Third-Party Concentration Risk: Do Your Suppliers Share a Single Point of Failure?

Your organisation uses different suppliers for payroll, customer support and document management. Each has completed a due diligence assessment and provided information about security and business continuity.

But what if all three depend on the same underlying service?

A disruption at that shared provider could affect several business activities simultaneously. Reviewing each supplier separately may leave this combined exposure difficult to see.

Third-party concentration risk arises when an organisation depends heavily on a particular provider, group of connected providers, location or shared underlying resource. It can exist directly, through several services purchased from one supplier, or indirectly, through dependencies further down the supply chain.

For risk managers, the challenge is to understand how those relationships affect the organisation as a whole, and whether contingency arrangements would still work if several suppliers were disrupted together.

Why third-party concentration risk deserves attention now

UK financial services firms are preparing for new operational incident and third-party reporting requirements taking effect on 18 March 2027. The FCA’s final rules require firms within the third-party reporting scope to maintain a register of material third-party arrangements, submit it annually and notify the regulator of new arrangements or significant changes.

The scope differs between the incident reporting and third-party reporting requirements. These are financial-sector requirements, rather than obligations applying to every UK organisation. Nevertheless, they highlight the importance of accurate information about external dependencies.

AI adoption adds another consideration. The Financial Stability Board has highlighted how generative AI can create dependencies on a relatively small number of providers of cloud infrastructure, specialised hardware and pre-trained models. Buying different AI applications does not necessarily mean their underlying dependencies are different.

For organisations across sectors, this creates a practical question: how much of our operation could be affected by a disruption somewhere beyond our direct suppliers?

How concentration risk can remain hidden

A supplier register can show who you buy from without explaining everything those suppliers rely on.

Consider this illustrative example:

There are three separate supplier relationships, but one potential shared source of disruption.

That does not prove all three services would fail together. Their architecture, recovery arrangements and use of independent infrastructure may differ. It does, however, identify an assumption that needs testing.

The next questions should concern the exact dependency: whether the same region or service is involved, whether recovery relies on it too, and what evidence supports the supplier’s continuity claims.

Concentration can also arise through common ownership, geographical exposure or providers that are difficult to replace. The Bank of England explicitly identifies these issues, alongside shared subcontractors, in its updated supervisory statement for central counterparties. That guidance is sector-specific, but the examples are useful prompts for a wider supplier risk assessment.

Third-party risk and fourth-party risk: what is the difference?

A third party is a provider with which your organisation has a direct relationship. A fourth party is commonly understood as a provider used by that third party to deliver its service to you.

For example, your payroll provider is a third party. A hosting company supporting that payroll service may be a fourth party from your organisation’s perspective.

Fourth-party risk concerns those indirect relationships. Concentration risk concerns how much exposure accumulates around a particular dependency. The two overlap when several direct suppliers rely on the same underlying provider.

This distinction matters when designing due diligence questions. Asking whether a supplier uses subcontractors is a starting point. Understanding which subcontractors support essential services, and what happens if they become unavailable, provides more useful information for a risk decision.

How to assess third-party concentration risk

The following approach offers a practical starting point. Scale the depth of assessment to the importance of the service and the consequences of disruption.

Start with the business services that matter most

Identify the activities whose disruption would cause the greatest harm to customers, service users or your organisation.

For each activity, establish the responsible owner, the external services it requires and how long disruption could be tolerated. Include time-sensitive dependencies: payroll may become particularly critical near a payment deadline, while a customer-facing service may require continuous availability.

Supplier spend alone is an incomplete measure of importance. A relatively inexpensive service can still support a critical operational step.

Gather information about underlying dependencies

Ask suppliers to identify the providers, locations and infrastructure essential to delivering the service you purchase.

Use a consistent format so responses can be compared across suppliers. Record the source of the information and when it was last confirmed. Where the supplier cannot provide sufficient detail, retain that uncertainty as an assessment finding.

An unanswered question should remain visible. It should not silently become an assumption that no dependency exists.

Assess the combined business impact

Review dependencies across supplier records, then consider what would happen if a shared provider became unavailable.

Would several departments lose access at once? Would staff be able to use their planned workarounds? Could the disruption affect both the main service and the tools needed to coordinate recovery?

Assess the scenario as a connected business risk. Averaging individual supplier scores may conceal the consequences of several services failing together.

A useful risk description might be:

Disruption to a shared hosting dependency could interrupt payroll and customer support simultaneously, creating payment delays, service backlogs and additional pressure on recovery teams.

This gives the risk owner a clearer basis for deciding which controls and contingency measures are needed.

Examine whether alternatives are usable

An alternative supplier is valuable only if it can support recovery within an acceptable timeframe.

Consider data export, integration work, contractual restrictions, available capacity and the staff effort required to move. Check whether the proposed alternative depends on the same provider that created the original exposure.

For some services, a temporary manual process may be workable. For others, an alternative arrangement may need to be established and tested in advance.

Assign ownership and review the decision

Give the concentration risk a clear owner with authority to coordinate action across affected business areas.

Record the proposed response, supporting evidence, outstanding actions and any exposure accepted by management. Set a review date and identify events that should trigger an earlier reassessment, such as a supplier acquisition, infrastructure change, incident or expansion in the service’s use.

The Financial Stability Board’s third-party risk management toolkit similarly takes a lifecycle approach, covering the identification of critical services and the management of risks throughout the relationship.

Questions to add to your supplier due diligence assessment

A focused set of questions can make shared dependencies easier to investigate.

Request evidence proportionate to the service’s importance. Depending on the arrangement, this could include a relevant continuity test summary, a dependency overview or documented exit procedures.

Sensitive technical information should be handled through an appropriate secure process. The objective is to obtain enough evidence for a reasoned decision.

What should management see?

A useful report should explain where concentration could affect business delivery and what management needs to decide.

For a first reporting cycle, consider showing:

• Essential business services linked to each significant shared dependency.

• Important supplier assessments with missing or outdated dependency information.

• Contingency arrangements awaiting testing.

• Outstanding mitigation actions and their owners.

• Accepted exposures approaching their review dates.

Avoid treating the number of suppliers as a standalone measure of resilience. More suppliers can still leave the organisation exposed to the same underlying dependency.

The most useful question for a committee or board is: where could one disruption affect several important services, and how confident are we in the response?

How Symbiant supports connected supplier risk management

Managing concentration risk requires supplier information to inform wider risk decisions.

Symbiant’s Due Diligence Software supports structured assessments, issue recording, risk scoring and remediation actions. It can also connect due diligence records with Risk Registers and Controls & Policies, helping teams relate assessment findings to the risks they need to manage.

Questionnaires, Surveys and Assessments can support a consistent approach to gathering supplier information. Configurable questions, conditional follow-ups, evidence uploads and scheduled assessments help teams investigate responses and retain assessment history.

Once a dependency has been identified and assessed, Symbiant’s Risk Register Software provides a place to record the exposure, assign ownership and link relevant controls, assessments, incidents and actions. Relationship mapping can help teams understand connections between recorded risks.

The quality of that view depends on the information collected and maintained. Supplier engagement, evidence review and professional judgement remain essential to identifying dependencies and assessing their significance.

Explore Symbiant’s Due Diligence Software to see how supplier assessments, findings and follow-up actions can support your wider risk management process.