Lesson 1.57: Concentration risk: when many risks share one cause
Risk registers usually list scenarios one by one, as if they were independent. Often they aren't: if one cloud region, one software supplier or one identity provider fails, several 'separate' risks happen at the same moment and their losses add up. This is concentration risk, and regulators such as DORA in EU finance now require firms to monitor it. In the lab you map Northwind's services to providers, find the provider most services depend on, see three register scenarios that are really one event, compute the combined loss and compare it with the risk appetite.
18 min
You will learn to
- Explain concentration and correlated risk
- Map services to providers and count dependencies
- Find register scenarios that share a cause
- Compute the combined loss of a common-cause event
- Recommend diversification and exit planning
Key terms
- Concentration risk
- Many important services depending on the same provider, location or component.
- Correlated losses
- Losses that tend to happen together because they share a cause.
- Common-cause failure
- One event causing several failures at once.
- Exit plan
- A tested way to move off a provider within an acceptable time.
- DORA
- EU Digital Operational Resilience Act for financial entities, applicable since 17 January 2025.
← Maturity profiles and a security roadmap · All lessons · Fewer, better-used tools →