What Is Concentration Risk? a Practical Guide for CFOs

A familiar version of growth looks healthy on paper. One client expands, keeps renewing, and becomes a meaningful share of billings. The leadership team feels confident because revenue is strong, the relationship is established, and the pipeline can wait another quarter.

Then that client slows approvals, stretches payment timing, or pauses a project. Nothing has “gone wrong” operationally inside your firm, but cash gets tight fast. DSO rises, collections gets awkward, and finance starts managing around one account instead of running the whole receivables book.

That's where concentration risk stops being an abstract finance term and becomes an operating problem. For a professional services firm, it often sits inside accounts receivable long before it shows up in a board deck.

The Hidden Threat in Your Client Roster

If you're asking what is concentration risk, the cleanest answer is this. It's over-reliance on too few sources of revenue, cash, or operational stability.

For a services firm, the most dangerous version usually isn't in an investment portfolio. It's in the client roster. One large account can become a single point of failure for billing, collections, and working capital.

Why this shows up in AR before it shows up in strategy

The link between revenue concentration and DSO is easy to miss. Most discussions frame concentration risk as a portfolio issue, but that misses what happens in practice when one customer represents 30%+ of revenue and payment behavior changes. That creates a single point of failure for cash flow and can directly inflate DSO, even when the rest of the client base is paying normally, as noted in this discussion of concentration risk and revenue dependence.

That matters because DSO is an average. A single oversized client can distort the average enough to make the whole receivables book look weaker than it really is. Or worse, it can make the book look stable until one account stalls and the month misses cash.

Practical rule: If one client can materially change your borrowing, payroll timing, partner distributions, or hiring plan by paying late, you have concentration risk.

What it looks like inside a professional services firm

In firms between $3M and $50M, concentration usually hides behind perfectly reasonable business logic:

• “They're our anchor client.” The account funds headcount and gives the team confidence.
• “The relationship is strong.” That may be true, but strong relationships don't eliminate budget freezes or procurement delays.
• “We can manage the timing.” Usually that means finance is carrying the volatility manually.

A useful way to think about it is simple. Revenue concentration becomes AR concentration the moment your collection calendar depends on a handful of client decisions.

For firms reviewing this issue, Stewart Accounting's perspective on avoiding customer concentration is worth reading because it connects dependency risk to the practical realities of running a small or mid-sized business, not just theory.

The Four Faces of Concentration Risk

Concentration risk rarely comes in one form. In a services business, it tends to show up across four areas at once.

Customer concentration

This is the most obvious form. A small number of clients account for a large share of revenue or receivables.

If one client represents a large portion of billings, every slowdown hits multiple lines at once. Cash collection. Utilization planning. Staffing decisions. Forecast confidence.

Regulatory guidance on vendor concentration treats providers covering more than 30% to 40% of critical functions as worth scrutiny. That's a useful parallel for client concentration too. When one client accounts for a similar share of revenue, failure risk can cascade across the business, as discussed in this review of vendor concentration risk thresholds.

Industry concentration

A firm can have many clients and still be concentrated if most of them sit in the same sector.

An accounting advisory firm with a client book heavily weighted toward commercial real estate may look diversified by logo count. It isn't diversified if the same economic pressure affects most of those clients at the same time. That's where “diversified” portfolios disappoint finance leaders. The names differ, but the risk driver is shared.

A broad client list doesn't help much if the same market shock affects all of them together.

Geographic concentration

Some firms depend too heavily on one city, state, or region. That works until local conditions shift.

A consulting firm tied to one metro area may feel stable because it serves many accounts. But if that region experiences regulatory disruption, weather events, labor pressure, or a local industry slowdown, AR quality can deteriorate in clusters. Collections feels this first. Invoices age together because clients are reacting to the same outside factors.

Product or service concentration

This version is often overlooked because it sits inside your own offering mix.

A law firm, agency, or outsourced finance practice may rely too much on one service line. If most revenue comes from project work, audit support, implementation, or one retainer model, a change in demand or pricing pressure can hit the entire firm. The same issue appears when one flagship service is easy for clients to defer.

Here's the practical test:

• Customer: Would losing one account change your cash plan immediately?
• Industry: Do many clients share the same economic exposure?
• Geographic: Are collections clustered in one region?
• Product or service: Does one offering carry too much of the firm's economics?

How to Measure Your Firm's Exposure

Most firms can sense concentration risk before they can measure it. Sensing isn't enough. You need a few numbers that tell you whether the issue is manageable, creeping, or already shaping cash flow decisions.

Start with revenue share

The first cut is simple. Calculate the share of total revenue held by your largest client, then your top few clients.

That won't tell you everything, but it gives finance and leadership a common language. If one account dominates current billings or open AR, you can see the dependency quickly.

A practical table helps frame the conversation.

Risk Level	Single Client Revenue Share	Implication
Lower	Smaller share relative to the rest of the book	A payment delay is easier to absorb operationally
Moderate	Meaningful share of revenue	Finance should monitor payment behavior and terms closely
High	Near or within the scrutiny range used as a parallel in concentration analysis	One client can materially affect cash flow, DSO, and planning

Use HHI for a better read

Simple ratios are helpful, but they miss shape. Two firms can both have a largest client at the same share and still have very different risk profiles.

That's why the Herfindahl-Hirschman Index, or HHI, is useful. It measures concentration by squaring each component's percentage share and summing the results, which gives a more nuanced view than a top-client ratio alone, as described in Moody's discussion of concentration measurement and HHI.

A simple example

Assume your firm has five client groups with revenue shares of 35, 25, 20, 10, and 10.

The HHI is calculated like this:

• 35²
• 25²
• 20²
• 10²
• 10²

Then add those results.

You don't need to turn finance into an academic exercise. The point is to compare periods and spot drift. If HHI rises quarter after quarter, concentration is increasing even if overall revenue is still growing.

For teams building out a more disciplined framework, these credit risk assessment tools are a useful complement because they help connect client dependence to payment risk, not just revenue mix.

Stress test the AR book

Numbers alone won't protect cash. You also need scenario thinking.

Ask questions like:

• Largest client delay: What happens if the top client pays late for one billing cycle?
• Dispute scenario: What happens if a major invoice is held in procurement review?
• Sector event: What happens if several clients in the same niche slow payments together?
• Retainer reduction: What happens if your largest monthly account cuts scope unexpectedly?

The most useful stress test isn't “Could we survive losing this client?” It's “What happens to cash if they simply start paying slower?”

Those questions usually surface real issues fast. Line usage. Partner draws. Hiring delays. Vendor stretch. Pressure on the AR team to chase exceptions manually through email and spreadsheets.

What to review every month

A workable monthly review for a Controller or CFO includes:

• Top client share: Revenue and open AR concentration by client
• Aging exposure: Whether older balances are clustered in a small group of accounts
• HHI trend: Quarter-over-quarter movement in client concentration
• Terms discipline: Whether your biggest clients also have your loosest billing and payment terms

If the largest clients also have the longest approval chains, weakest contract structure, or most inconsistent billing documentation, you don't just have concentration risk. You have concentration risk with collection friction layered on top.

The Direct Impact on Cash Flow and DSO

The operational damage from concentration risk usually arrives through timing, not catastrophe. A key client doesn't need to default to create stress. They only need to pay slower.

How one account skews the whole picture

A concentrated client book changes the meaning of DSO. The average may rise because one major customer is dragging the number up, while the rest of the book is healthy. Or the average may look fine right until a large invoice tips past due and the month turns.

That's why DSO needs to be read alongside customer mix. If you want a clean refresher on the mechanics, this guide on what DSO is and how finance teams use it is a practical reference.

The pain shows up in sequence:

• Cash gets less predictable. Treasury starts planning around specific client remittance dates.
• The line of credit becomes a bridge. Not for growth, but for timing.
• Collections gets politicized. Teams hesitate to press a major client because the relationship feels too important.
• Operations feels it next. Hiring, subcontractor payments, and partner distributions become conditional.

Why AR teams feel the strain first

AR teams don't experience concentration as a theory. They experience it as exceptions.

One large client has custom billing rules. Another requires a purchase order change. Another won't release payment until a project manager approves a detail. As these exceptions stack up, the team spends more time managing one relationship than governing the whole receivables process.

For firms trying to tighten discipline, these actionable cash flow management tips are useful because they keep the focus on daily operating control, not just high-level planning.

When one client becomes the explanation for every cash shortfall, the issue isn't collections effort. It's concentration.

Practical Strategies for Mitigation and Monitoring

The answer to concentration risk isn't panic diversification. It's better structure, clearer thresholds, and tighter monitoring.

Mitigation that actually works

The first move is commercial, not technical. Reduce the chance that one client can dictate your cash profile.

• Set exposure limits: Put a written threshold in place for client concentration. Vague language doesn't help. Finance, sales, and leadership need a number or a range that triggers action.
• Change contract structure: Use retainers, milestone billing, deposits, or shorter billing intervals where the relationship allows it.
• Tier credit and terms: Your largest exposures deserve the strongest underwriting and the most disciplined invoicing process, not the loosest terms.
• Broaden service mix: If one service line dominates, build adjacent offerings that spread demand and smooth billing cycles.
• Protect documentation quality: Large clients often have the most complex billing workflows. Tight statements of work, clean approvals, and accurate invoices matter more here than anywhere else.

One useful finance habit is to combine business development goals with risk goals. Not “grow revenue” in the abstract, but “grow revenue in ways that reduce dependency.”

For owners who want a straightforward outside perspective, EndureGo Tax has a practical piece on managing your small business's cash flow that aligns well with this discipline-first approach.

Monitoring that gives you control

Most firms still monitor concentration with static month-end reports. That's too late for AR.

Modern accounts receivable automation changes the job from backward-looking reporting to active control. AR automation software with predictive analytics can forecast payment behaviors and identify potential defaulters proactively, while real-time dashboards can continuously track metrics such as DSO and CEI, as outlined in this overview of AR automation capabilities.

That's where AI AR automation becomes practical, not trendy. It helps teams answer questions that matter operationally:

• Which large accounts are slowing down right now
• Which invoices are most likely to drift past expected payment timing
• Where disputes, broken workflows, or inconsistent follow-up are adding delay
• Whether concentration risk is getting worse even while revenue is increasing

What to put on the dashboard

A useful dashboard for a professional services firm should show:

• Top client concentration: Revenue and open AR by client
• Aging by major account: So one oversized slow payer doesn't hide inside a blended number
• Promise-to-pay follow-through: Especially for strategic accounts
• Payment behavior trend: Whether a client is consistently slipping
• Billing accuracy exceptions: Credits, disputes, rejected invoices, and rework
• Collections effectiveness: Alongside DSO, using CEI and related operational views

If you're evaluating process discipline more broadly, these credit risk management best practices provide a solid checklist for building governance around client exposure, terms, and follow-up.

Where QuickBooks AR automation fits

Many firms in this size range start with QuickBooks AR automation because it's the natural next step from spreadsheet-based follow-up.

That can work if the goal is basic visibility and reminder consistency. It won't solve concentration risk on its own. The key is whether your system can segment major accounts, flag behavioral changes early, and support action before DSO drifts.

The best AR software for professional services does three things well. It preserves relationship tone, improves invoice follow-through, and helps finance intervene before a strategic client becomes a cash event.

From Risk Management to Business Resilience

A resilient firm isn't the one with the prettiest diversification story. It's the one that knows where dependency sits, measures it accurately, and acts early.

That's the important correction to the usual advice. “Diversify to reduce risk” sounds right, but it's incomplete. Correlated defaults can affect even diversified portfolios, and stronger outcomes come from better underwriting, governance, and the ability to identify hidden concentration risks, not just wider exposure, as argued in this analysis of concentration and resilience.

What durable firms do differently

They don't wait for a bad quarter to discover that one client controls too much of the cash cycle.

They build routines around visibility:

• Review concentration monthly
• Track major-account payment behavior continuously
• Tighten terms where exposure is highest
• Use automation to reduce lag between signal and action

That's how you reduce DSO without damaging relationships. It's also how you improve cash flow without relying on heroic collections work at month-end.

Good finance teams don't just collect cash. They design a receivables process that stays stable when a major client becomes unpredictable.

Concentration risk isn't just something to monitor. It's something to design around. Once you treat it as an AR problem, not only a strategy problem, the path to control gets much clearer.

---

Resolut automates AR for professional services. It helps finance teams reduce DSO, improve cash flow, and manage collections with consistency across billing, outreach, cash application, and risk identification. If you want a more controlled approach to receivables, Resolut is built to be consistent, accurate, and human.