Concentration Risk
What is Concentration Risk?
The risk arising from overexposure to a single counterparty, sector, region, or system dependency that could amplify the impact of adverse events.
Terms that appear alongside concentration risk
Each of these is named in at least one of the same controls as concentration risk. The number is how many controls name both.
- due diligence 9 shared controls
- third party risk 9 shared controls
- audit 8 shared controls
- resilience 7 shared controls
- cybersecurity 6 shared controls
- business continuity 6 shared controls
- compliance 5 shared controls
- multi cloud 4 shared controls
Frameworks that govern concentration risk
What the standards actually require on concentration risk
Requirements naming concentration risk across 6 standards, quoted from the control text.
Third-Party + Outsourcing + Cloud Service Provider cybersecurity is critical per FSA Cybersecurity Guidelines + FISC Cloud Guidelines (FISC Anzen Taisaku Kijun - Cloud Computing Edition). (1) Outsourcing Governance: (a) Outsourcing Policy + Board Approval;
JP-FSA-CYB-Third-Party-Outsourcing-Cyber-Risk-Cloud-Service-Provider-Due-Diligence-Audit-Right-Sub-Processor-Visibility-Concentration-Risk · Japan FSA Cybersecurity Third Party + Outsourcing Cyber Risk + Cloud Service Provider Due Diligence + Audit Right + Sub-Processor Visibility + Concentration Risk + Data Sovereignty + ISMAP Certification + FISC Cloud Guidelines →When assessing ICT third-party arrangements supporting critical or important functions, financial entities shall assess ICT concentration risk, including the risks of contracting providers that are not easily substitutable or of multiple arrangements with the...
DORA-Art.29 · Preliminary assessment of ICT concentration risk at entity level →Concentration risk management. Control from FFIEC IT Examination Handbook framework, domain: FFIEC IT Examination Handbook: Third-Party Risk Management.
FFIEC-19 · Concentration risk management →Implement IT Audit + Third-Party Risk Management per MAS TRM Chapters 14 + 15 + MAS Notice 658 on Outsourcing. Chapter 14 IT Audit - IT audit charter approved by Board Audit Committee + IT audit plan risk-based + IT audit methodology + IT auditor competency (C...
MAS-TRM-Third-Party-IT-Audit-Chapters-14-15-Outsourcing-Notice-658-Concentration-Risk-Exit-Strategy · MAS TRM Third Party + IT Audit + Chapters 14-15 + Outsourcing + Notice 658 + Concentration Risk + Exit Strategy →Maintain Risk Appetite Statement + Risk Limits + Concentration Risk Management + Limit Breach Protocols per 12 CFR Part 30 Appendix D Sections II.E + II.F + II.G + II.H + II.I + II.K.
OCCHS-3 · Risk Appetite Statement, Risk Limits, Concentration Risk, and Limit Breach Protocols →Concentration risk management. Control from PCI P2PE framework, domain: PCI P2PE: Third-Party Risk Management.
PCI-P2PE-19 · Concentration risk management →Questions people ask about concentration risk
What is Concentration Risk?
Why is Concentration Risk important for compliance?
Which compliance frameworks address Concentration Risk?
Where can I learn more about Concentration Risk?
See how Concentration Risk applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.