Supplier concentration risk: measuring dependency before you contract
Supplier concentration risk is the exposure created when a supplier cannot readily be replaced — because the category has consolidated onto one supplier, because no alternative exists in the market, or because the recorded alternatives are no longer able to supply. It is assessed before contracting, not after failure, because the remedies have to exist in the contract to be available later. Measurement has three parts: how concentrated the category is, whether the recorded alternatives are real, and how likely the supplier is to fail. Exposure is the cost of interruption multiplied by the probability of interruption, and the cost of interruption is not the contract value.
- Applies to
- Bottleneck categories, and Strategic categories where the concentrated supplier is also high-spend
- Unit of analysis
- One supplier within one category
- Position in the lifecycle
- Before the arrangement is entered into
Single source and sole source are different exposures
The distinction is standard in the profession and is frequently lost in the risk register, where both appear as one supplier.
Single source and sole source: same register entry, different remedy | Single source | Sole source |
|---|
| What it is | A choice by the organisation | A condition of the market |
| Why it arose | Volume concentrated with one of several available suppliers, usually for price, quality consistency or relationship reasons | Proprietary technology, regulatory approval attached to one site, or a specification only one manufacturer can meet |
| Reversible by procurement action | Yes — qualifying a second supplier costs time and money, and the cost is calculable | No — mitigation only, through buffer, redesign or contractual protection |
Recording both as one supplier produces a register that cannot distinguish a problem with a remedy from a problem without one, and therefore cannot rank them.
The alternative on the list is frequently not an alternative
A more common failure than either, and the one that determines whether the register describes reality.
A backup supplier that has received no order for eighteen months is not functioning as a backup. The primary is effectively a sole source regardless of what the approved vendor list records. Qualification lapses, tooling is reallocated, the account team has moved on, and lead times quoted for a dormant relationship are estimates rather than commitments.
Two further conditions turn a nominal alternative into a real one:
- Qualification currency. Whether the alternative could supply within the required lead time today, not whether it was qualified at some point.
- Independent exposure. Whether the alternative shares the primary’s own upstream dependency. Two suppliers drawing from the same tier-2 source are one supplier for continuity purposes.
Concentration risk multiplies where one supplier supports more than one critical function. A provider that supplies both a production input and a system the production line depends on creates a correlated failure that neither category’s risk assessment sees on its own, because each assessment looks at one category.
Qualification lead time is the exposure window, and it is usually missing from the case
Where qualifying a replacement takes nine months, single-sourcing means nine months of exposure — not the two weeks it takes to place an order elsewhere. This is the single number most often absent from a consolidation business case, and including it frequently reverses the decision.
In regulated categories the figure is large and non-negotiable. Pharmaceutical inputs, aerospace components, medical devices and anything carrying a site-specific approval are measured in months of requalification, and the constraint is regulatory rather than commercial. No amount of buyer urgency compresses it.
The practical test is to ask what would actually have to happen, in sequence, before an alternative could ship: sample, test, audit, approval, tooling, first article, ramp. The sum of those is the exposure window. The contract value is not.
Two measures, because share alone hides the structure
Two measures, used together, because each is blind to something the other sees.
Top-supplier share is the proportion of category spend held by the largest supplier. Simple, immediately interpretable, and insufficient on its own: it does not distinguish a category with one large supplier and twenty small ones from a category with one large supplier and one other.
The Herfindahl-Hirschman Index sums the squares of every supplier’s share of the category:
HHI = Σ ( share of supplier i )²
Expressed on shares as percentages, the index runs from near zero for a highly fragmented category to 10,000 for a single supplier. The convention in competition analysis treats values above 2,500 as highly concentrated, and while that threshold was designed for markets rather than for individual buyers’ supply bases, it is a serviceable reference point.
Category structures and the HHI they produce| Category structure | Shares | HHI | Reading |
|---|
| Sole source | 100 | 10,000 | No alternative in use |
| Dominant supplier with a nominal second | 90 / 10 | 8,200 | Concentrated; test whether the second is real |
| Deliberate dual source | 70 / 30 | 5,800 | Concentrated but with a live alternative |
| Balanced three | 40 / 35 / 25 | 3,450 | Moderately concentrated |
| Fragmented | 20 / 20 / 20 / 20 / 20 | 2,000 | Not concentrated; may carry a different problem |
The reason to compute both is that spend-based measures record what is bought, not what could be. A category showing an HHI of 5,800 in a deliberate 70/30 split is in a materially different position from one showing 8,200 where the 10% supplier has not received an order in a year — and the second frequently looks safer in a spend report than it is.
Sector base rates beat judgement, and they are free
Supplier failure probability is usually treated as unknowable and therefore assigned by judgement, which produces a register in which every supplier is Medium. Public data supports a better starting position.
Eurostat publishes bankruptcy declarations quarterly and monthly, by NACE sector and by member state, indexed to 2015, with annual absolute counts from 2015 to 2024. This gives a sector-and-country base rate that can be applied to a supplier as a starting estimate and then adjusted for what is known about the specific company.
The current picture, date-stamped because it moves: in the fourth quarter of 2025 bankruptcy declarations in the EU rose 2.5% against the previous quarter and increased in six of eight sectors, with the largest rises in accommodation and food services, information and communication, and transport. Allianz Trade recorded global insolvencies rising 10% in 2024 and 6% in 2025, with a further 3% expected in 2026 — a fifth consecutive year of increase.
The adjustment from a sector base rate to a specific supplier is a matter of observable signals rather than of modelling: payment behaviour changing, delivery performance drifting, leadership departures, filings delayed, ownership changes, litigation.
Exposure is not contract value
The most consequential error in bottleneck assessment is using contract value as the measure of what is at stake. The defining property of a bottleneck category is that its consequence exceeds its spend, which is exactly the condition a value-based threshold cannot detect.
Exposure = cost of interruption × probability of interruption
Where the cost of interruption is built from what stops rather than from what is paid:
Components of the cost of interruption| Component of interruption cost | Basis |
|---|
| Lost output | Production or service volume unavailable for the duration, at contribution margin rather than revenue |
| Emergency sourcing premium | Spot price against contract price, plus expedited logistics, for the volume that can be replaced |
| Requalification cost | Engineering, testing, regulatory approval and tooling for an alternative source |
| Contractual exposure to your own customers | Service credits, penalties, and the commercial consequence of missing your own commitments |
| Recovery duration | The multiplier on all of the above |
For scale on the strategic end, McKinsey Global Institute’s modelling across 23 value chains found disruptions lasting a month or longer occurring roughly every 3.7 years and costing the average company in the region of 45% of one year’s EBITDA over a decade, with wide sector variation — consumer goods sits nearer 30%. A disruption of 30 days or fewer puts 3–5% of EBITDA margin at stake.
Invert the question: state a threshold, not a prediction
The formula above requires a probability, and a probability of failure for one named company over the next year is not something anyone can supply honestly. Assigning one produces false precision; refusing to assign one leaves the decision unquantified. There is a third option.
Rather than predicting the probability, compute the probability at which the decision changes:
Break-even failure probability = annual value of the discount ÷ estimated cost of interruption
A consolidation offering €180,000 a year in discount, against an interruption estimated at €4.5m over a nine-month qualification window, breaks even at a 4% annual probability of failure. The output is a sentence a decision-maker can actually act on: this discount pays for itself provided the annual probability of failure at the consolidated supplier is below 4% — judge whether that holds.
This keeps the arithmetic visible and simple, keeps the judgement with the person who has the category knowledge, and produces something defensible in front of a risk committee. A threshold with named assumptions survives challenge; a predicted probability does not.
Consolidation creates the exposure it is meant to reduce
Volume consolidation is the standard route to price leverage and it moves the category toward concentration by construction. The two objectives are in direct tension and the tension is manageable rather than resolvable.
The convention in the profession is a dual-source split around 70/30, on the reasoning that most of the volume-discount benefit is available at 70% while the 30% keeps a qualified alternative live. The precise ratio matters less than the principle that the minority share must be large enough to keep the second supplier’s qualification current — which returns to the eighteen-month test above. A 95/5 split is a single source with a paper alternative.
Two further checks belong in any consolidation decision and are routinely omitted.
- Capacity. Whether the chosen supplier can absorb the full volume. Consolidating into a supplier already running at 90% utilisation buys risk rather than savings, and the constraint tends to surface at exactly the moment demand rises.
- Leverage is spent once. The moment of consolidation is the point of maximum buyer leverage in the relationship, and trading all of it for price is the recurring error. An indexation cap, an audit right, a capacity commitment and a structured exit are each worth more over a multi-year term than an additional point of discount, and none of them will be available on the same terms at renewal.
Any consolidation analysis should therefore end with a concentration assessment of the resulting structure, not begin with one of the current structure.
Where this became an obligation
For EU financial entities, concentration assessment is no longer good practice.
The Digital Operational Resilience Act has applied since 17 January 2025 to approximately 22,000 EU financial entities. Its third-party regime requires:
DORA third-party requirements, article and timing| Requirement | Article | Timing |
|---|
| Register of Information covering every ICT contractual arrangement, submitted annually to the competent authority | 28 | Ongoing |
| Assessment of concentration risk before entering an arrangement | 28–29 | Pre-contractual |
| Mandatory contractual provisions for arrangements supporting critical or important functions | 30 | At contracting |
| Documented and tested exit strategies | 28 | At contracting, tested thereafter |
Penalties reach 2% of total annual worldwide turnover or €10m. The European Supervisory Authorities designated the first critical ICT third-party providers in November 2025, and during 2026 supervision moved from dialogue to formal compliance review with registers cross-checked.
Two figures indicate the scale of the exercise rather than the risk: an EBA survey put the average financial institution at 147 ICT third-party arrangements, and in a Deloitte survey 46% of institutions named the Register of Information the single most challenging DORA requirement.
The feature that distinguishes DORA from most procurement-adjacent regulation is that its obligations are pre-contractual. Concentration is assessed before the arrangement is entered into, and the exit is structured before signature. An assessment produced after the fact does not satisfy the requirement, and an exit strategy the contract does not permit cannot be tested.
What this method does not do
- It does not map tiers beyond the first with any depth. Establishing whether two suppliers share an upstream source requires multi-tier mapping, and specialist supply chain risk platforms do this considerably better. The method above uses tier-2 exposure as a question to ask rather than a dataset to hold.
- It does not produce a failure prediction for an individual company. A sector base rate adjusted by observable signals is a starting position for prioritisation, not a credit assessment — which is the reason the threshold formulation above exists.
- It does not cover cyber or information security assessment of the supplier, which is a separate discipline with its own instruments, even where the same DORA article governs both.
Where this runs in EXOS
Concentration is assessed as a chain, because the measurement, the dependency structure and the consequence are three different analyses.
The scenario chain that executes this method| Step | Scenario | What it produces |
|---|
| Measure concentration and score category risk | S20 · Category Risk Evaluation | Category risk score by dimension, supply risk assessment, supplier concentration (HHI) block where supplier-level spend is supplied, EU regulatory exposure flag, recommended contract terms |
| Establish whether the dependency is reversible | S25 · Supplier Dependency Planner | Dependency score, lock-in factor assessment across contractual, technical and knowledge dimensions, switching cost analysis, exit roadmap, diversification roadmap |
| Quantify what failure would cost | S27 · Black Swan Scenario Simulation | Vulnerability assessment identifying single points of failure across tiers, per-scenario financial exposure, cascading failure analysis, early warning indicators |
| Prepare the operational response | S26 · Disruption Management | Alternative supplier activation matrix with qualification status and lead times, impact table by delay duration, total disruption cost estimate |
| Verify a specific supplier before contracting | S29 · Pre-Flight Supplier Audit | Financial distress signals, litigation history, sanctions and ESG flags, run against the registered legal entity rather than the brand |
S24 · Single vs Multi-Source runs into this chain rather than away from it. It does not compute a volume discount; it takes the offered discount as an input and returns the point at which it stops paying for the risk it buys — the break-even failure probability described above, plus qualification lead time exposure, a capacity check, a recommended structure anchored to the Kraljic quadrant, the terms to extract while leverage is available, and the triggers that should force a review later. Consolidating for price without running that step is how the exposure gets built deliberately.
Two chaining notes worth stating, because they are where the analysis is usually cut short.
The registered legal entity, not the brand, is what carries the litigation and distress record. In group structures the trading entity and the contracting entity are frequently different legal persons, and an audit run against the wrong one returns a clean report about a company you are not contracting with.
And the assessment has a shelf life. A concentration position established at qualification is not the position at renewal three years later, which is what the continuous component is for.
Continuous component — Risk Monitor. The chain above assesses the position once. The Risk Monitor tracks supplier and sector signals on a scheduled basis across a defined supplier list, which is what converts a one-off assessment into something still true when the renewal arrives.
Monitoring in EXOS is scheduled, not continuous. Specialist multi-tier monitoring platforms go deeper, and where continuous multi-tier surveillance is the requirement they are the correct instrument.
Sources
- Regulation (EU) 2022/2554 (DORA), Articles 28–30.
- European Supervisory Authorities, designation of critical ICT third-party providers, November 2025, and the published list of designated CTPPs.
- EBA survey data on ICT third-party arrangements; Deloitte DORA readiness survey.
- Directive (EU) 2024/1760 as amended by Directive (EU) 2026/470 (Omnibus I).
- Eurostat, quarterly and monthly registrations and bankruptcies (sts_rb_q, sts_rb_m), news release February 2026.
- Allianz Trade, Global Insolvency Outlook 2026.
- McKinsey Global Institute, Risk, resilience, and rebalancing in global value chains, August 2020.