Vendor concentration is often reported as spend by supplier. Spend is useful for commercial exposure, but it can miss the provider that processes little revenue while supporting every customer identity check, payment interface or critical data feed.
Practical situation: A low-spend specialist vendor supports a component embedded in six critical services across four countries. Because each contract is small and held locally, the supplier does not appear in the group’s top-20 vendor report. Its outage produces an enterprise-wide disruption.
Concentration should be measured through service dependency, substitutability, data, technology, geography and time to impact—not one financial metric. Thresholds should lead to a decision: diversify, strengthen resilience, accept exposure or reduce dependency.
Why this belongs on the ERM agenda now#
Local procurement can create group concentration#
Separate entities may independently select the same provider or ecosystem without recognising the aggregate dependency. The practical consequence is easy to miss. A useful response converts the concern into observable signals, named decisions and time-bound actions rather than adding another narrative risk to the register.
Criticality is not proportional to spend#
Small contracts can support high-impact functions, while large suppliers may be easier to substitute. This changes the risk conversation in a very concrete way. Management should be able to see what would trigger escalation, who can act and how quickly the organisation can change course.
Concentration can be indirect#
Several providers may share the same cloud region, software component, data source or subcontractor. For risk teams, the implication is operational rather than theoretical. The test is whether the issue changes a real decision on resources, controls, suppliers, customers or strategy.
What good looks like#
Effective vendor concentration risk combines consistency with room for informed local judgement. Owners know the boundaries, exceptions are visible and a material change reaches management with enough time to respond. The process should concentrate effort where failure would matter most rather than adding the same paperwork everywhere. Start with this observable outcome: Concentration is analysed by service, entity, provider, region, technology and fourth party.
Five characteristics distinguish that outcome from a documentation exercise:
-
Concentration is analysed by service, entity, provider, region, technology and fourth party.
-
Metrics include substitutability and time to impact, not only spend.
-
Thresholds are linked to risk appetite and clear management actions.
-
New procurement and change decisions consider existing enterprise concentration.
-
Board reporting shows accepted exposure, resilience and exit progress.
A practical vendor-concentration model#
1. Create a group provider master#
Treat this as an operating requirement, not a documentation exercise. Resolve duplicate names, affiliates and local aliases so contracts and services can be aggregated. Link each provider to its parent and material subcontractors where known.
The control record should show stable provider ID, legal name, aliases, parent, entities, arrangements, fourth parties and data-quality owner. Recording those elements shows how the Create a group provider master step supports the wider approach to vendor concentration risk and gives the next reviewer a usable starting point.
2. Map providers to critical services#
The strongest programmes begin with a narrow, testable definition. Record which services and outcomes depend on each arrangement and how quickly failure would cause harm. Include internal alternatives and manual workarounds.
The decision file should retain service, dependency level, time to impact, tolerance, substitute, recovery and accountable owner. That evidence keeps the judgement on vendor concentration risk traceable when ownership, assumptions or operating conditions change.
3. Measure multiple concentration dimensions#
This is where ownership becomes visible. Use service count, critical-service share, spend, data volume, geographic clustering, technology dependency, fourth-party overlap and specialist skills. Avoid one composite score that hides the driver.
Minimum evidence should include metric definition, denominator, source, update frequency, threshold and limitation. The result should be reusable in monitoring and reporting, not a one-off document that disappears after the Measure multiple concentration dimensions step is complete.
4. Set appetite and escalation thresholds#
Design the step around the exception that management would need to understand quickly. Define when concentration requires challenge, diversification, resilience testing, contract improvement or formal acceptance. Thresholds may differ by criticality and substitutability.
A reviewer should be able to find appetite statement, early warning, tolerance, decision right, response and acceptance expiry. This allows challenge to focus on the quality of the decision rather than on reconstructing the history of vendor concentration risk.
5. Assess new and changed arrangements#
Start by making the decision explicit. Before approval, show how the decision changes group concentration. A locally attractive supplier may create an unacceptable enterprise dependency.
The practical output is pre-contract concentration impact, alternatives considered, architecture or procurement challenge and approval rationale. Clear evidence also makes it easier to distinguish a genuine change in vendor concentration risk from a change in wording or presentation.
6. Report decisions, not rankings#
Keep this step deliberately simple. Board reporting should explain the most material concentrations, service impact, resilience, exit timing, trend and management decision. A league table alone does not show whether exposure is controlled.
Do not close the step without top concentrations, tolerance status, scenario result, action, funding, accepted residual risk and next review. The record should enable another qualified person to understand the decision, test it and continue the work without relying on personal memory.
Ownership and decision rights#
Effective governance of vendor concentration risk requires more than a name in the risk register. The operating chain should connect the business decision, the controls and data used to support it, independent challenge and the forum that can accept or change the exposure. Five responsibilities deserve explicit treatment.
- Executive sponsor: owns the outcome and approves trade-offs that exceed a function’s authority. The sponsor should understand how vendor concentration risk affects the wider Third-Party and Supply Chain Risk agenda and what delay would mean for customers, services, strategy or legal entities.
- First-line owner: runs the activity that creates or manages the exposure. This person should lead the work to create a group provider master, keep the conclusion current and translate it into operating choices.
- Control and data owners: operate the controls and produce the evidence behind measures such as Share of critical services dependent on top providers. For vendor concentration risk, they should explain lineage, exceptions, manual intervention and the response when a control or feed fails.
- Second-line challenge: tests scope, assumptions, rating, appetite interpretation and proposed action. It should challenge the risk of using spend as the primary measure, document disagreement and confirm when higher authority is required.
- Assurance and governance forums: assess whether the process works in practice and whether material conclusions reach the right committee. They should test whether the organisation can report decisions, not rankings, whether open weaknesses are visible and whether prior decisions produced the expected result.
For vendor concentration risk, a responsibility matrix is only the beginning. The workflow should preserve who submitted, reviewed, challenged, approved, changed and closed each material record, together with the date and rationale. That history protects continuity when teams, suppliers or legal-entity leadership change.
A realistic maturity path#
Organisations can improve vendor concentration risk without a multi-year redesign. The sequence below creates usable control at each stage while preserving a route to more advanced analysis.
Level 1: establish visibility#
Create one scope, one owner model and one minimum record for vendor concentration risk. Retire duplicate trackers, agree the definitions and begin with Share of critical services dependent on top providers. The test is whether management can find the current exposure and decision without a manual reconciliation exercise.
Level 2: connect decisions and controls#
Once visibility is reliable, link vendor concentration risk to the controls and events that can change it. Add independent review and report Providers above tolerance without approved action alongside Estimated substitution time versus impact tolerance so ownership includes outcome, not merely submission.
Level 3: anticipate and optimise#
At the advanced level, use vendor concentration risk information to anticipate pressure and test management options. Provider master with aliases, parents, arrangements and fourth-party links should support earlier intervention, with transparent assumptions and an audit trail for any automated recommendation.
A mature approach to vendor concentration risk is repeatable under pressure and understandable to someone who did not design the process.
Measures that are useful in management meetings#
Measures for vendor concentration risk should reveal a change that may require a decision. Start with Share of critical services dependent on top providers, then interpret it alongside exposure, age, severity, concentration, trend or service impact. A denominator is essential; without it, a rise in volume may be mistaken for deterioration—or genuine deterioration may be hidden by growth.
-
Share of critical services dependent on top providers: Shows enterprise service concentration.
-
Providers above tolerance without approved action: Identifies governance gaps.
-
Estimated substitution time versus impact tolerance: Tests resilience.
-
Shared fourth-party or cloud dependencies: Reveals indirect concentration.
-
New arrangements increasing high concentration: Measures decision discipline.
-
Concentration remediation delivered on time: Tracks reduction or control of exposure.
Common failure modes#
-
Using spend as the primary measure: Commercial size does not equal operational impact.
-
Creating one opaque concentration score: Management cannot see the driver or choose the response.
-
Ignoring local aliases and affiliates: Group exposure is understated.
-
Setting thresholds without actions: Red status becomes reporting noise.
-
Assuming diversification always reduces risk: Additional vendors may increase complexity or share the same dependency.
A 90-day implementation plan#
Days 1–30: establish the facts#
Build a clean provider master and map the top critical services to direct and known indirect providers. Calculate basic service, entity, region and spend concentration, and identify missing substitutability data.
Days 31–60: test the operating model#
Agree concentration dimensions and pilot thresholds for five material dependencies. Run one provider-failure scenario and estimate substitution time, customer impact and interim workarounds. Create options and cost ranges.
Days 61–90: embed the management rhythm#
Approve appetite, procurement challenge and Board reporting. Assign remediation or acceptance for exposures above tolerance and schedule periodic data refresh and scenario testing.
How technology should support the process#
For vendor concentration risk, the platform’s job is to preserve the decision chain: source facts, assessment, challenge, approval, action and later review. Automation is valuable where it removes repetitive collection or alerts an owner, but the rationale must remain inspectable. A practical foundation is Provider master with aliases, parents, arrangements and fourth-party links. Additional capabilities include:
-
Provider master with aliases, parents, arrangements and fourth-party links.
-
Critical-service and entity dependency mapping.
-
Configurable concentration metrics, thresholds and trend dashboards.
-
Pre-contract and material-change concentration assessments.
-
Actions, scenarios, exit plans and risk acceptance linked to each concentration.
For vendor concentration risk, the closest Vilfora product workspace is /regquanta/third-party-risk/concentration-risk. A useful implementation should connect that workspace to the relevant risks, controls, obligations, incidents, actions and reports rather than treating it as an isolated register.
Global implementation lens#
International implementation of vendor concentration risk should distinguish the enterprise minimum from the local overlay. The group can standardise service criticality and ownership, while legal entities document the jurisdiction, language, market structure and delegated authority that change how the control operates.
For this topic, common records should support concentration and subcontracting without forcing local teams to hide legitimate differences. The global view should report Share of critical services dependent on top providers consistently, preserve the source evidence and show where data or terminology cannot be aggregated safely.
Local governance should then specify who will create a group provider master, which forum owns exceptions and how issues involving monitoring and exit readiness are escalated. This produces comparable governance across countries without turning the global framework into identical paperwork everywhere.
Questions senior management should ask#
-
Which provider failure would affect the most critical services within the shortest time?
-
Where is concentration high despite low supplier spend?
-
Which alternatives share the same infrastructure or subcontractor?
-
What decisions are required for exposures above tolerance?
-
Are local procurement teams shown group concentration before approval?
Frequently asked questions#
How should vendor concentration risk be measured?#
Use several dimensions: critical-service dependency, entity count, spend, data, geography, technology, substitutability, time to impact and indirect dependency. Avoid relying on one metric.
What is a good concentration threshold?#
It depends on service criticality, impact tolerance and alternatives. A threshold should identify a point at which management must diversify, strengthen resilience or formally accept exposure.
Is a single strategic provider always too risky?#
Not necessarily. A concentrated provider can be acceptable where resilience, control, contractual rights, monitoring and exit planning are strong and the residual exposure is understood and approved.
What should the Board see?#
The Board should see material concentrations, affected services, trend, tolerance status, tested resilience, substitution time, actions, funding and any accepted residual risk.
Final takeaway#
Concentration reporting becomes useful when it shows how dependency can harm critical services and what management has decided to do about it. The value of ERM is visible when management can move from a weak signal to a defensible action without first reconciling several versions of the truth. The organisation’s approach to vendor concentration risk should meet that test.
Vilfora ERM connects the records used for vendor concentration risk—risks, controls, indicators, evidence, incidents, remediation and reporting—within a governed workflow. Use this article as a checklist when assessing whether /regquanta/third-party-risk/concentration-risk and the surrounding process can support timely decisions across entities and jurisdictions.
