An organisation may assess every supplier individually and still overlook one of its largest exposures: several critical services depending on the same provider, location, technology or subcontractor. Third-party concentration risk arises when a shared dependency can disrupt multiple products, processes or entities at the same time.
This practical guide explains how to identify, assess and control concentration across a third-party portfolio. It complements ordinary due diligence by moving the analysis from “Is this supplier acceptable?” to “What would happen across the organisation if this shared dependency failed?”
What is third-party concentration risk?
Third-party concentration risk is the possibility that excessive reliance on a common external dependency creates a material, correlated impact. Concentration may be direct, such as several business units using one cloud provider, or indirect, such as different primary suppliers relying on the same fourth-party platform, data centre, logistics hub or specialist component.
The risk is not determined by spend alone. A low-cost service can be operationally critical, difficult to replace and connected to sensitive data. Conversely, a high-spend supplier may be readily substitutable. Assessment therefore needs evidence about criticality, dependency, substitutability, resilience and the potential scale of simultaneous failure.
The US banking agencies’ joint guidance on third-party risk management covers planning, due diligence, contracting, ongoing monitoring and termination across the relationship lifecycle. Although directed at banking organisations, its lifecycle logic is useful more broadly. NIST SP 800-161 Revision 1, updated in November 2024, also stresses supply-chain visibility and the identification, assessment and mitigation of cybersecurity risks throughout the chain.
Where concentration can hide
- Provider concentration: one supplier supports several critical services, entities or markets.
- Geographic concentration: suppliers, facilities or data centres share a region exposed to the same disruption.
- Technology concentration: different vendors rely on a common platform, software component, network or identity service.
- Fourth-party concentration: apparently separate suppliers depend on the same subcontractor.
- Capability concentration: a scarce skill, licence, dataset, certification or piece of equipment has few alternatives.
- Revenue or customer concentration: a third party enables a disproportionate share of sales, service delivery or customer access.
- Financial concentration: exposure is clustered in one payment channel, insurer, bank or financially connected supplier group.
- Exit concentration: several important contracts expire, migrate or require renewal within the same period.
These forms can combine. Three vendors may appear independent but use the same hosting region and open-source component. A cyber incident affecting that shared layer can defeat a diversification strategy based only on supplier names.
How to assess third-party concentration risk
1. Build a complete third-party inventory
Start with an inventory that reconciles procurement, accounts payable, contract, information-security and business-owner records. Include affiliates, outsourced operations, consultants, technology providers, agents, distributors and other parties that may not pass through central procurement. Assign a unique identifier so that different trading names and legal entities are not counted as separate providers incorrectly.
For each relationship, record the service, owner, entities and locations served, data access, system connectivity, contract dates, annual value, criticality, subcontractors and recovery commitments. Establish a process for keeping these fields current.
2. Identify critical services and outcomes
Determine which customer, operational, financial, regulatory or public-service outcomes must continue within defined tolerances. Link each critical outcome to the third parties that enable it. This outcome-first view prevents a supplier list from obscuring dependencies that cross departmental boundaries.
Define impact tolerances where possible: maximum acceptable outage, data loss, transaction backlog, financial exposure or customer harm. The same supplier can be critical for one service and non-critical for another.
3. Map direct and indirect dependencies
Ask business owners and critical providers about facilities, hosting, networks, subcontractors, key software, data sources and specialist personnel. Contractual disclosure rights can support this exercise, but information will rarely be complete. Record confidence and unknowns rather than presenting an incomplete map as fact.
Use a simple many-to-many model: critical service to supplier, supplier to location, supplier to technology and supplier to fourth party. Visualisation can reveal clusters that ordinary questionnaires miss.
4. Measure exposure using more than supplier count
Useful measures include the proportion of critical services dependent on one provider, transaction or revenue share, number of legal entities affected, geographic clustering, data sensitivity, recovery-time mismatch and the percentage of suppliers using a common fourth party. Analyse concentration at organisational and portfolio levels.
Metrics require careful denominators. “Thirty per cent of suppliers” may be meaningless if those suppliers serve only minor activities. A better measure might be “four of six services with a four-hour impact tolerance depend on the same hosting region”.
5. Assess substitutability and exit complexity
Evaluate the time, cost and feasibility of changing provider or bringing the service in-house. Consider data portability, intellectual property, integration, regulatory approval, customer communication, specialist skills, contract restrictions and the capacity of alternatives. A named backup is not a control unless it can accept the required workload within the tolerance.
Distinguish theoretical alternatives from tested alternatives. A market with several providers may still be concentrated if all use the same infrastructure or require a long migration.
6. Test severe but plausible scenarios
Run scenarios that affect the common dependency: provider insolvency, prolonged outage, cyber compromise, regional disruption, sanctions, loss of licence, data corruption or simultaneous contract termination. Include fourth parties and connected internal systems. Estimate the combined impact, management decision points and time available.
Challenge optimistic assumptions. Contractual recovery commitments do not guarantee actual recovery, and financial compensation may not repair customer harm or regulatory breach.
7. Evaluate controls and residual exposure
Assess controls such as diversification, geographic separation, portability, tested continuity, backup capacity, escrow, audit rights, incident notification, subcontractor approval and exit assistance. Determine whether controls operate at the same level as the concentration. A resilient supplier does not eliminate a portfolio-level dependency if several services still share one failure point.
Compare residual exposure with approved appetite and impact tolerances. Escalate concentrations that cannot be reduced promptly, with clear ownership and time-bound acceptance.
A practical concentration-risk scorecard
| Dimension | Key question | Evidence |
|---|---|---|
| Criticality | Which important outcomes depend on this concentration? | Service maps, impact analysis, tolerances |
| Scale | How many entities, customers or transactions could be affected together? | Volumes, exposure reports, service data |
| Substitutability | Can the dependency be replaced within the required time? | Market analysis, migration tests, capacity |
| Correlation | Which apparently separate providers share infrastructure or subcontractors? | Architecture maps, disclosures, testing |
| Resilience | Can the shared dependency recover within impact tolerances? | Exercise results, recovery evidence, incidents |
| Exit readiness | Are data, knowledge, access and services transferable? | Exit plan, clauses, inventories, rehearsals |
Use a consistent rating scale, but retain the supporting facts and assumptions. A composite score can support prioritisation; it should not hide a critical weakness behind several strong dimensions.
How to reduce concentration risk
- Diversify providers only after confirming that alternatives do not share the same hidden dependency.
- Design portable data, interfaces and operating procedures to reduce switching time.
- Establish tested contingency capacity rather than relying on unverified backup contracts.
- Set portfolio limits or escalation thresholds for critical providers, regions and technologies.
- Strengthen contract rights covering subcontractors, location changes, incidents, audit, continuity and exit.
- Use staged transition, dual running or modular architecture where immediate diversification is impractical.
- Accept residual concentration formally when the strategic benefit outweighs the risk and no proportionate alternative exists.
Monitoring and board reporting
Monitor changes in ownership, financial condition, service footprint, subcontracting, hosting, incidents, recovery capability and market substitutability. Indicators may include exposure above limits, untested exit plans, unresolved continuity gaps, fourth-party unknowns and critical contracts approaching renewal.
Board reporting should distinguish individual supplier performance from portfolio concentration. Show the critical outcomes exposed, scenarios considered, risk movement, appetite breaches, remediation, accepted residual risk and decisions required. Avoid reports that count high-risk suppliers without explaining correlated impact.
Common assessment mistakes
- Using spend as the only measure of criticality.
- Counting legal entities without recognising common ownership or infrastructure.
- Assuming multi-sourcing provides resilience without testing shared fourth parties.
- Accepting contractual recovery times without operational evidence.
- Ignoring data portability, knowledge transfer and internal capacity in exit estimates.
- Assessing concentration once at onboarding rather than when services and markets change.
Develop stronger third-party risk capability
EPW’s Third Party Risk Management and Due Diligence Course helps procurement, risk, compliance, audit and contract professionals segment relationships, conduct proportionate due diligence, define contractual controls, monitor exposure, manage incidents and prepare resilient exit plans. The five-day programme includes concentration and fourth-party risk within a complete lifecycle approach.
For related guidance, compare third-party due diligence and ongoing monitoring, or explore more Auditing, Governance, and Risk Compliance Articles.
References
- Board of Governors of the Federal Reserve System, FDIC and OCC (2023), Interagency Guidance on Third-Party Relationships: Risk Management.
- National Institute of Standards and Technology (2024), SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.
