Measuring customer concentration risk for technical suppliers

Customer concentration is not a vague worry that one account is too big - it is a measurable exposure with three layers you can compute from your own ledger: revenue share, a portfolio concentration index, and margin-weighted exposure. The practical verdict for a technical supplier is to measure all three, because revenue share alone understates the risk when your largest accounts are also your highest-margin ones, and because a single number lets you manage the dependency down on purpose instead of worrying about it in the abstract.

This matters more in Mexico’s supplier economy than the topic usually gets credit for. According to INEGI’s 2025 Balanza Comercial de Mercancias, as reported in March 2026 by Heraldo Binario and by the Guanajuato Puerto Interior agency, the automotive industry alone accounted for 31 percent of Mexico’s manufacturing exports in 2025, worth more than US$185,791 million. Downstream of that headline sits a long tail of Tier-1 and Tier-2 suppliers whose entire order book is one, two, or three OEM relationships. The macro picture is itself concentrated: ConaLog, citing INEGI and AMIA for full-year 2024, reports that roughly 80 percent of Mexico’s vehicle exports go to a single destination, the United States. Firm-level concentration is the same risk in miniature.

What the disclosure rules actually require, and what they do not

Two US regimes get quoted loosely as “the 10 percent rule,” and they are not the same thing anymore. The one that still carries a hard number is US GAAP. Under ASC 280-10-50-42, as documented by Deloitte’s accounting research tool, if revenues from a single external customer reach 10 percent or more of a public entity’s revenues, that entity must disclose the fact, the amount, and the segment involved. That rule also tells you how to count a customer: a group of entities under common control counts as one, so two plants of the same OEM group are a single customer, not two.

The other regime moved. The SEC’s Regulation S-K once named a specific test. As a 2018 Cooley LLP client alert records, the old Item 101 required naming any customer that represented 10 percent or more of revenue and whose loss would have a material adverse effect. That numeric prompt was made principles-based in the 2020 amendments; the current text at 17 CFR 229.101, mirrored by Cornell Law School’s Legal Information Institute, speaks of “dependence on … a few major customers” with no percentage attached. So the still-numeric 10 percent line lives in the accounting standard, not in the current SEC disclosure item.

None of this binds most readers directly. Private companies are not subject to SEC Item 101 at all, and ASC 280 applies only if you issue GAAP financial statements with segment reporting, which most privately held suppliers do not. Treat the 10 percent figure as the level at which a public-company accountant would flag your book, not as a legal duty of your own. This article is analysis, not legal or accounting advice; confirm applicability with your own auditor or counsel.

The framework: five layers, from arithmetic to judgment

Run these five steps in order. The first two are cited external methods; the last three are this publication’s suggested practice, labeled as such, not an industry standard.

Start with the arithmetic the Corporate Finance Institute states plainly: customer concentration percentage equals revenue from a customer divided by total revenue. Compute it for your single largest account, your top three combined, and your top five combined, over a trailing twelve months. This is the same math behind the GAAP 10 percent threshold above, so it doubles as the number an outside accountant would notice. Use the common-control rule when you aggregate: bill the same corporate parent through three purchase orders and it is still one customer.

2. Customer-book HHI

Revenue share tells you the size of the biggest slices; it does not tell you how lopsided the whole book is. For that, adapt the Herfindahl-Hirschman Index. The formula, as MetricGate documents it, is the sum of the squares of each participant’s percentage share: HHI equals the sum of s-squared. As a simple illustration, four shares of 30, 30, 20, and 20 give 2,600. Applied to a customer book, a supplier with customers at 40, 30, 20, and 10 percent scores 1,600 plus 900 plus 400 plus 100, or 3,000; a supplier with ten roughly equal customers scores near 1,000. Higher means more lopsided.

One caution has to be explicit. HHI is an antitrust tool for whole markets. In the 2023 Merger Guidelines, as summarized by Stinson LLP, the DOJ and FTC treat a market above 1,800 as “highly concentrated” - a figure calibrated for merger review, replacing the 2010 threshold of 2,500. No regulator has issued HHI bands for a single firm’s customer list. So use customer-book HHI as a relative gauge across your own years and against your own targets. Do not present it as if 1,800 were an official customer-concentration cutoff; it is not.

3. Margin-weighted exposure

This is the layer most write-ups skip, and it is the one that changes decisions. Weight each customer’s share by its contribution margin, not by revenue. A customer at 25 percent of revenue sold near cost may be less of a real loss than a customer at 15 percent of revenue carried at a 40 percent margin, because what walks out the door if they leave is profit, not turnover. Recompute your top-1, top-3, and top-5 on a margin basis and compare the two rankings. Where the margin ranking is more concentrated than the revenue ranking, your true exposure is worse than the revenue headline suggests. No external body publishes a “standard” margin-weighting method; this is the piece’s own analytical step.

4. Qualitative dependency map

Numbers set the priority; the map tells you where the relationship is actually fragile. For each customer above your action threshold, record five things: whether the relationship rests on a single named point of contact, the contract term and its renewal or notice dates, any exclusivity or most-favored-customer clauses, tooling or certification lock-in (common in automotive supply, and a two-way lock), and payment-term concentration. Two customers at the same revenue share are not equal risks if one is a three-year contract with staggered renewals and the other is a rolling purchase order that can lapse with 30 days’ notice. This is operational judgment, not a cited standard.

5. Action thresholds

Set thresholds - but state honestly that no standard exists, because the practitioner sources disagree by a wide margin. The Corporate Finance Institute describes a top-five share under 25 percent of revenue as low concentration and a top-five share above 50 percent as high. M&A advisor FOCUS Investment Banking writes that above 20 percent of sales draws detailed buyer review, above 30 percent leads many buyers to decline outright, and above 40 percent requires the rest of the deal to compensate. CT Acquisitions offers yet another set of bands: under 10 percent diversified, 10 to 20 moderate, 20 to 30 high, above 30 critical. The threshold treated as decisive runs anywhere from 10 to 50 percent, depending on which publisher is writing.

A defensible starting point, offered as a suggestion and not a rule: treat any single customer above 20 percent of margin-weighted exposure, or a customer-book HHI trending upward year over year, as a review trigger - then decide with the dependency map, not the number alone. The counterexample matters. FOCUS reports having sold manufacturing businesses with customer concentrations up to 85 percent, at a premium multiple, when contract quality and relationship durability supported it. Concentration is priced in context. For a Mexican supplier whose business model is legitimately one or two OEM relationships, contract structure and switching costs can matter more than the raw percentage.

What buyers and lenders do with the number

The reason to compute this before anyone asks is that outsiders will compute it for you, and their adjustments are large and informal. FOCUS cites valuation reductions on the order of 20 to 35 percent for concentrated deals. CT Acquisitions describes EBITDA discounts in a 15 to 40 percent range and gives an illustration: on a business valued at a 6x multiple, a 25 percent concentration discount can move the purchase price by a wide margin. These are opinions from firms that sell M&A advice, not standards, and they contradict each other - which is exactly why the number is worth owning yourself. A concentration you have measured, mapped, and contracted around is a story you tell the buyer or lender; one they discover in diligence is a discount they apply to you.

What to do this week

Pull twelve months of revenue by customer, aggregate by corporate parent, and compute the three revenue shares and the customer-book HHI. Add contribution margin per customer and recompute the shares on a margin basis. For every account over your review trigger, fill in the five-point dependency map. The output is one page: two rankings, one index, and a short list of the relationships whose contract terms do not match their importance. That page is the input to a diversification plan, a contract renegotiation list, or a receivables-insurance decision - and it is the kind of exposure a structured commercial diagnostic is built to surface before a buyer, a lender, or a lost account does it for you.