What Is Customer Concentration Risk? (Portfolio Risk Specs)
Customer concentration risk is the danger that a small number of customers account for so much revenue, profit, or cash flow that losing one, delaying payment, or reducing orders could seriously harm a business. Measure it with customer revenue shares, top-customer totals, and the Herfindahl-Hirschman Index (HHI). Set internal limits based on your own economics; accounting disclosure thresholds are not safety limits.
A business can have strong sales and still face a fragile future. If one buyer places a large share of orders, a contract change or late payment can quickly affect payroll, production, and debt payments. The challenge is to spot that dependence before it becomes a crisis.
I use a simple hypothetical example throughout: Northline Components sells to many customers, but its largest buyer provides 30% of revenue. This is not a real company or a recommended limit. It shows how to connect the numbers to practical decisions.
Customer Concentration Risk: Definition, Scope, and Measurement
Customer concentration risk is the harm a business may face when a few customers account for a large share of its business. It can affect sales, profit, cash flow, or access to production capacity. The risk depends not only on each customer’s revenue share, but also on how quickly the business could replace that customer.
Customer concentration may affect a manufacturer, service firm, contractor, lender, or investment portfolio that holds loans to businesses. Here, “portfolio” means the business’s customer base unless stated otherwise.
How to calculate customer revenue share
Customer revenue share is a customer’s revenue divided by total revenue for a stated period. Use the same time period and accounting basis for each customer, such as the latest fiscal year or a rolling 12 months.
Customer share = customer revenue ÷ total revenue
If a company earns $10 million in a year and one customer accounts for $3 million, that customer’s share is 30%. State whether figures include returns, discounts, or pass-through sales. Apply the same rules each time so the comparison is useful.
Also identify related companies. A parent company and its subsidiaries may appear as separate accounts, even though they depend on the same business relationship. Combine them when they share a decision-maker, contract, or economic source of risk. Record the method used.
What the HHI measures
The Herfindahl-Hirschman Index, or HHI, summarizes customer concentration by adding the squared revenue shares of all customers. Use shares from 0 to 1 for the calculation. You can report the result on a 0–1 scale or multiply it by 10,000; label the scale clearly.
HHI = Σ(customer revenue share²)
For shares of 40%, 30%, 20%, and 10%, the calculation is 0.4² + 0.3² + 0.2² + 0.1² = 0.30, or 3,000 on the 0–10,000 scale. A larger HHI indicates that revenue is more concentrated across the customers measured. HHI does not show which customer is largest, so use it alongside the largest-customer and top-five shares.
Disclosure is not a risk limit
Under U.S. GAAP, ASC 280 requires specified major-customer disclosures when revenue from one external customer reaches 10% or more of consolidated revenue. IFRS 8 has a similar 10% threshold for revenue from a single external customer. Details depend on the applicable accounting framework.
That 10% figure is a financial-reporting threshold, not a universal safe level or a rule that exposure below 10% is harmless. A customer with a smaller share may still be vital if it has a high profit margin, few substitutes, specialized products, or slow replacement options. Ask an accounting professional to confirm disclosure obligations.
Key takeaway: Measure the exposure consistently, group related customers where appropriate, and do not confuse a reporting rule with a business risk limit.
Portfolio Specifications: Exposure Metrics, Limits, and Reporting
Portfolio specifications are the agreed measures, limits, owners, and reporting steps used to track customer dependence. They should show how much business depends on each customer, how that dependence affects profit and cash, and what action follows when exposure rises. A useful specification defines both the calculation and the response.
A revenue-only view can hide serious weaknesses. For each major customer, monitor:
- Largest-customer share and combined top-five share.
- HHI and the scale used to report it.
- Gross-margin contribution, which shows how much profit remains after direct costs.
- Receivables aging, which shows how long invoices remain unpaid.
- Contract end dates, renewal terms, and notice periods.
- Replacement time, including the time needed to find a buyer and shift capacity.
- Exposure by product, geography, and sales channel.
A customer may contribute a modest share of sales but a large share of profit. Another may pay slowly or buy a product that uses equipment the business cannot quickly redirect. Record these details next to revenue data.
Example of an internal escalation policy
There is no single customer-share or HHI ceiling that is safe for every business. Limits should reflect profit, debt obligations, customer switching costs, replacement time, and the ability to reduce expenses. The figures below are an illustrative policy choice for a fictional company, not an accounting or regulatory standard.
| Measure | Example alert | Example action trigger | Example response |
|---|---|---|---|
| Largest customer share | Above 20% | Above 30% | Review sales plan, renewal status, and replacement options |
| Top-five customer share | Above 60% | Above 75% | Set a diversification plan and report progress to leadership |
| HHI, 0–10,000 scale | Above 1,800 | Above 2,500 | Review customer mix and stress-test a major loss |
| Receivables from a major customer | Past agreed payment terms | Material overdue balance | Escalate collection and reassess credit exposure |
These sample bands may be too strict or too loose for a real business. A firm with stable, long-term contracts may accept a different revenue profile from a firm with short contracts and high fixed costs. Document why a limit fits the business, who approves exceptions, and what happens when a limit is breached.
A clear specification should name an accountable owner, such as the chief financial officer or sales leader. It should also set a reporting period, define how customer groups are combined, and list actions and deadlines for each escalation level.
Key takeaway: A limit is useful only when the business has defined how it is calculated, who watches it, and what steps follow a breach.
Risk Controls, Scenario Analysis, and Ongoing Monitoring
Risk controls are steps that reduce the chance or impact of customer loss, payment delay, or lower orders. Scenario analysis estimates what those events could do to revenue, profit, and cash. Together, they help managers move from a concentration score to a practical response plan.
Test loss, delay, and volume reduction
Do not test only the question, “What if we lose our biggest customer?” Also model a payment delay or smaller orders. Those problems can occur even when a contract remains active.
For Northline, assume annual revenue is $10 million and its largest customer provides $3 million. If that customer disappears, revenue falls by 30% before the business finds replacements. The actual effect on profit and cash depends on costs, payment timing, contract terms, and replacement sales.
Use a simple scenario table and replace the figures with the business’s own data:
| Scenario | What to change in the model | What to assess |
|---|---|---|
| Customer loss | Remove all sales from one major customer | Revenue gap, margin loss, unused capacity, replacement time |
| Payment delay | Extend payment time beyond normal terms | Cash available for payroll, suppliers, and debt payments |
| Lower order volume | Reduce orders by a chosen percentage | Break-even point, staffing needs, and ability to cut costs |
| Contract non-renewal | Stop sales after the contract end date | Notice period, transition costs, and time to secure new work |
Use realistic assumptions. For example, do not assume another customer can replace sales at once unless capacity, product requirements, and sales timelines support that claim. Run a severe but plausible case as well as a moderate one. Make assumptions visible, and update them when market or contract conditions change.
Build controls around the actual cause
If risk comes from a single buyer, broaden sales channels and develop customers in different sectors. If the issue is slow payment, set credit limits, review overdue invoices, and agree on clear payment terms. If a customer uses specialized production capacity, assess whether that equipment can serve other buyers.
Contract protections can also help. Review notice periods, cancellation rights, minimum purchase terms, price changes, and payment terms. These provisions do not eliminate risk, and their effect depends on the contract and applicable law. Have qualified advisers review important agreements.
Review metrics at least quarterly and after a major event, such as a large contract award, a customer merger, a payment default, or a sharp drop in orders. Compare actual results with limits. Record exceptions, the person responsible for action, due dates, and remaining risk. Management or the board should see unresolved high exposures.
Key takeaway: Stress-test more than total customer loss, then assign a person and deadline to each control.
Business Resilience Outcomes: Diversification, Retention, and Cash-Flow Protection
Business resilience is the ability to keep operating when a customer buys less, pays late, or leaves. Diversification can reduce dependence, but it is not simply a goal of adding more names to a customer list. The aim is to build a customer mix that supports reliable profit, cash flow, and workable operations.
A business with 100 small customers may still depend on one sales channel, region, or product. Segment exposure by customer group, product, geography, and channel to see whether risks overlap. For example, several buyers may all depend on the same industry or distributor.
Growth also needs care. Replacing a major customer with many low-margin sales may improve the concentration figures but weaken profit. Compare new-customer revenue with its margin, cost to serve, payment behavior, and sales cost. Retain valuable customers through sound service and communication, while avoiding a plan that relies on one relationship alone.
I would present a short dashboard to leadership with:
- Current largest-customer and top-five shares.
- HHI with its calculation scale.
- Margin and receivables exposure for major customers.
- Contract renewal dates and replacement estimates.
- Scenario results, active exceptions, and mitigation owners.
That format connects the numbers to decisions. It helps leaders decide whether to invest in new sales, reduce fixed costs, change credit terms, or prepare for a contract ending.
Key takeaway: The goal is not to eliminate major customers. It is to understand the dependence, set a level the business can withstand, and prepare for change.
Frequently Asked Questions
What is customer concentration risk?
It is the risk that losing, delaying, or reducing business with a small number of customers could significantly harm a company’s revenue, profit, or cash flow.
How do I calculate a customer’s revenue concentration?
Divide revenue from that customer by total revenue for the same period. State how you treat related companies, returns, discounts, and pass-through sales.
What does HHI mean in customer concentration?
HHI adds the squared revenue shares of all customers. A higher result means revenue is more concentrated, but HHI should be read alongside the largest-customer and top-customer-group shares.
Is a 10% customer share considered unsafe?
No. The 10% threshold under U.S. GAAP ASC 280 and IFRS 8 relates to specified disclosures, not a universal risk ceiling. A smaller share can still be critical.
What is a safe customer concentration percentage?
There is no universal safe percentage. A suitable internal limit depends on margins, cash needs, contract terms, replacement time, and the business’s ability to cut costs.
Why measure top-five customer concentration?
A top-five total shows whether dependence is spread across several large buyers or concentrated in a few. It can reveal exposure that the largest-customer figure alone misses.
How often should a business review customer concentration?
Review it at least quarterly and after material events, such as a major contract change, customer merger, default, or sharp order decline.
Can a business reduce concentration risk without losing a major customer?
Yes. It can grow other sales channels, markets, or customer groups while retaining the major account. It should check that new sales support profit and cash flow, not just revenue.
What should a customer concentration report include?
Include revenue shares, top-five share, HHI and its scale, margin contribution, receivables aging, contract dates, stress-test results, policy limits, owners, and actions.
What is the main mistake when assessing customer concentration?
Treating revenue share or the 10% disclosure threshold as the whole risk picture. Profit, payment behavior, substitutes, contract terms, and replacement time matter too.
(This article was written by one of our staff writers, Nathan Sterling. Visit our Meet the Team page.)
