Risk Concentration

Concentration exists as a category because averages hide it: ten suppliers look diversified until you notice that all ten route through one port. The concept forces leaders to see single points of failure — one site, one system, one person, one jurisdiction — behind an apparently spread portfolio. The dependent decision is redundancy: paying for a second source, site or key-person cover before the concentration is tested by events. Regional supply routes in the Gulf make this a board topic, not a procurement detail.

Concentrations are identified during the business impact analysis and supplier assessments, tracked in the risk register, and reviewed at least annually by operations and procurement together. Thresholds make them visible: flag any supplier above 40% of a critical category, any site hosting more than 50% of production capacity, any process whose details only one employee knows. Each flagged concentration gets an owner and a decision — accept it with open eyes, or fund an alternative. Insurance rarely covers the time dimension of a concentrated failure, so the analysis must be operational, not only financial.

The typical mistake is measuring supplier risk by counting contracts instead of tracing dependencies — the second and third suppliers often rely on the same upstream manufacturer. Concentration only shows itself when the chain is mapped one level deeper than the contract. Turning such dependency maps into resilience decisions is developed in module M2 "From enterprise risk management to business resilience" of the ERGP programme.