What is Concentration Risk?
Concentration risk in third-party and operational risk management is the exposure created when an organization depends on a single provider, a small group of related providers or one location to such a degree that their unavailability, failure or shortfall could endanger the delivery of critical or important functions or cause large losses. DORA defines it for ICT providers.
- Concentration risk is the exposure created when critical functions depend on one provider, a group of related providers, one fourth party or one location.
- DORA Article 3(29) defines ICT concentration risk and Article 29 requires financial entities to assess it before contracting; US interagency guidance reaches the same point through due diligence.
- It takes five forms: single provider, related providers, fourth-party, geographic and internal.
- It only becomes visible when third-party data is joined to business services: map each critical function to its providers and sub-providers, then read the map the other way.
- Mitigate with multi-vendor or multi-region designs, data portability rights, tested exit strategies and impact tolerances, and record any accepted concentration with its rationale.
What is Concentration Risk?
Concentration risk is the exposure created when an organization depends so heavily on one third party, a group of related providers or one location that their failure could endanger critical functions or cause large losses.
The EU Digital Operational Resilience Act gives the formal definition for technology providers. DORA Article 3(29) defines ICT concentration risk as an exposure to individual or multiple related critical ICT third-party service providers creating a degree of dependency such that the unavailability, failure or other shortfall of the provider may endanger the ability of a financial entity to deliver critical or important functions, cause other adverse effects including large losses, or endanger the financial stability of the Union. Article 29 requires financial entities to assess it before contracting. The US Interagency Guidance on Third-Party Relationships reaches the same idea through due diligence, asking whether additional risk is presented by dependency on a single provider for multiple activities.
Why it matters
- It converts a vendor problem into an enterprise problem. One outage can stop several critical services at once when they share a provider.
- Regulators now ask for it explicitly. DORA, the Basel operational resilience principles and the UK operational resilience rules all expect firms to know and manage their concentrations.
- It hides in fourth parties. Many vendors run on the same few cloud platforms, so contract-level diversity can conceal concentration one layer down.
Forms of concentration
- Single provider: one vendor supports several critical or important functions.
- Related providers: several vendors belong to one group or share ownership.
- Fourth-party: different vendors depend on the same subcontractor, hosting platform or data center.
- Geographic: providers or their operations sit in one country or region exposed to the same events.
- Internal: one team, one site or one system on which many processes depend.
How to identify it
Concentration only becomes visible when third-party data is joined to business services. Map each critical or important function to the providers and sub-providers that support it, then look at the picture the other way: which providers appear against many functions, and which sub-providers appear behind many providers. DORA's register of information is built for exactly this view. Substitutability is the second question: how quickly, and at what cost, could the service move elsewhere?
Mitigation
Options include multi-vendor or multi-region designs for the most critical services, contractual rights to data portability and assistance on exit, tested exit strategies, and impact tolerances that state how long the organization can survive without the service. Where a concentration is accepted, record the decision, its rationale and its compensating measures, and revisit them on a schedule.
Related terms
- Third-party risk
- Third-party risk management (TPRM)
- Operational resilience
- Supply chain risk management
- Important business services
- Business continuity management (BCM)
In SmartSuite
SmartSuite Third-Party Risk Management can link each vendor and subcontractor to the business services and systems it supports, so concentration views by provider, provider group, fourth party and country come from the relationship data rather than from a separate spreadsheet.
Frequently asked questions
Is concentration risk only a financial services concern?
No. The formal definitions come from financial regulation, but any organization that runs critical processes on a single cloud platform, payroll provider or logistics partner carries the same exposure. Financial firms are simply required to assess it; others manage it because a single point of failure is a resilience problem regardless of sector.
How does DORA expect firms to handle ICT concentration risk?
Article 29 requires financial entities to assess, before contracting for ICT services supporting critical or important functions, whether the arrangement creates concentration, whether the provider is substitutable, and whether there are alternatives. The assessment feeds the register of information, exit strategies and the decision to proceed, and it is revisited when arrangements change.
What is the difference between concentration risk and fourth-party risk?
Fourth-party risk is the exposure from your vendors' own suppliers. Concentration risk is about dependency, whether on one direct vendor, one fourth party or one location. The two overlap when several of your vendors rely on the same subcontractor, which is a fourth-party concentration and usually the hardest kind to see.
Get started with SmartSuite
See how connected GRC, IT and operations work on one platform.