How KPMG uses GitHub

Play video: Productizing security powers teams to manage risk at scale

Location: Amstelveen, Netherlands
Industry: Professional Services
Number of Seats: 5,200+

Overview

As one of the "Big Four" accounting organizations, KPMG spans 145 countries with more than 235,000 employees. Beyond audit and accounting, KPMG helps clients solve complex business problems, increasingly driving digital transformations and developing custom software. The company has transformed into a multidisciplinary services company with a large technical and engineering workforce.

KPMG recently faced a significant challenge: its tech stack was as varied as its tax codes. To address this, the company launched KPMG Code, an initiative to unite its developers on a single engineering platform. GitHub became the centerpiece of this effort, standardizing DevOps pipelines across member firms and breaking down barriers to communication and collaboration across teams.

"We wanted to empower developers to use the tools they prefer, while also creating a common language across all teams," says Tim Denley, Partner, KPMG Solutions. "By standardizing on GitHub our developers can work the way they want to while still making it easy to share and discover each other's code."

Consolidating Tools and Reducing Complexity

With GitHub, KPMG consolidated many tools under a unified platform. "In the past, we had to manage many different CI/CD systems ourselves," says Keith Annette, Cloud Capability Lead at KPMG's UK location. "Now GitHub does that heavy lifting, and we leverage GitHub APIs to create products that enable our developers to build faster, smarter, and safer. Developers have fewer tools to juggle, which reduces their cognitive load and lets them focus on innovating."

Code Reuse Across Teams and Continents

KPMG made it possible for teams to reuse code across teams and continents, primarily by sharing smaller components between projects. "Each consulting engagement is different. What we build in Australia for a financial services client won't exactly match what we build for a client in Portugal," explains Sarah Vega, National Managing Partner at KPMG Futures. "What GitHub enables us to do is create a 'parts warehouse' where developers can find useful code that can be quickly assembled into new solutions."

This innersource methodology—whereby teams within a company treat internal code collaboratively as they would open source—is especially valuable for member firms with smaller engineering teams. "It helps developers recognize that they're part of a larger team," Vega says. "The work they do can help their fellow developers in other countries, and they can turn to people around the world for help with their own problems."

Automation and Developer Experience

Since moving to GitHub, automation plays a larger role in KPMG's workflows. The company uses GitHub Actions to deploy its .NET and React applications, automating what would otherwise be a manual build step. "GitHub Actions has been incredibly powerful for us, because it reduces the time it takes for a developer to get up and running," says Annette. Because GitHub has fostered a culture of code reuse within KPMG, teams now share custom-built Actions, creating new efficiencies.

To further simplify the developer experience, KPMG leverages GitHub Codespaces, which allows developers to code within their browser and integrates seamlessly with Visual Studio Code. Codespaces provides ready-to-use development environments, which is invaluable for getting new hires productive right away. Instead of spending hours or days installing and configuring dependencies, a developer can simply spin up a Codespace instance and begin coding in moments. "Codespaces is a great enabler at a large enterprise with many different requirements because it lets developers skip the tedious, error-prone stuff that normally stands between them and actually getting started on real work," says Annette.

GitHub also makes developers happier. "Developers increasingly expect organizations to have a tool like GitHub," Vega says. "Meeting and exceeding engineering teams' expectations helps us retain top talent."

Security and Compliance at Scale

As KPMG broke down silos to improve collaboration, security became more important than ever. For developers to effectively collaborate, they need easy access to code repositories, but the distributed nature of KPMG's member firms, alongside stringent industry compliance requirements, presented a challenge. Risk management had proven historically cumbersome, because each subsidiary used different technologies. Security auditing was performed by various departments, leading to a lengthy and time-consuming process. KPMG needed a security platform that would safeguard customer trust while providing an easy-to-use development environment.

GitHub Advanced Security was critical to addressing KPMG's varied needs. "GitHub Advanced Security and GitHub Actions enable us to run standardized scans across repositories throughout the KPMG enterprise," says Leo Stolyarov, Engineering Director at KPMG UK. "It gives us the best chance to stay as secure as possible when writing software."

KPMG built custom automations with GitHub Actions to check projects for compliance with the company's security policies, making it easier and safer to share code internally. The company uses Dependabot, CodeQL, and Secret Scanning with Push Protection to ensure that repositories are secure. GitHub Advanced Security automatically ensures that KPMG's developers don't unknowingly commit credentials to a code base. With a wealth of pre-written CodeQL queries available, it was easy to get started out of the box.

Vision for Global Collaboration

Using GitHub as a beacon to unite its developers, KPMG has redefined how its global developer teams collaborate to deliver better and more secure solutions to end-clients.

"From the beginning, our vision was that anyone in their organization should be free to view code, comment on it, learn new skills by examining it, and submit changes that they think will either improve it or customize it to their needs," explains Stolyarov. "This vision was only able to come to life through GitHub."