Overview
KPMG is one of the Big Four professional services networks, formed in its current global structure in 1987 through the merger of Peat Marwick International and Klynveld Main Goerdeler. The network reported US$38.4 billion in aggregate revenue for FY2024 across approximately 273,000 employees in 143 countries, operated as KPMG International Limited with member firms in each major market. Bill Thomas serves as Global Chairman and CEO. Cyber and identity work sits within the Advisory practice and is anchored by KPMG US, KPMG UK, KPMG Germany, KPMG Australia, and KPMG India.
Within identity and security consulting, KPMG runs a mature Big Four practice with particular strength in identity governance, segregation-of-duties (SoD) analytics, and audit-grade access controls testing. The firm holds top-tier partner status with SailPoint, SAP, Microsoft, Okta, Saviynt, and CyberArk, and operates a proprietary IGA accelerator built on SailPoint and SAP Identity Access Governance. Cyber and identity work is heavily concentrated in financial services, energy, public sector, and life sciences. KPMG also runs a meaningful incident response practice through KPMG Cyber Defence Services.
KPMG is typically a fit for regulated buyers running SAP-anchored landscapes or for organisations that need identity work paired with internal audit, SoD remediation, or controls modernisation. The firm is rarely the lowest priced option, and its cyber bench is the smallest of the Big Four in absolute terms. Smaller single-platform IGA deployments under US$1 million are usually better served by Optiv, SailPoint Professional Services, or a regional specialist.
Services Offered
- Identity strategy, IAM operating model, and roadmap
- SailPoint and Saviynt IGA implementation and migration
- SAP Identity Access Governance (IAG) and GRC Access Control
- CyberArk and BeyondTrust privileged access deployments
- Segregation-of-duties (SoD) analytics and remediation
- Zero-trust architecture and security operations advisory
- SOX, NIST CSF, ISO 27001, and DORA controls advisory
- Incident response, threat intelligence, and breach investigation
- Managed identity and access certification operations
- Privacy programme, GDPR, and data classification advisory
Typical Engagement
| Engagement Type | Model | Typical Range |
|---|---|---|
| IAM strategy and target state design | Fixed-fee project | $200K–$900K (6–12 weeks) |
| IGA or PAM implementation | Fixed-fee or T&M | $1.5M–$8M (8–16 months) |
| Enterprise identity transformation | Multi-year outcome contract | $8M–$35M+ (24–42 months) |
| Managed identity services | Monthly retainer | $60K–$700K per month |
| Staff augmentation (Certified IAM) | Hourly bill rate | $165–$315/hour blended |
Pricing ranges verified May 2026 from public procurement records, identity vendor channel benchmarks, and reference checks. KPMG Delivery Network centres in India, Hungary, and Poland lower blended rates by 20–35%.
Strengths
- Top-tier IGA bench with proprietary segregation-of-duties (SoD) analytics across SailPoint, Saviynt, and SAP IAG
- Deep SAP-anchored identity capability — preferred Big Four for SAP IAG and GRC Access Control
- Audit-aligned controls testing methodology for SOX, SOC2, ISO 27001, and DORA
- Strong delivery footprint in continental Europe, particularly Germany, Netherlands, and the Nordics
- KPMG Delivery Network centres in India, Hungary, and Poland deliver competitive blended rates
- Mature managed identity capability for SAP-heavy enterprises with cross-application access certifications
Limitations
- Smallest cyber bench among the Big Four in absolute terms, particularly outside Europe
- Audit-client independence rules restrict the addressable buyer base in the US for non-audit clients only
- Premium pricing — partner rates frequently exceed US$375/hour onshore
- Methodology-heavy delivery can slow product-led IGA work compared with specialist firms
- Recent US public-cloud licence-fee settlement and KPMG UK partnership restructuring have created episodic senior consultant turnover