Ask a board where its concentration risk sits and you will usually be shown a customer table. One client at nineteen per cent of revenue, another at eleven, a comfortable tail beneath. The conclusion drawn is that the business is diversified.
The conclusion is often wrong, because concentration is not a property of the customer list. It is a property of the dependencies underneath it, and those are not tabulated anywhere.
Four places it hides The first is the supplier behind the suppliers. Three vendors, one upstream component. Four logistics partners, one port. The register shows four relationships; the business has one point of failure.
The second is the lender. A facility that has been rolled without incident for years stops being a financing arrangement and becomes an assumption. It is worth knowing, in writing, what happens if it is not rolled — and knowing it before the conversation rather than during it.
The third is the channel. Revenue arriving through a single platform, distributor or intermediary is revenue held at someone else's discretion, however many end customers sit behind it.
The fourth is the person. One individual holds the key relationship, the undocumented process, or the regulatory permission. This is the concentration boards are least willing to name, because naming it is awkward, and it is the one that most often triggers everything else.
A risk that is spread across four relationships and one dependency is not spread.
The exercise Map revenue to single points of failure rather than to customers. For each material revenue line, ask what one supplier, one system, one counterparty or one person, if removed tomorrow, would interrupt it. Then ask how long the interruption would last and what it would cost.
The output is usually shorter than expected and rarely matches the risk register. Two or three dependencies typically account for most of what could go materially wrong, and at least one of them is generally something the board had never discussed.
What to do with it Not necessarily to remove it. Concentration is often the correct commercial choice — it buys price, service and attention that a diversified position does not. The failure is not concentration. The failure is unpriced concentration.
Three responses are usually available:
Price it. If a dependency is deliberate, hold a reserve, a facility or an inventory buffer against it, and say so in the accounts rather than in the corridor. Shorten it. A documented process, a second qualified supplier held warm, a named deputy — none of these remove the dependency, but all of them shorten the interruption. Contract for it. Notice periods, step-in rights and transition assistance cost very little to negotiate at signing and are unobtainable at the point of failure. The governance point Concentration risk is a board matter rather than an operational one, because the decision it forces is about appetite, not about process. Management can manage a dependency. Only the board can decide how much of one the business is willing to own.
The useful discipline is to review the dependency map on a fixed calendar, in the same meeting every year, whether or not anything has changed. The years in which nothing has changed are the point.
This note describes an approach to risk assessment. It is not legal, insurance, investment or tax advice, and any specific arrangement should be reviewed with qualified counsel.