Third-party risk isn’t a spreadsheet problem

I keep seeing third-party risk registers that are technically complete and practically useless. Every supplier logged, every field filled in, every review date up to date. Nobody in the room, though, can tell you which three suppliers — if they failed simultaneously — would actually stop the business.

Concentration risk isn’t about counting vendors. It’s about understanding what breaks together.

A five-minute exercise worth trying with your own team: pick your three most critical ICT services. Ask who else depends on the same underlying provider beneath them — the same cloud region, the same payments rail, the same single piece of infrastructure three “different” suppliers all quietly sit on. The answer is often more concerning than the register on its own suggests, and it’s exactly the kind of concentration risk DORA’s third-party provisions (Chapter V) were written to surface.