Concentration Risk
What is Concentration Risk?
The risk arising from overexposure to a single counterparty, sector, region, or system dependency that could amplify the impact of adverse events.
Terms that appear alongside concentration risk
Each of these is named in at least one of the same controls as concentration risk. The number is how many controls name both.
- due diligence 9 shared controls
- third party risk 9 shared controls
- audit 8 shared controls
- resilience 7 shared controls
- cybersecurity 6 shared controls
- business continuity 6 shared controls
- compliance 5 shared controls
- multi cloud 4 shared controls
Frameworks that govern concentration risk
What the standards actually require on concentration risk
Requirements naming concentration risk across 6 standards, quoted from the control text.
Include in the framework policies and supporting processes, appropriate to the bank's size, complexity and risk profile, for identifying, measuring, monitoring and controlling concentrations of risk.
occ-heightened-standards-12-cfr-part-30-appendix-d::II.I · II.I Concentration risk management →The bank has policies and processes that give a bank-wide view of significant sources of concentration risk (credit, market and other, including asset classes, products, collateral, currencies and funding sources), capturing on- and off-balance sheet exposures...
basel-core-principles-for-effective-banking-supervision-2024::P19 · Principle 19: concentration risk and large exposure limits →When assessing ICT third-party arrangements supporting critical or important functions, financial entities shall assess ICT concentration risk, including the risks of contracting providers that are not easily substitutable or of multiple arrangements with the...
DORA-Art.29 · Preliminary assessment of ICT concentration risk at entity level →Sets the principles of consolidated supervision of concentration risks under the Banking (Exposure Limits) Rules: the implementation of the BELR, the principles, the supervisory approach (application, subsidiaries to be included, Tier 1 capital as the base, so...
hkma-spm::CR-L-1 · CR-L-1 Consolidated Supervision of Concentration Risks: BELR Rule 6 →HKMA TM-G-1 Cyber + Audit + Outsourcing + Cloud. (1) SECURITY MONITORING AND SIEM (TM-G-1.7.1) - SIEM + SOC + 24x7 monitoring + log management + correlation + use cases + alert handling + escalation + UEBA + behavior analytics + SOAR automation + threat detect...
HKMA-TMG1-Cyber-Monitoring-Threat-Intel-IR-Audit-Outsource-Cloud · TM-G-1 Security Monitoring + SIEM + Threat Intel + Cyber IR + Audit + Outsourcing + Cloud Computing Risk →A trustee sets, reviews on a recurring basis and follows an investment strategy covering the entity as a whole, plus one for each investment option on offer, having regard to risk and likely return against its objectives and expected cash flow, the diversifica...
australia-superannuation-industry-supervision-act-1993-cth::s52-6 · s 52(6) Investment strategy covenant →Questions people ask about concentration risk
What is Concentration Risk?
Why is Concentration Risk important for compliance?
Which compliance frameworks address Concentration Risk?
Where can I learn more about Concentration Risk?
See how Concentration Risk applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.