Explore all risks
Risk trend indicators
We continue to navigate the turbulence of geopolitical and macroeconomic tensions, disruptive technologies, demographic change, and ongoing scrutiny of the profession. The complexities of the resulting operating environment mean that the risk landscape is constantly evolving, interconnectivity of risk has become more evident, and risks are materialising more, and more quickly as a result. The need to constantly review and adapt our strategy, at pace, will continue to be crucial in the year ahead.
We recognise the importance of continually shaping our business to remain relevant to our clients, whilst also being resilient to change and regular scrutiny. We are evolving our delivery model as we work more closely with an expanding ecosystem of third parties and alliance partners, to deliver to our clients’ needs. Our culture is a continuous focus, and quality remains at the heart of what we do. We continue to work hard to communicate openly with our stakeholders, and proactively manage our reputation.
We are accelerating our investment in, and adoption of, emerging technologies, particularly GenAI. In doing so, we are also cognisant of the need to manage the associated risks, including confidentiality, privacy, and responsible data use. As a result, a new risk has been added to our risk register this year to reflect the strategic importance of GenAI and the need to manage these associated risks. This additional risk looks to recognise the importance of delivering at pace against our AI strategy to ensure we remain relevant and seize the opportunity it presents, whilst aligning with the PwC Network strategy and managing the ethical considerations. The interconnectivity of risk is particularly evident here as AI pervades across our risk landscape.
We have also taken the opportunity to streamline some of our risks, and to stratify the risk landscape into operational and strategic risks in order to enable focused discussion and debate at the Executive Risk Committee. As a result, we have removed some risks from the Top Risks, whilst recognising that these risks are important and ongoing management of them will continue to be required.
The risk register brings together external and internal insight to understand the underlying risks the firm faces, agree on our mitigation strategies, and ground ourselves for navigating the changing, complex environment we find ourselves in.
Externally influenced
Regulatory developments impacting the business
Failure to identify, prepare for and adapt to further significant regulatory changes on our business and the competitive landscape.
{{risk-down}} 2024 trend
{{risk-neutral}} 2023 trend
{{risk-neutral}} 2022 trend
Risk landscape
- Continuing regulatory focus on large multidisciplinary firms with a sustained level of interaction with and supervision from regulators.
- Continued expectation that ARGA will be created.
Mitigations
- Regular engagement and direct interaction, where possible, with governmental bodies and regulators to understand objectives, provisions of changes and the implications for our businesses.
- Regular/continuous monitoring of the cumulative impact of changes in the regulatory environment on the firm’s ability to provide services to audit clients.
- Regulatory affairs specialists who lead the firm’s efforts to track all changes in applicable regulatory regimes, of whatever origin, under which the UK firm operates.
- Regular updating of the firm’s processes and procedures to ensure compliance by all our people, on all our clients, with all applicable regulations.
- Business contingency planning.
Externally influenced
Geopolitical & Macroeconomic risk
Failure to adapt our strategy in response to geopolitical and macroeconomic shifts resulting in failure to achieve growth and/or challenges to our ability to service our clients.
{{risk-neutral}} 2024 trend
{{risk-up}} 2023 trend
{{risk-neutral}} 2022 trend
Risk landscape
- Political and economic volatility continue globally fuelled by elections in major democracies and ongoing conflicts in the Ukraine and Middle East.
- Expectation that activism in the UK will increase over socioeconomic and geopolitical issues. Cost of living crisis continue to be a key focus.
- Tensions between the US and China expected to continue.
Mitigations
- Regular engagement with experts and the PwC Network to understand the changing political landscape.
- Standing agenda points on Management and Executive boards, with regular expert opinion sought.
- Ongoing monitoring of sanctions (global and UK) continues.
- Support provided by Business resilience teams for travel and security risks.
Externally influenced
Public perception and reputation
Failure to:
- Respond in an impactful and transparent manner to relevant UK or global issues raised, in particular to those which contain a public interest or moral dimension, and / or are perpetuated by adverse media coverage which impacts the firm’s reputation; or
- Appropriately manage the firm’s reputation by not proactively positioning the firm’s communications.
{{risk-neutral}} 2024 trend
{{risk-neutral}} 2023 trend
{{risk-neutral}} 2022 trend
Risk landscape
- Risk of negative sentiment as scrutiny of the audit profession continues to be a driver of media coverage.
- Risk of damage to the UK firm’s reputation through negative media coverage of issues, litigation or regulatory enforcement in PwC network firms.
- Continuing expectations from society that as a large organisation we deliver tangible actions in relation to key issues of public interest such as D&I and ESG.
- Navigating polarised issues in a time where employers are becoming more of a trusted source of information and are expected to take a position on issues of the day.
- Clear communications required to manage the transition to a new leadership team against a backdrop of disruptive technologies and uncertain market conditions.
Mitigations
- Embedding a culture of 'doing the right thing' from the top to the bottom of the organisation with an emphasis on individual accountability for reputational risk.
- Engaging in open and serious debate with network territories and relevant stakeholder groups on trust-related and public interest issues to inspire change.
- Sharing of knowledge and insights on trust to sustain, widen and enrich the discussion.
- Actively promote the firm’s positive contributions including those to our clients, our people and to broader society e.g. through our commitments to net zero, D&I and social mobility.
Evolving the firm
Evolving client services and products
Failure to stay relevant, to invest and evolve services/products including leveraging technology, data and alliances to meet changing market and client needs, which could lead to poor business performance and negatively impact our brand.
{{risk-up}} 2024 trend
{{risk-neutral}} 2023 trend
{{risk-neutral}} 2022 trend
Risk landscape
- Evolving client needs requiring us to identify changes, be agile and adapt at speed. This is increasing as we move into new products and services.
- Increased demand for Execution Managed Services from clients.
- Potential for new services to lead to increased regulatory and independence requirements.
- The market dynamics continue to be challenging in some areas due to macroeconomic uncertainty, but still contain opportunities for growth and competitive advantage.
Mitigations
Well-established procedures for responding to changing client needs, including:
- Monitoring of business dynamics and client trends.
- Upskilling programme to provide partners and staff with enhanced business and commercial skills.
- Management Board review and consideration of new client service and product offerings.
- Client Committee involvement in acceptance of higher risk engagements and new significant offerings.
- Markets & Services Leadership Team (MSLT) in place to execute go-to-market strategy.
Evolving the firm
Evolving delivery models and collaboration with third parties
Failure to evolve and manage resilient delivery models, including appropriate use of Service Delivery Centres, Alliances and third parties leading to quality issues, delivery disruption, financial and/or reputational risks.
{{risk-neutral}} 2024 trend
{{risk-neutral}} 2023 trend
{{risk-neutral}} 2022 trend
Risk landscape
- Focus on improving efficiencies and evolving the way we deliver client services.
- Increased reliance on resilience/business continuity of entities providing services to our clients from entities outside PwC UK.
- Increased demand for non-core skills and services to be provided by third parties in the delivery to clients.
- Increased use of alliances as part of our services to clients.
Mitigations
- Firmwide process for reviewing new delivery models to identify and address relevant risks.
- Internal focus on relevant on-boarding and operating processes and procedures.
- Established a third party risk management approach to ensure risks associated with third parties are identified and managed throughout the lifecycle of engagements.
- Launched EMEA Alliance Impact Centres to provide advice and guidance on integrated solutions and how to apply them to clients.
Operational
Audit services delivery quality
Significant audit quality failure in the UK firm or the PwC Network due to either:
- Engaging with an inappropriate client;
- Inadequate delivery of services; or
leading to a potential service failing, reputational risk, litigation and/or regulatory action.
{{risk-neutral}} 2024 trend
{{risk-neutral}} 2023 trend
{{risk-neutral}} 2022 trend
Risk landscape
- Delivering consistently high quality audits remains a core focus of our business as usual activities. The steps we take to ensure we deliver high quality audit services are set out in our Audit Quality plan (AQP).
- There is continued regulatory scrutiny and challenging litigation environment in the audit market.
- Careful consideration of organisations as part of the acceptance process will continue to be important.
- Continued exposure to issues arising from other firms in the PwC Network such as potential quality failures and the response to these by non-UK regulators, which may result in contagion or delivery risks for the UK.
Mitigations
Internal quality management systems, including:
- Regular reporting on audit quality and internal quality control procedures to various governance committees including the Audit Executive, the Management Board, and the Audit Oversight Body.
- Client engagement and acceptance processes, including the Audit Tender Acceptance Process and Client Committee;
- Annual Quality Management for Service Excellence testing of policies, processes and controls relating to audit quality;
- Real-time support for engagements through Real-time reviews of active engagement files
- Continuous Improvement team focused on root cause analysis, dynamic issue identification and action planning;
- Quality reviews of PwC network firms, including the UK firm; and
- Monitoring and review of key performance indicators by various governance groups including the Executive Board and the Audit Oversight Body.
Operational
Non-audit services delivery quality
Significant quality failure in the UK firm or the PwC Network due to:
- Engaging with an inappropriate client; or,
- Inadequate delivery of services,
leading to a potential service failing, reputational risk, significant cost to remedy, perceived or actual conflict of interest, litigation and/or regulatory action.
{{risk-up}} 2024 trend
{{risk-neutral}} 2023 trend
{{risk-neutral}} 2022 trend
Risk landscape
- More challenging external environment leading to increased competition and greater likelihood of higher-risk engagements across the portfolio.
- Increasing complexity of the work we are performing, the client situations we are supporting and the length of contracts.
- Execution Management Services, which can have different risk profiles to other types of typical services, continues to expand as part of the business.
- Increase in public / regulatory scrutiny over our management of perceived conflicts of interest arising from the provision of non-audit services to audit clients.
- Increased use of technology to deliver services or licensing of technology to clients.
- Evolving skills and resources needed to deliver specific engagements, in particular technology and data.
- Network failures may result in some contagion risk for the UK.
Mitigations
Internal quality management systems, including:
- Recruitment standards and staff development procedures;
- Client engagement and acceptance processes, including Line of Service Panels and Client Committee;
- Client engagement standards supported by methodologies and tools;
- Continue to establish quality policies, processes and procedures;
- Monitoring and reporting of higher risk engagements, including use of Delivery Governance Forums;
- Firmwide Quality Partner (‘QP’) programme;
- Quality reviews of PwC network firms, including the UK firm; and
- Monitoring and review of key performance indicators by various governance groups including the Executive Board.
Operational
Information and cyber security
Failure to adequately protect the firm’s technology landscape through the design, implementation and maintenance of information security capabilities, including security awareness which could lead to:
- Intentional leakage of the firm’s or our clients' confidential data by threat actors; or
- Reduced defences against ransomware attacks.
{{risk-neutral}} 2024 trend
{{risk-neutral}} 2023 trend
{{risk-neutral}} 2022 trend
Risk landscape
- The threat landscape is continuously evolving with AI adding a new vector, requiring us to continually enhance our cyber defences.
- Geopolitical turbulence continues, increasing the risk of cyber warfare
- Increased reliance on technology to deliver services leading to a greater risk of cyber security threats.
- Access to greater volumes of data from clients could put the firm into a target position.
Mitigations
- Cyber Committee chaired by a member of the Executive Board, which provides overall strategic direction, framework and policies for information security.
- The firm operates an ISO/IEC 27002:2013 certified information security management system which includes:
- Governance – including policies, processes, leadership (Cyber Committee) and assessment for client data and other information;
- Mandatory security education and awareness training for all and regular phishing simulations;
- Data leakage prevention controls and enhanced controls for high risk groups including FS clients and leavers;
- Physical, technical and human resource control;
- Threat intelligence;
- Incident response capability;
- Regular monitoring and independent review systems;
- Continual investment in established cyber security controls;
- Security awareness and education programmes; and
- Monitoring of ISO27701.
Operational
Regulatory compliance
Failure to comply with relevant independence, legal and regulatory (including sanctions, confidentiality and GDPR) requirements which could lead to regulatory action, financial penalties, reputational damage and/or a client conflict of interest.
{{risk-neutral}} 2024 trend
{{risk-neutral}} 2023 trend
{{risk-neutral}} 2022 trend
Risk landscape
- The global regulatory environment is more assertive and the financial crime sanctions environment continues to evolve and increase in scope, leading to increased monitoring and reporting to ensure the firm is compliant.
- The Economic Crime and Corporate Transparency Act 2023 is expected to materially impact the firm, introducing new criminal offences, and additional filing requirements and requiring new processes and controls to ensure compliance.
Mitigations
Established compliance and independence management systems, including:
- Clear policies, procedures and guidance;
- Regular updating of the firm’s processes and procedures to facilitate compliance by all our people, on all our clients, with all applicable regulations;
- Mandatory annual training for all partners and staff;
- Client and engagement acceptance procedures;
- Annual independence and compliance submissions for all partners and staff enforced by penalties for non-compliance;
- Ongoing consultation and proactive dialogue with relevant stakeholders given the changing landscape around regulation; and,
- Regular monitoring and reporting to the Executive Risk Committee and Executive Board.
Operational
Operating the technology environment
Failure to create and maintain resilient IT infrastructure and applications across the technology ecosystem, including third parties and the Global Network, to support the running of the business now and in the future.
{{risk-down}} 2024 trend
{{risk-neutral}} 2023 trend
{{risk-neutral}} 2022 trend
Risk landscape
- Complexity of the technology environment is increasing, and will continue to increase at pace, with greater variety and scale of demand for digital assets accelerating our need to work in different ways.
- Importance of preparing for the IT infrastructure of the future which will aid our ability to serve clients in rapidly changing markets.
- Increasing reliance on provision of key technologies for core services from other territories within the PwC Network, from PwC Global or third parties.
- Increase in client expectations around the development and use of our own technology solutions to deliver services, as opposed to using their technology solutions.
- Inadequate business continuity management plans may result in challenges responding to failure of business critical IT applications.
Mitigations
- Recovery of critical systems is secured by the use of two geographically distant data centres. If required, failed systems are reinstated at the second data centre, in line with Business Impact Analysis priorities.
- Continuing programme of testing provides assurance of our ability to rebuild systems from backups.
- Regular Business Impact Analysis identifies priority applications and recovery order in case of a major outage.
- Regular reviews of third parties including leadership visits, reviews of offshore facilities, risk assessments for outsourcing and review of IT suppliers.
- Technology Risk Board in place to approve use of new technology.
- Active participation in Global governance bodies.
- Business Continuity Management Team’s competency framework and BCMS certified to ISO 22031.
- Invested in and implemented new business continuity software to be used in conducting Business Impact Analysis to support analysis of technology dependencies.
Operational
People (current)
Failure to attract, develop and retain the talent required to deliver against our current people and client needs, including:
- Failure to create and maintain a diverse and inclusive culture;
- Failure to support an agile workforce with the flexibility to support changing client needs;
- Failure to promote and support employee wellbeing; and
- Failure to ensure compliance with professional requirements, firm procedures and to police unacceptable behaviour.
{{risk-neutral}} 2024 trend
{{risk-down}} 2023 trend
{{risk-up}} 2022 trend
Risk landscape
- Evolving expectations of our multigenerational workforce, in particular at the most junior grades, and the increasing use of offshore / delivery models is changing what people expect from the firm as an employer, and what we need our people to do.
- Importance of a diverse workforce and the risk of not achieving targets set such as a narrowing of pay gaps.
- Evolving skills needed to deliver services to clients including the increasing need for technologists and the challenge in attracting and retaining them in professional services.
- Changes implemented by the Home Office on minimum salary requirements for work visas will impact our diversity and location strategies and future workforce approach
Mitigations
- Regular reviews of the market for student and experienced talent to benchmark the firm’s relative competitive position and ensure agile management of resources.
- Use of various communication and discussion channels to engage with our people.
- Continued practical focus on building people engagement and supporting retention.
- Monitoring and review of key performance indicators by the Executive Board, including staff surveys, external data and regular client feedback.
- Regular review of the Learning and Development curriculum to ensure it supports the development of the skills and behaviours required for our people to deliver their roles which align to our culture and strategy.
- Diversity targets and action plans in place.
- Equal pay audit completed annually
Operational
People (future)
Failure to adapt people strategies today to be ready for changes in employee expectations and business models in the future, including:
- Failure to offer a sufficiently appealing proposition to future talent which restricts our ability to attract and retain the right talent;
- Failure to develop the skills and leaders needed for the future business;
- Failure to adapt to changing technology and business processes;
- Failure to maintain the firm culture in a changing business environment; and,
- Failure to implement the strategic workforce planning required to anticipate and adapt to changing people and client needs.
{{risk-neutral}} 2024 trend
{{risk-neutral}} 2023 trend
New risk in FY22
Risk landscape
- The acceleration of the pace at which new disruptions with profound people impacts come (e.g. technology, including AI and evolving delivery models make it increasingly difficult to define trends and anticipate how the future people model will look.
- Expectation that future workforce will need different skills from existing workforce, presenting challenges around recruitment, reskilling and upskilling our people.
- Changing needs of clients and the importance of our people continually developing skills (e.g. technology and data analytics) to provide high quality services to clients.
- Evolving expectations of employees potentially negatively impacting the attractiveness of the firm and professional services to highly talented individuals.
- Societal shift away from traditional career paths is being seen.
- Higher levels of experienced recruitment creates potential challenges regarding sustaining our culture and creates potential challenges around our ability to support junior talent in early stages of career development.
Mitigations
- People Council, representing a group of diverse backgrounds and roles within the firm, in place to obtain feedback to understand the future needs of our people.
- People strategies are regularly reviewed and updated to ensure they are relevant.
- Diversity and inclusion targets and action plans in place.
- Ongoing reviews of reward and incentives to ensure that they are relevant to the new world of work.
- Strategic workforce planning activities performed across the business to plan for the future workforce model.
- Identification of new technologies to enable the transition to a skills focused workforce
Operational
Financial performance
Failure to adequately plan for and appropriately respond to the broad financial effects of internal or external forces impacting the business, including macroeconomic developments, changing market conditions and evolving delivery models, resulting in a failure to optimise the business’ growth and profitability, appropriately manage its working capital needs and/or withstand a crisis.
{{risk-up}} 2024 trend
{{risk-neutral}} 2023 trend
New risk in FY22
Risk landscape
- Uncertainty arising from the geopolitical and macroeconomic environment remains relatively heightened. Mitigating controls currently in place remain appropriate and proportionate although we continue to monitor this closely.
- Expectation of the continuation of a variable trading environment requiring continual monitoring of mitigating controls.
- Highly competitive business environment requires careful assessment and investment opportunities to ensure successful execution of our investment growth strategies.
Mitigations
- Comprehensive budgeting and planning processes that look forward 3 years across multiple scenarios, covering growth, profitability, resourcing and working capital perspectives.
- In times of heightened economic uncertainty, more detailed scenario planning is performed to support timely decision making.
- Regular monitoring of the business through the Executive Board, Client & Markets Executive, Regions and Industries, COO, People Partner and Risk forums. Use of forward looking sales, financial and resource deployment forecasts and assessments.
- Investment and Client Committees ensuring that only the best opportunities receive funding and that high risk engagements are carefully assessed prior to acceptance.
- A Treasury Committee sets and regularly monitors the firm’s funding position, foreign currency exposures and cash flows.
- Appropriate levels of banking facilities and below the line reserves are maintained, providing additional resilience.
- Ongoing focus on working capital management with clear targets and daily monitoring to ensure optimisation.
Operational
Climate and environment (internal)
Failure to appropriately mitigate and respond to the impacts of climate change and degradations to the environment on our operations and the UK firm, including preparing for its implications and:
- failure to transition our own business (including SDCs) to adapt to the impacts of climate change and environmental degradation;
- failure to meet our climate and environmental commitments; and
- failure to comply with regulatory disclosure and other regulatory requirements.
{{risk-up}} 2024 trend
New risk in FY23
Risk landscape
- Increasing scrutiny from a multitude of internal and external stakeholders on transitioning our business to Net Zero combined with updates to the UK Government’s base estimates for carbon emissions on air travel creating challenges regarding meeting emissions targets in the near-term..
- Increasing focus on climate risks arising from our SDCs, especially physical risks.
- Increasing scientific consensus that climate change (and causes of this) may increase likelihood of further pandemics, with the potential to cause further climate-related challenges to our business.
Mitigations
- Science-based commitment to reach Net Zero by 2030.
- Voluntary annual Task Force Climate-related Financial Disclosures (TCFD) for the past five years.
- ‘Going Circular’ programme to reduce material, water and carbon impacts.
- Net Zero Committee in place to consolidate the focus and investment around our Net Zero commitments.
- Supply Chain Sustainability programme designed to drive down carbon emissions, with all UK offices now powered by 100% renewable electricity since last year.
- Service partners required to commit to SBT as part of the selection process to support supply chain commitments.
- Dedicated role of National Energy Manager supporting Corporate Sustainability reporting.
- Energy management system certified to ISO 50001 and Environmental management system certified to ISO 14001.
Operational
Network risk
Risks associated with the PwC Network including:
- Failure to capitalise on the opportunities originating from the Network operating model.
- Actions of other Network firms which could result in reputational risks, overseas litigation and/or regulatory action.
{{risk-up}} 2024 trend
New risk in FY23
Risk landscape
- Potential contagion effect from other PwC Network firm’s actions becoming more prevalent.
- Potential of overseas litigation affecting the network and UK firm.
- Increasing number of engagements which involve multiple territories and Shared Delivery Centres.
- Increasing focus on global technology solutions to be used.
Mitigations
- Close relationships and regular interactions with key Global and Network stakeholders.
- The UK continues to lead and support across the PwC Network, at individual territory, EMEA and Network levels, providing engagement and support as required.
- Management board members represent UK firm interests on committees and global forums.
- Annual network standard monitoring performed by PwC Global to ensure alignment to network standards.
- LoS specific reviews take place at network level to ensure that the UK and other firms are meeting their obligations as a network firm.
- The UK firm has an established xLoS team to manage its EMEA delivery ecosystem.
Strategic
AI
Failure to develop, execute and continually evolve consistent strategies to capitalise on the opportunity of AI, whilst ensuring appropriate conduct, ethics and compliance in respect of data and AI usage, during a transitional period as AI disrupts the business environment, potentially resulting in:
- Failure to capitalise on our market-leading position; and,
- Failure to keep pace with competitors and / or client needs.
New risk in FY24
Risk landscape
- AI presents new opportunities and challenges and as a firm we need to understand how to maximise on the opportunities whilst minimising the risks associated with adoption and transformation of these tools.
- Need to ensure we keep pace with competitors and the market and maintain market presence for new services in this space.
- Need to understand what is required ethically and behaviourally and will need to ensure appropriate guardrails are in place for evolving use cases.
- Work closely with third parties to provide solutions, architecture or environments to take to clients adds to existing risk exposures such as quality management and brand / reputational risks.
- Preparing and commercialising our data will require upfront investment and x-network strategic alignment.
- AI is expected to significantly reshape our current and future people models, requiring adjustments to existing strategies to combat risks of skills shortages, change fatigue, and shifts in resource deployment methodologies.
Mitigations
- AI Technical and Go to market leads.
- Project teams setup to model impacts of AI, internally and externally.
- Investments made in critical technologies and partnerships.
- Establishing and implementing Business rules on usage of AI tools.
- Ongoing development of ethical use cases.
- Technology Review Board process to review use cases.
Contact us
