Concentration Risk
Concentration risk is the risk that arises from over-reliance on a single vendor, supplier, service provider, or geographic region. When too much of a critical function depends on one party, the failure or disruption of that party creates disproportionate impact on the organization.
Concentration risk is a key concern in third-party risk management. It can take several forms: vendor concentration (too many services from one vendor), geographic concentration (too many vendors in one region or country), service concentration (one vendor provides a critical single point of failure), or sector concentration (over-reliance on vendors in one industry). Organizations should identify concentration points, assess the impact of disruption, and develop contingency plans — including alternative vendors, exit strategies, and business continuity arrangements.
Examples
- •An organization uses a single cloud provider for 80% of its infrastructure — if that provider experiences an outage, most operations are affected.
- •A bank relies on one credit rating agency for all ratings — if the agency faces regulatory action, the bank's rating process is disrupted.
- •A manufacturer sources 90% of a critical component from one supplier — if the supplier has financial difficulties, production may halt.