Dynamic Risk
Assessment
The power of four
The power of four
An evolution in risk assessment that
applies sophisticated algorithms and
advanced data analytics together in
a KPMG proprietary methodology to
identify, connect and visualise risk in
four dimensions.
[Link]
Why is Dynamic Risk
Assessment different?
The business environment is becoming ever more Traditional risk management approaches do not lend
unpredictable. Rather than long periods of stability with themselves to being able to answer these questions
occasional disruptions, we are in a time where disruption because they typically:
is becoming the norm. The World Economic Forum calls
– consider risks individually with linear relationships
it ‘the age of the polycrisis’, a world in which clusters
(if any) between them
of related global risks continually compound, such
that the overall impact exceeds the sum of each part. – identify ‘significant’ risks on an individual basis rather
In this context, traditional ways of understanding and than reflecting the cumulative effect of interconnected
responding to risk are simply no longer sufficient. risks forming a cluster with potentially a far greater
likelihood and/or consequence in aggregation
KPMG’s Dynamic Risk Assessment (DRA) marks a
groundbreaking shift in risk identification. DRA was – aggregate multitudes of operational risks, to obtain a
developed to provide clients with a better understanding top level risk profile through qualitative and subjective
of the risks their organisations face in today’s complex means based on averages or worst case scenarios.
world of increasing geopolitical and economic volatility. The outcome thus often lacks rigour and cannot
This includes developing technology, emerging markets, withstand scrutiny
climate change, growing populations and other
– grossly underestimate risk contagion within
megatrends that interact and shape our future.
the network, as well as velocity of impact.
DRA takes an unprecedented approach to gaining Notwithstanding that experience shows that failures
insights into risk environments – by pinpointing typically result from a number of risk events
central risks and shedding new light on the occurring simultaneously or within a short space of
effectiveness of controls. time so that historic, single risk mitigation strategies
become ineffective
Management and boards often ask:
– design mitigation strategies on a risk-by-risk basis with
– How do the many operational risks aggregate and
limited understanding of where resources should best
interrelate to impact the overall summarised risk
be applied to achieve a reduction in risk across the
profile presented to the executive and the board?
entire risk network.
– Do we have a complete understanding of our risk
The power of considering all four dimensions of
profile or are there emerging risks or structural breaks
risk overcomes these limitations and enables the
(macro-economic, geopolitical, sociopolitical and other
transformation of risk into opportunity.
megatrends not necessarily previously observed) that
are not being addressed?
– If a risk event was to occur, how quickly would it
adversely impact the business?
– How can we go beyond operational resilience to using
risk to create opportunity and competitive advantage?
– Are our resources being applied as efficiently and
effectively as possible to achieve a risk outcome
commensurate with our risk appetite?
© 2023 KPMG Law, an associate of KPMG. KPMG is an Australian partnership and a member firm of the KPMG network of independent member
firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The KPMG name and logo are KPMG’s Dynamic Risk Assessment 1
registered trademarks or trademarks of KPMG International. Liability limited by a scheme approved under Professional Standards Legislation.
The power of four
Looking beyond conventional depictions of risk, typically
based solely on likelihood and severity, Dynamic Risk
Assessment takes a four-dimensional view by including
connectivity and velocity. This enables consideration of
the contagion effect of risks – one of the most significant
learnings from the Global Financial Crisis.
In these turbulent times, organisations need to Dynamic Risk Assessment is the key with which those
approach risk assessment with fresh thinking and deeper insights can be unlocked. It is an evolution in risk
innovative solutions. As geopolitical and economic assessment that applies actuarial theories, sophisticated
volatility becomes the norm, and the past is no longer algorithms and advanced data analytics together in a
an indicator of things to come, seemingly disparate KPMG proprietary (patent pending) methodology to
events can become inextricably linked. This makes identify, connect and visualise risk in four dimensions:
assessing risk exposure especially difficult because
– Likelihood
risk is unpredictable and contagious, and connected
globally within complex organisational structures. – Impact
Focus needs to shift – Velocity
It’s increasingly important to understand and monitor – Connectivity.
emerging risks and be aware of what out-of-trend risks
(structural breaks) could arise in this age of disruption. Combining the latest in applied science with insights
from management and extensive benchmarking, DRA
Equally, as global organisations expand their reach
modelling allows our risk professionals to see where
beyond traditional geographic and sector boundaries,
risks can be expected to form critical clusters or trigger
they not only create new opportunities, but also expose
other risks through ‘contagion’.
themselves to potential new risks. At the same time,
organisations are being influenced by macro-economic, By exposing the expected contagion effects between
geopolitical and other megatrends not necessarily global and enterprise risks, we can objectively measure
observed in the past. the genuinely significant threats. These may not be the
risks with the highest impact individually, but rather the
Recognising that past data and assumptions are severely
risks with the most significant connections and, hence,
limited in a world of developing technology, emerging
the ability to trigger several risks in a short time frame.
markets, climate change, growing populations and other
megatrends that interact and shape our future, KPMG’s These fresh insights provide clients with new insights
risk professionals are well-positioned through DRA to be to drive more informed decision-making within their
able to help you turn risk into opportunity and increase organisations on how to best tackle and monitor these
resilience while disruption and volatility unfold. threats and, where possible, create opportunity.
A turning point
At KPMG we realised that a turning point has been
reached where traditional, two-dimensional risk
management methodologies (that focus on single points
of risk with high likelihood and severity) may be limiting
the value of risk management in increasingly complex
and global organisations. Extending from this is the
realisation that the ability to understand an organisation’s
risk interrelationships can be significantly improved if we
find a way to identify potential risk contagion.
© 2023 KPMG Law, an associate of KPMG. KPMG is an Australian partnership and a member firm of the KPMG network of independent member
firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The KPMG name and logo are KPMG’s Dynamic Risk Assessment 2
registered trademarks or trademarks of KPMG International. Liability limited by a scheme approved under Professional Standards Legislation.
Dynamic Risk
Assessment explained
KPMG’s Dynamic Risk Assessment (DRA) In short, KPMG applies advanced mathematics and
methodology applies network theory to identify analytical tools to produce an understandable and
expected contagion between structural breaks, personalised system risk network report.
global risks, megatrends and organisational risks.
This process enables the move from a two-dimensional
We model this expected contagion through working view of independent risks to an interconnected view
with experienced individuals from across your of the four dimensions of risk – Likelihood, Impact,
organisation and applying the findings of published Velocity and Connectivity.
research into network theory to produce a bespoke
systemic risk network for your organisation, as well
as a comprehensive analysis of the characteristics
of your risk network.
Traditional, two-dimensional risk map Interconnected view
High The individually most
significant risk
Likelihood and severity of this exhibits low levels of
cluster exceeds those of this expected contagion
single risk
Potential impact
This individually insignificant risk
significance: it triggers many
other risks into existence, all of
them more significant than itself
Low Likelihood of occurrence of High
Connectivity strength:
material financial statement error
Likelihood
low
medium
high
Severity
© 2023 KPMG Law, an associate of KPMG. KPMG is an Australian partnership and a member firm of the KPMG network of independent member
firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The KPMG name and logo are KPMG’s Dynamic Risk Assessment 3
registered trademarks or trademarks of KPMG International. Liability limited by a scheme approved under Professional Standards Legislation.
Risk interconnectedness
and clusters
Interconnectedness The domino effect
Interconnectedness assists with more holistic risk Whilst individual risks may not be regarded as
management by illuminating an additional dimension significant due to their assessed likelihood and
which shows the impact risks have on each other. impact, it may change when the risks are considered
Groups of strongly related risks are called risk ‘clusters’. in combination considering clusters. Risks in a cluster
These are relevant because organisational failures are can be subject to the ‘domino’ effect and this effect can
seldom the result of a single risk event but are more be mathematically quantified such that the collective
typically the consequence of a number of related risks impact and likelihood of the cluster as a whole can be
materialising at the same time. understood. By understanding the overall impact and
likelihood of connected risks, appropriate resources can
Risk clusters are determined mathematically by analysing
be allocated.
a number of factors. All risks within a cluster are likely
to either trigger/make another risk more severe or be The illustration below depicts how the labour, security
triggered/made more severe by other risks in the cluster. and leadership skills/culture risks (bottom right) are
individually rated to have an impact which is not
Access to resources considered to be ‘High’. However, due to the cumulative
Information Technology
Water impact of these risks collectively, this cluster of risks
Liquidity or funding
has an impact which is between ‘High’ and ‘Very High’.
Lack of
agility in Fatality
Their collective likelihood has increased slightly as well.
strategic
positioning Leadership skills /culture In this way, DRA is superior to traditional aggregation
Poor capital allocation
Strategy and
Global Warming techniques which, in order to determine the rating
financial risk cluster of a number of risks together, will often take either
Reputation risk
Commodity risk the average of the risk ratings of a group of risks, or
Security
alternatively, the highest rated risk. Using either of these
Labour
Price of energy resources Human capital risk Cluster methods in the scenario below would have reported a
much lower risk outcome than what DRA does using
Relative Inter- established science.
Connectedness
Low/Nil* Low-Med Medium Med-High High
Relative Impact
Low Medium High
Severity
Extremely High
Strategy and Financial Risk
Cluster
Very High
Lack of agility in strategic
positioning
Fatality
Commodity risk
Human Capital Risk Cluster
Poor capital allocation
Liquidity or funding
Global Warming
Water
High
Access to resources
Leadership skills / culture
Price of energy resources
Reputation risk
Security
Information Technology
Labour
Medium
Unlikely Possible Likely
Likelihood
© 2023 KPMG Law, an associate of KPMG. KPMG is an Australian partnership and a member firm of the KPMG network of independent member
firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The KPMG name and logo are KPMG’s Dynamic Risk Assessment 4
registered trademarks or trademarks of KPMG International. Liability limited by a scheme approved under Professional Standards Legislation.
Positive risk contagion
An added advantage of understanding interconnectedness This differs to traditional risk management thinking
is that it enables management to understand which whereby the risks outside of appetite are typically
risks have the strongest connections and, hence, where allocated the most resources.
resources should be allocated for maximum benefit.
Whilst the traditional approach may reduce the risk to a
In the current environment, it’s important to ensure rating within appetite, only one risk is typically mitigated,
that any capital allocated will have the maximum which has little impact on the risk network as a whole.
impact possible. By understanding the connections
We quite often find that the points of vulnerability
between risks, and consequently which risks trigger
(the risks which must go right) are within appetite and
others (compared to those that are triggered by others),
hence are not being closely managed or monitored.
the vulnerable points in the network can be identified.
Allocating additional resources to these risks rather than
These are the risks which ‘must go right’ for the other
to those outside of appetite can equate to a cost saving.
risks to not be triggered.
This is because treating this one very connected risk
In a capital conscious environment it’s these interwoven has flow-on implications to the whole network, thereby
points of vulnerability which should be allocated the creating an opportunity to bring numerous risks back
most resources. within appetite.
Traditional, two-dimensional risk map Interconnected view
High The individually most
significant risk
Likelihood and severity of this exhibits low levels of
cluster exceeds those of this expected contagion
single risk
Potential impact
This individually insignificant risk
significance: it triggers many
other risks into existence, all of
them more significant than itself
Low Likelihood of occurrence of High
Connectivity strength:
material financial statement error
Likelihood
low
medium
high
Severity
© 2023 KPMG Law, an associate of KPMG. KPMG is an Australian partnership and a member firm of the KPMG network of independent member
firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The KPMG name and logo are KPMG’s Dynamic Risk Assessment 5
registered trademarks or trademarks of KPMG International. Liability limited by a scheme approved under Professional Standards Legislation.
Contact us
Need more information?
Want to speak with a subject matter expert?
Merriden Varrall Stuart Johnson Paul Lichtenstein
Partner, Geopolitics Hub Lead Partner, Project Partner, Financial Risk
T: +61 2 9335 8223 Controls & Assurance & Advanced Analytics
E: mvarrall@[Link] T: +61 3 9288 6182 T: +61 3 9288 6420
E: spjohnson@[Link] E: plichtenstei@[Link]
Kevin Smout
Partner, Risk Strategy & Peter Beaton Katherine Shaw
Technology and Global Leader Partner, Governance, Partner, Governance,
for Governance, Risk & Risk & Control Services Risk & Control Services
Assurance Services T: +61 7 3233 9630 T: +61 2 9335 8056
T: +61 8 9263 7105 E: pbeaton@[Link] E: kashaw@[Link]
E: ksmout@[Link]
Caron Sugars
Michael Hill Partner, Governance, Risk &
Global Lead, Assurance & Control Services and Board
Integrity Head of Risk Consulting Advisory Services
for Infrastructure, Government T: +61 8 9263 4850
& Healthcare E: ccobargsugar@[Link]
T: +61 3 9288 5589
E: mwhill@[Link]
[Link]
The information contained in this document is of a general nature and is not intended to address the objectives, financial situation or needs of any particular individual or entity. It is provided
for information purposes only and does not constitute, nor should it be regarded in any manner whatsoever, as advice and is not intended to influence a person in making a decision,
including, if applicable, in relation to any financial product or an interest in a financial product. Although we endeavour to provide accurate and timely information, there can be no guarantee
that such information is accurate as of the date it is received or that it will continue to be accurate in the future. No one should act on such information without appropriate professional advice
after a thorough examination of the particular situation.
To the extent permissible by law, KPMG and its associated entities shall not be liable for any errors, omissions, defects or misrepresentations in the information or for any loss or damage
suffered by persons who use or rely on such information (including for reasons of negligence, negligent misstatement or otherwise).
© 2023 KPMG, an Australian partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”),
a Swiss entity. All rights reserved.
The KPMG name and logo and are registered trademarks or trademarks of KPMG International.
Liability limited by a scheme approved under Professional Standards Legislation.
July 2023. 1155829169AARC
© 2023 KPMG Law, an associate of KPMG. KPMG is an Australian partnership and a member firm of the KPMG network of independent member
firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The KPMG name and logo are
registered trademarks or trademarks of KPMG International. Liability limited by a scheme approved under Professional Standards Legislation.
