ベンダー集中リスク
Vendor Concentration Risk / ベンダー・コンセントレーション・リスク
Vendor Concentration Risk is the exposure created when too much critical capability, spend, data, or recovery dependency sits with one supplier or supplier cluster. It is used for when to diversify, add fallback capacity, renegotiate, insure, or accept the exposure by reading single-source dependency, spend share, switching time, data exit cost, and supplier failure impact and deciding when to diversify, add fallback capacity, renegotiate, insure, or accept the exposure.
Vendor Concentration Risk is not a dictionary label; it is a practical concept for improving operating, risk, and organization decisions. It makes single-source dependency, spend share, switching time, data exit cost, and supplier failure impact visible under shared assumptions so teams can decide when to diversify, add fallback capacity, renegotiate, insure, or accept the exposure. Without clear vendor concentration risk boundaries, owners, and review cadence, teams can improve one local view while moving vendor concentration risk pressure elsewhere.
Keep the inclusion and exclusion rules stable so decisions can be compared over time. Include | critical service dependency, spend share, data portability, switching path | These determine how severe supplier failure would be Exclude | low-impact commodity spend, replaceable subscriptions, one-time purchases | They may look concentrated but not threaten operations Define explicitly | single point of failure, exit plan, fallback vendor, contract leverage | The response depends on what kind of concentration exists
| Item | Treatment | Why it matters |
|---|---|---|
| Include | critical service dependency, spend share, data portability, switching path | These determine how severe supplier failure would be |
| Exclude | low-impact commodity spend, replaceable subscriptions, one-time purchases | They may look concentrated but not threaten operations |
| Define explicitly | single point of failure, exit plan, fallback vendor, contract leverage | The response depends on what kind of concentration exists |
Breaking the topic into drivers shows which operating action is likely to move the result. Switching time | Longer switching time raises continuity exposure | Use tested migration effort, not vendor claims Data lock-in | Hard exits reduce negotiating and recovery options | Check export, format, and ownership rights Supplier health | Weak vendor finances or operations increase failure probability | Review signals before renewal
| Driver | Metric impact | What to watch |
|---|---|---|
| Switching time | Longer switching time raises continuity exposure | Use tested migration effort, not vendor claims |
| Data lock-in | Hard exits reduce negotiating and recovery options | Check export, format, and ownership rights |
| Supplier health | Weak vendor finances or operations increase failure probability | Review signals before renewal |
Vendor Concentration Risk changes decisions by turning single-source dependency, spend share, switching time, data exit cost, and supplier failure impact into evidence for where scarce capacity and budget should go. It sets boundaries so improvement, control, resilience, and customer impact can be weighed in the same review. It makes when to diversify, add fallback capacity, renegotiate, insure, or accept the exposure operational by naming owners, triggers, and review cadence instead of leaving the concept as a discussion point.
- Vendor Concentration Risk changes decisions by turning single-source dependency, spend share, switching time, data exit cost, and supplier failure impact into evidence for where scarce capacity and budget should go.
- It sets boundaries so improvement, control, resilience, and customer impact can be weighed in the same review.
- It makes when to diversify, add fallback capacity, renegotiate, insure, or accept the exposure operational by naming owners, triggers, and review cadence instead of leaving the concept as a discussion point.
- Map critical vendors by service impact, not only annual spend.
- Estimate realistic switching time and data exit effort.
- Separate commercial concentration from operational recovery concentration.
- Review concentration before renewals, architecture decisions, and expansion plans.
- In every Vendor Concentration Risk review, record the customer impact, risk tradeoff, accountable owner, and next review date alongside the metric movement.
A company discovers that its customer identity, billing export, and incident notification all rely on one vendor. The vendor spend is moderate, but switching would take months. The team funds data export automation and a tested fallback for notifications before the renewal. In this example, Vendor Concentration Risk is treated as an operating decision that connects constraints, ownership, measurement, and review, so the team can reassess the change using the same evidence later.
Procurement strategy | Chooses sourcing and commercial approach | Vendor concentration risk tests whether the approach leaves critical exposure Supplier relationship health | Assesses ongoing supplier partnership | Concentration risk focuses on dependency severity and exit options Enterprise risk management | Prioritizes material risks | Vendor concentration is one operational and strategic exposure inside ERM
| Metric | Difference | Why read together |
|---|---|---|
| Procurement strategy | Chooses sourcing and commercial approach | Vendor concentration risk tests whether the approach leaves critical exposure |
| Supplier relationship health | Assesses ongoing supplier partnership | Concentration risk focuses on dependency severity and exit options |
| Enterprise risk management | Prioritizes material risks | Vendor concentration is one operational and strategic exposure inside ERM |
- Low price can increase risk when the vendor becomes hard to replace.
- A second contract is not a fallback if it has never been tested.
- Concentration can hide in data, identity, logistics, or specialized knowledge, not just spend.
Is concentration always bad?
No. It can be acceptable when impact is low, controls are strong, and the exit plan is realistic.
What is the best first metric?
Start with critical service dependency and switching time; spend share alone is not enough.
How do we reduce concentration?
Use dual sourcing, tested fallback paths, data portability, contract rights, or explicit risk acceptance.