Where is your concentration risk hiding?

Concentration risk is a regular and high visibility agenda item in most financial services risk discussions; however, in many corporates it seems to be a hidden and not well understood risk. From a financial services perspective, concentration risk typically refers to the potential for losses that could arise from having a large portion of, for example; assets, liabilities, or revenues, concentrated in a particular area, sector, asset class, or counterparty. In a corporate context, concentration risk arises when a large portion of the business operations, revenues, or resources are dependent on a single customer, supplier, market, product, or geographic region.

Why should businesses outside financial services be worried about this?

Firstly, if the concentration risk crystallises, it can have a severe impact on the business from a revenue, cost and business interruption perspective. Secondly, concentration risk can hide in many corners of a business; customer, supplier, supplier region, supplier route, 3rd party logistics provider, pricing model, technology, people, financing… and the list goes on. Finally, there is often opacity around this risk. It is not unusual to be greeted with stunned silence in response to the question; what are your main concentration risks? Even if, after a bit of reflection, the answer becomes; “we don’t have any,” further probing frequently shows that the answer is not necessarily based on data or analysis.

In a world where focus has historically been on delivering the lowest cost or most efficient solutions with less emphasis on the risk involved in achieving either of these, the concentration risk has often been overlooked or ignored. The concentration risk is therefore frequently a consequence of the strategic and operational choices that have been made over a period of time and reflects the evaluation criteria, performance metrics and incentive structures that have been put in place. Hence, the concentration risk can have accumulated gradually and silently over a period of time. It is therefore unsurprising that it often takes significant effort to identify clearly the true nature, significance and origin of this risk. In addition, this risk also represents another example of a possible single point of failure.

For example, some companies will perceive that they have a low exposure to a particular sourcing region because their direct sourcing from this region is relatively small. However, if their suppliers predominantly source from this region to obtain competitive prices, the real concentration risk might be significantly higher. Equally, if a customer or a sector account for a large proportion of the sales and profit generated, then there is likely to be a concentration risk that merits investigation, monitoring and reporting. However, this does not automatically mean that the position should be reversed if the returns generated justify the risk which is being assumed, and that contingency plans such as, for example, standby agreements have been put in place and tested. In order to determine whether the benefits outweigh the risk, one also has to consider the risk appetite for concentration risk whether it has been explicitly defined or not.

In recent times, concentration risk has also surfaced in the context of geopolitics, meaning that organisations need to pay more attention to such hotspots in relation to the footprint of their business activities. Geopolitics is also an example of an area where there might be important interdependencies such as domestic political situation, economic outlook including inflation, local demand and export orientation that contribute to the concentration risk. Examples of concentration risk in relation to geopolitical hotspots can include having concentration of activity that is dependent on for example, how the relationship between China-Taiwan-US and the situation in the Middle East evolve. Another recent example is the dependency on specific supply routes to Europe and the impact of the escalation of pirate attacks in the Red Sea / Gulf of Aden, and the interdependency with timely availability and cost of goods for both manufacturing and distribution.

If this article has made a convincing case for a greater focus on concentration risk, the next step is to identify the metrics that businesses should consider monitoring to develop more actionable insight. In financial services, one would typically look at portfolio concentrations from a product, market, and counterparty perspective. In a corporate context, some examples of the Key Risk Indicators or Key Performance Indicators include:

Supplier concentration in terms of % of spend with individual suppliers or single supplier dependency; overall or by direct and indirect spend category.

Supplier or sourcing region concentration for example, amount of spend from a country such as China or a region such as the Middle East.

Logistics route - what % of our imports go through the same logistics route be that by sea or otherwise.

Customer or sector concentrations in terms of the percentage of revenue that is generated by the top 1%, 5%, 10% of the customer base, and equally how much of the revenue is accounted for by the most important sector(s).

Revenue concentration - by product or service, by region, by pricing type (e.g. fixed price, cost-plus, long-term vs. spot business).

Contractor / 3rd party dependency, for example, what % of staff is contractor or temporary vs. employee. This can be measured group-wide but also at head office vs. operating company level or by function (e.g. IT or Finance).

Incorporating these metrics into quarterly and monthly performance reviews, business cases (e.g. consolidation of supplier base, changes to sourcing regions, investing in increasing sales to the top 10 customers), risk assessments or deep-dives, and regular risk reports will increase the focus on concentration risk and lead to more explicit evaluation of the risk-return from key decisions.

From an executive perspective, the concentration risk is easily underestimated or rationalised as the underlying decisions were predicated on delivering enhanced returns. However, it is not clear that the potential impact of the concentration risk crystallising was taken into account. The key questions that executive management should ask include for example:

What is the nature and characteristics of the concentration risk?

• Why/how has it arisen?
• What are the commercial/strategic drivers of the concentration risk?
• Is it measured and monitored in the business units and operating companies?
• How can the risk be managed better?

From a Board perspective, putting the spotlight on concentration risk will help to ensure that strategy discussions, business reviews and risk reviews incorporate explicit consideration of concentration risks both current and projected:

• What concentration risks do we have?
• What is the magnitude of the concentration risk?
• What returns are we generating from concentration risk(s)?
• How is concentration risk being managed?

In summary, concentration risk is not unique to financial services. On the contrary, businesses outside financial services overlook the risk at their peril. It can be a lot harder to diversify concentration risk outside financial services hence businesses should take care in how they make decisions that potentially increase the magnitude of the risk. Although single source supply, centralisation of manufacturing and distribution bring efficiencies, there are also trade-offs. In order to manage these well, businesses should define their appetite for concentration risk in risk-return terms. In addition, in areas where concentration risks are accepted, there should be clear mitigation plans and business continuity plans in place to avoid costly business interruptions.