to win them over.

💡 Why This Answer Works: This answer showcases advanced influencing and change management skills. The ability to reframe a recommendation to align with a stakeholder's interests is a masterful consulting technique. It proves you can be a persuasive and effective agent of change within a client organization.

Q10: Tell me about a time you had to mentor a junior consultant on how to conduct a client interview.

• S (Situation): I was leading a workstream, and a new analyst was about to conduct his first client interview to map a business process. He was very nervous.
• T (Task): My goal was to prepare him to conduct the interview confidently and effectively.
• A (Action): I didn't just give him the list of questions. I spent an hour with him on a coaching call. First, we discussed the overall objective of the interview. Second, we co-created the interview guide, and I explained the logic behind each question. Third, and most importantly, we did a role-play, where I played the part of the client so he could practice his questioning and listening skills in a safe environment.
• R (Result): The preparation worked perfectly. He went into the interview with a high degree of confidence and did an excellent job. The client even commented on how well-prepared he was. This became my standard coaching method for new analysts.

Dos ✅

• Describe a structured, multi-step coaching process.
• Include practical, hands-on techniques like role-playing.
• Show that your goal was to build the junior's confidence and skills.

Don’ts ❌

• Just say "I gave him some tips."
• Just give him the questions and send him into the meeting unprepared.
• Take over the interview yourself.

💡 Why This Answer Works: This answer demonstrates strong mentorship and talent development skills. The role-playing technique is a specific and highly effective coaching method. It proves you are a leader who is genuinely invested in building the capabilities of your team members.

This section focuses on future hypothetical scenarios to test your judgment, leadership, and advisory skills.

Q11: You are leading a workstream and realize your team's analysis is not sufficient to form a clear conclusion on a key risk. Your deadline is in two days. What do you do?

I would immediately flag the issue and propose a revised plan. I would not try to force a conclusion from weak data. My first step would be to inform my manager, presenting the issue clearly: "Here is the analysis we have done. My assessment is that it is not yet robust enough to support a firm conclusion on this key risk. To close this gap, we need to do X and Y." I would then present a few options, such as "We can deliver the rest of the report on time and flag this as an area requiring further work," or "We can request a short extension to complete this critical analysis."

Dos ✅

• Prioritize the quality and integrity of your analysis over the deadline.
• Be proactive and transparent in your communication with your manager.
• Propose clear options and a solution, not just the problem.

Don’ts ❌

• Hide the issue and hope your manager doesn't notice.
• Present a weak or unsupported conclusion just to meet the deadline.
• Blame your team for the insufficient analysis.

💡 Why This Answer Works: This answer demonstrates professional judgment and accountability. It shows you are a responsible leader who will not compromise on quality. The focus on proactive communication and presenting clear options proves you can be trusted to manage difficult situations professionally.

Q12: Your manager has asked you to assess a risk using a standard firm methodology, but you believe the methodology is not a good fit for this specific client situation. How do you handle this?

I would handle this with a respectful and data-driven discussion. I would first apply the standard methodology as requested, to show I am a team player. However, I would also concurrently prepare an alternative analysis using a methodology I believe is a better fit. I would then schedule a meeting with my manager and say, "I've completed the analysis using our standard framework as you asked. While doing it, I noticed a few areas where the client's unique situation doesn't quite fit the model. I've taken the initiative to run the analysis a second way, which I think might provide a clearer picture. Could I walk you through both?" This approach shows respect for their direction, but also demonstrates initiative and critical thinking.

Dos ✅

• Be respectful and non-confrontational.
• Do the work as requested first before presenting an alternative.
• Use a data-driven argument to support your alternative approach.
• Show initiative and critical thinking.

Don’ts ❌

• Just refuse to use the standard methodology.
• Go over your manager's head.
• Criticize the firm's standard methodology without offering a better solution.

💡 Why This Answer Works: This answer demonstrates a perfect balance of being a team player and a critical thinker. It's a politically savvy and highly effective way to manage upwards. It proves you can be trusted to not only follow instructions but also to proactively add value and improve the quality of the team's work.

Q13: You are in a client meeting, and a client manager asks for your opinion on a strategic decision that is outside your scope but has risk implications. How do you respond?

I would be helpful but also careful to stay within my role's boundaries. I would respond by saying, "That's a very important strategic question. From a risk perspective, some of the key things to consider for a decision like that would be X, Y, and Z. However, a full strategic recommendation is a bit outside the scope of our current project. I would be happy to take this back to my project manager and the partner, and perhaps we can connect you with our colleagues in our strategy practice who are experts in this area."

Dos ✅

• Be helpful by providing a high-level risk framework.
• Clearly and professionally state the boundaries of your current scope.
• Use it as an opportunity to connect the client with another part of the firm.

Don’ts ❌

• Give a detailed strategic opinion that you are not qualified to give.
• Shut the client down by just saying "that's not my job."
• Miss the opportunity to be helpful and create a potential lead for another team.

💡 Why This Answer Works: This answer shows excellent professional judgment and commercial awareness. It demonstrates that you understand the importance of staying in your "lane" of expertise to manage risk, while also being a collaborative "One KPMG" professional who can spot opportunities to bring the full power of the firm to help the client.

Q14: How do you ensure your recommendations are practical and commercially viable for the client, not just theoretically correct?

I use a "client-first" filter for all my recommendations.

1. Involve the Client: I make sure to involve the client's team in the problem-solving process. This ensures our recommendations are grounded in their reality.
2. Quantify the Impact: Every recommendation must be supported by a clear business case that quantifies the expected benefit (e.g., cost savings, revenue increase) and the estimated cost and time to implement.
3. Create a Roadmap: I don't just provide a list of recommendations. I provide a prioritized implementation roadmap, starting with the "quick wins" to build momentum.
4. "Day in the Life" Test: Before finalizing a recommendation, I always ask, "What would this actually mean for the day-to-day job of the person who has to implement it?" This helps to ensure our ideas are practical, not just theoretical.

Dos ✅

• Have a clear, multi-part framework for ensuring practicality.
• Emphasize collaboration with the client.
• Focus on creating a quantified business case and a clear implementation plan.

Don’ts ❌

• Only focus on the theoretical "best practice" solution.
• Deliver a list of recommendations without a clear plan for how to implement them.
• Create a solution without considering the client's organizational culture or capacity for change.

💡 Why This Answer Works: This answer demonstrates a strong client-centric and commercial mindset. It proves you understand that the goal of consulting is not to create a smart report, but to create a real, tangible impact for the client. This is a key attribute of a successful consultant.

Q15: Why are you interested in a senior role in Risk Consulting at KPMG?

I have built a strong foundation in risk analysis, and I am now ready to take on more leadership responsibility in a firm that I believe truly values this function.

1. Values and Trust: Risk consulting is fundamentally about establishing trust. KPMG's brand is built on a foundation of integrity, which I believe is the most critical value in this profession. I want to advise clients from that strong ethical platform.
2. Industry Leadership: KPMG is a recognized leader in key risk areas like internal audit and financial risk. As I look to deepen my specialization, KPMG's strong client base and market reputation in the [e.g., Banking] sector provide the best opportunity.
3. Collaborative Approach: I'm drawn to the firm's collaborative, "One KPMG" approach. The ability to work on complex risks that require input from our colleagues in Cyber, Deals, and Tax is how the best, most holistic solutions are created for clients.

Dos ✅

• Show a clear understanding of the step-up in responsibility.
• Be specific about why KPMG's values and market position appeal to you.
• Link your ambition to the specific opportunities at the firm.

Don’ts ❌

• Just say "I want a promotion."
• Be unable to articulate why you want to stay in Risk Consulting.
• Give a generic answer that could apply to any company.

💡 Why This Answer Works: This is a key motivation question. This answer is strong because it is specific, ambitious, and tailored to KPMG. It demonstrates that you have a clear career plan and have thought strategically about why KPMG is the right place for you to take the next step.

Mini-FAQ — KPMG Risk Consulting Consultant Role

• Q: What is the career path after Consultant?

A: The path is typically Consultant → Assistant Manager → Manager. The Assistant Manager role involves leading entire engagements, managing the client relationship at a more senior level, and taking on formal business development responsibilities.

• Q: Is specialization expected at this level?

A: Yes. As a Consultant, you will deepen your specialization in a specific risk area, such as Cyber Risk, Financial Risk, or Internal Audit. This expertise is the foundation of the value you bring to the team and the client.

• Q: How much client interaction is there?

A: A very significant amount. You will often lead client workshops, present your workstream's findings to client managers, and be a key day-to-day contact for your client counterparts.

• Q: What are the most important skills for a Risk Consulting Consultant?

A: A combination of structured problem-solving and strong client communication skills. The ability to take a complex risk, break it down into a logical analysis, and then communicate your findings and recommendations clearly to a client is the key to success.

Next Steps: Ace Your KPMG Interview

Great preparation is the key to confidence. Take the next step in your journey:

• ➡️ Explore Other Guides: Get ready for any opportunity by reading our interview guides for the Risk Advisory teams at PwC, Deloitte, and EY.
• 📚 Master the Fundamentals: Deepen your knowledge with our comprehensive articles on Risk Appetite Frameworks and The Three Lines of Defense Model.
• 🚀 Get Expert Feedback: Want to test your skills in a realistic setting? Learn more about our 1-on-1 Mock Interview Coaching with former Big 4 risk advisors.