Finance Index

What is vendor concentration risk, and when should a finance team worry?

Reference guide to vendor concentration risk, including AI concepts, data requirements, control questions, and finance-team decisions.

Vendor concentration risk is overdependence on a small number of suppliers - operational exposure if a critical vendor fails, pricing exposure if they know you can't leave. Common screening thresholds: any single vendor above 10 - 15% of total spend, or a top-10 share above 50%, warrants review. The threshold matters less than knowing your number and reviewing it regularly.

At a Glance

Aspect Short Answer Why It Matters
Vendor concentration risk Vendor concentration risk is overdependence on a small number of suppliers - operational exposure if a critical vendor fails, pricing exposure if they know you can't leave. Keeps vendor records and payment decisions reliable.
Vendor impact Three complementary measures. Keeps vendor records and payment decisions reliable.
Risk check Commonly used screening lines: 10% of total spend with one vendor merits monitoring, 20%+ merits a mitigation plan. Keeps vendor records and payment decisions reliable.
Audit evidence One slide: top-10 vendor share with trend, any vendor above 10%, single-source dependencies in critical categories, and the mitigation status of each flagged exposure. Keeps evidence clear and reduces control risk.
Find hidden concentration Roll up vendor records by tax ID and parent company before computing shares, and run the analysis on consolidated cross-entity spend. Reduces payment errors, timing issues, and reconciliation cleanup.

How do I measure supplier concentration from AP data - top-n share, hhi, single-source dependencies?

Three complementary measures. Top-N share: percentage of total spend with your top 1, 5, and 10 vendors - simple and board-legible. HHI (Herfindahl - Hirschman Index): sum the squared spend shares of all vendors; it captures the full distribution rather than just the head. Single-source dependency: for each critical category, count qualified suppliers - a vendor at 3% of total spend can still be your only source for something essential, which spend-share math will never flag. Run all three at total level and per category, on normalized vendor records (parent-company roll-ups included), or the analysis understates reality.

What % of spend with one vendor is considered risky - are there industry benchmarks?

Commonly used screening lines: 10% of total spend with one vendor merits monitoring, 20%+ merits a mitigation plan. Industry context shifts this - manufacturers with strategic single-source partnerships run higher by design; services businesses usually shouldn't. The benchmark question matters less than the follow-up: could we operate if this vendor disappeared for a quarter?

How do I present vendor concentration risk to the board or audit committee?

One slide: top-10 vendor share with trend, any vendor above 10%, single-source dependencies in critical categories, and the mitigation status of each flagged exposure. Boards want to see that you know the number, the trend, and the plan - not a statistics lecture.

How do I find hidden concentration - same parent company behind multiple vendor records, or one vendor across all entities?

Roll up vendor records by tax ID and parent company before computing shares, and run the analysis on consolidated cross-entity spend - a vendor at 4% in each of five entities is a 4% vendor in your records and potentially a 20% vendor in reality. Parent-company mapping for your top 100 vendors is an afternoon of work that frequently changes the answer.

What should a vendor concentration review include beyond spend share?

Contract terms (termination rights, price-escalation clauses), switching cost and time-to-switch, geographic and regulatory exposure, the vendor's financial health, and whether the dependency is mutual (are you a major customer to them?). Spend share finds the candidates; these factors determine which exposures are actually dangerous.

How do I flag when a single vendor's spend is growing abnormally fast quarter over quarter?

Compute quarter-over-quarter growth per vendor and flag anything exceeding both a relative threshold (say, 50% growth) and an absolute one (material dollars), so noise from small vendors doesn't drown the signal. Sustained outlier growth means either an unmanaged dependency forming or price escalation worth investigating - both are findings.

Our auditors flagged supplier concentration - what analysis and mitigation plan do they expect?

Expect to show: the measurement (top-N and category-level concentration, refreshed on a stated cadence), the assessment (which concentrations are deliberate vs accidental, with business rationale for the deliberate ones), and the mitigation (alternate suppliers identified, contract protections, monitoring triggers). Auditors accept managed concentration; they flag unexamined concentration.

How do I track concentration by category instead of just total spend?

Compute supplier shares within each spend category - one freight carrier at 90% of logistics is invisible in total-spend math and critical in operational reality. Category-level concentration is where the real single-source risks live; total-level concentration is where the pricing-leverage risks live. Track both.

Stampli perspective

Concentration analysis is only as good as the vendor data underneath - duplicate vendor records and missed parent relationships systematically understate exposure. Because Stampli processes invoices against a governed vendor master inside ERP-aligned workflows, the spend-by-vendor base is clean at the source. Deep Finance is designed to surface signals like vendor concentration risk directly from that invoice data, presenting quantified findings with supporting evidence and financial impact that finance leaders can take to the board.