Concentration risk is the risk posed to a financial institution by any single or group of exposures which have the potential to produce losses large enough to threaten the ability of the institution to continue operating as a going concern. In other words, it's the opposite of a diversified portfolio.
For example, an institution may have a concentration of loans in a certain geographic area. If that area experienced an economic downturn an unexpected volume of defaults might occur, which could result in significant losses to or failure of the institution. Or an institution may have a concentration in a certain type of lending, for example construction lending. If construction slows unexpectedly, the impact to the institution could be significant.
By their very nature community banks and credit unions have some degree of concentration risk; geographically, within their customer/member base, and by products they specialize in and offer. The smaller the geographic area served, the more limited the customer base is, and the fewer number of products offered all lead to increased concentration risk.
Concentrations can also exist in asset categories, such as residential real estate, automobiles, business loans, etc.), within asset categories, such as junior position home equity lines of credit within a residential category, indirect auto loans within an automobile category, or SBA loans within a business loans category, or as loan quality rating categories, such as a concentration of lower quality credits (loans).
Lastly, concentrations can exist in seemingly unrelated categories. A classic example is a financial institution that invests in mortgage back securities in its investment portfolio, while at the same time investing in mortgage loans in its loan portfolio.
Methods and systems of identifying concentration risk should be commensurate with the size of the institution, the levels of inherent concentrations, and the importance of the activity to the institution. The basic building block of a good identification system is the ability to store and access data. Systems should also apply some controls to help ensure the data is entered as accurately as possible. Information related to the attributes of the loans such as loan type, balances, limits, rates, dates; to the characteristics of the borrower; name, credit score, etc., and information related to the collateral such as address, value, and senior liens should be accessible for analysis.
If an institution does not have this data capability in house it should contract with a third party provider and of course, conduct proper due diligence on any such vendor to ensure confidential information is handled appropriately and the vendor is generally operating in a safe and sound manner.
The board of directors must establish policies which address concentration risk limits. The board should take into account company strategy, economic conditions, and net worth levels in setting such limits.
Most financial institutions will have limits or not to exceed thresholds for certain common concentrations, such as by lines of business, types/sectors of lending, geography, ratings/grades segments, and to a single borrower or related set of borrowers. These thresholds can be tracked as a percentage of the loan portfolio, the institution's total assets or the institution's net worth.
Once appropriate risk management systems and policies are in place, management should actively monitor concentration risk through the use of regular formal reporting. Larger institutions will probably find it beneficial to have a committee focus their attention and expertise on monitoring this reporting.
Management should also have a plan of action in place if concentrations levels approach or exceed established thresholds. For example:
Financial Institutions have a duty to not only understand concentration risk; what it is, how it is formed, and the risks it poses to their institutions, but also to prudently manage the risk. Furthermore, management is responsible for keeping the board up to date on concentration risks, which involves properly analyzing concentration data, regular reporting, and developing contingency plans.