What is Concentration Risk?

Credit & financial risk
Third-party exposure
3 min read

The short answer

Concentration risk arises when exposures are overly dependent on a shared party, group, geography or other factor.

Concentration Risk: why it matters

A risk decision depends on the relationship, exposure and the age and scope of available information. This concept supplies one part of that assessment, not a universal approval rule.

How to assess it in practice

Resolve group relationships before counting apparently separate counterparties as independent exposure. Start by defining the question the team needs to answer. Identify the relevant record or evidence, check its scope and date, and retain the reasoning behind the result. If evidence conflicts, keep that conflict visible for review.

Worked example

Illustrative workflow: a team reviewing a business adds a separate check for concentration risk. The reviewer’s task is to resolve group relationships before counting apparently separate counterparties as independent exposure. The outcome is recorded together with the supporting evidence; an unresolved question stays open rather than being converted into a positive result.

Illustrative scenario

Five approved suppliers belong to the same parent group. A parent-level disruption may affect all five, so record the shared dependency rather than counting five independent sources.

Distinctions that matter

Concentration Risk belongs to the third-party exposure topic family. Read Third-Party Risk alongside it to understand the adjacent question. Each page has its own intended scope; shared context does not make the concepts equivalent.

Evidence and review output

Review these

Relationship and critical service
Legal and financial exposure
Shared dependencies and locations

The review should produce

A relationship-specific risk assessment with prioritised controls and an accountable review owner.

Across this family

Risk arises from the relationship and the harm a failure could cause. Combine legal identity with service criticality, financial exposure and relevant dependencies. A supplier's low spend or familiar incorporation country can hide a substantial operational or geographic concentration.

A note from practice

Concentration depends on common drivers, not just the number of vendor records. Aggregate related entities, critical locations or shared inputs where those create correlated exposure.

Limits and common mistakes

The practical boundary is important: Resolve group relationships before counting apparently separate counterparties as independent exposure. Do not substitute a related label for this check or assume that missing information is a negative finding. Source-specific and jurisdiction-specific rules require their own review.

Frequently asked questions

Which evidence should I review?

For this topic, focus on relationship and critical service, legal and financial exposure, shared dependencies and locations. The relevant source and dates should be retained with the finding.

How is Concentration Risk different from Third-Party Risk?

Third-party risk is the exposure created by a relationship with an external organisation or person. The distinction matters because the evidence needed for that concept may not resolve the question addressed on this page.

What should the result of the review contain?

A relationship-specific risk assessment with prioritised controls and an accountable review owner. Preserve material conflicts instead of replacing them with an unexplained success flag.

Continue learning

Explore Third-party exposure

See the registry record behind every answer.

Primary, government-sourced data on 600M+ companies in 200+ countries, with full source attribution.

Book a demo Talk to us