GRCLibrary.ai

Register

Concentration Risk Register

This register records the concentration of supplier dependencies across the supplier portfolio. It identifies single points of failure, shared dependencies, geographical clusters, and regulatory or geopolitical concentrations that would cause cross-portfolio impact if a concentrated dependency fails. For DORA, it supplies connected-provider and single-supplier concentration indicators as an input to the financial entity's Article 29(1) consideration, which the entity performs outside the register, and, where a concentration subject is a designated critical ICT third-party provider, it records a link to that designation, without applying the designation criteria; it also supports the broader supplier risk programme.

Type
Register
Version
1.0.23
Date
2026-10-29
Owner
Supplier Risk Maintainer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Supply Chain Governance
Review frequency
Quarterly and upon material supplier portfolio, geopolitical, or regulatory change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • Scope
  • Concentration dimensions
  • Register schema
  • Operating expectations
  • Treatment options
  • Coordination with the critical ICT third-party regime
  • Metrics
  • Framework alignment
  • Limitations

Frameworks it maps to

Related documents