info Visit the New & Improved Industry Insider!
You’ll find more insightful and valuable content in a fresh, new layout.
Visit Now
United States / Analyst Insights
Concentration Risk is Real and Deadly

What information do you want to see from IBISWorld on COVID-19? We'd love to hear from you

by Rick Buczynski, Ph.D.
Jan 04 2014

As originally published in The RMA Journal

During the recent crisis, banks of all sizes suffered losses as a result of real estate concentrations that were not captured with traditional asset-quality metrics. All segments—commercial and industrial, commercial real estate, and consumer lending—were affected. Today, the industry and regulators alike are honing analytical techniques and tools such as stress testing, scenario analysis, and early warning systems to address shortcomings in concentration risk management. Indeed, it is widely recognized that a bank’s early warning system is the key to avoiding the next financial crisis.

Banks’ current methods for managing concentrations suffer from four deficiencies:

  1. Few systems adequately confront concentrations, espe­cially in the mapping of latent risks and in developing meaningful stress testing and scenario analysis tools.
  2. Stress testing and scenario analysis tools are not being linked with early warning systems to better manage concentrations. Instead, stress testing and scenario analysis are focused on assessing the probable dam­age of the next crisis rather than preventing it. There is more to the world than capital planning.
  3. Few banks place these tools and the management of concentration risk within an ERM function. Doing so would provide a better understanding of the com­plexity of concentration risk across the enterprise and ensure that risks are communicated quickly to senior management.
  4. Few applications use these tools to find new business opportunities.


This article discusses best practices in measuring con­centration risk, in performing stress testing and scenario analysis, and in building early warning systems. It shows how these important tools, instead of being siloed within a bank, can be used individually and collectively to manage concentration risk. Data collection, risk identification, and stress testing should support the early warning systems, while providing a resource for business development.fig 1

Figure 1 uses blue arrows to link the four pillars of bank functionality. Feedback links (the red arrows) are basic iterative “learning loops” that are based on both quantitative and qualitative exchanges of information and data. Right-side-brain readers might call this “collective intelligence,” while left-siders might prefer “artificial intelligence.” It is actually both. In the background are backroom credit MIS/loan accounting systems employed to facilitate the process.

Concentration Risk

The RMA Journal and other industry publications have fre­quently examined concentration risk in light of the recent banking crisis. Regulators have also focused on portfolio concentrations. In September 2011, the Federal Reserve’s Inspector General attributed the failure of smaller banks to poor strategic decision-making in pursuit of robust growth, as well as to asset concentrations tied to real estate and development loans. An FDIC study released in January 2013 supported this conclusion, singling out asset concentrations, poor underwriting, and deficient credit administration.

Without a good handle on concentration risk, a bank simply does not understand its business and becomes vulnerable to vagaries beyond its control. Risk manage­ment and business development should go hand in hand. Table 1 illustrates a simple pool mapping scheme of the four concentration risk categories across three segments of credit: consumer, commercial real estate (CRE), and commercial and industrial (C&I) loans. The first category is single-name concentration, probably the easiest for a bank to track. In this example, a bank has an exposure to ABC Corporation through a C&I line of credit and a CRE loan on the business property. The bank also holds a home mortgage for the owners of ABC Corporation. As long as the bank monitors this concentration and the risks associated with it, this would be a sound piece of business.table 1

In the second risk category—industry—the monitoring of exposures according to NAICS industries should be straightforward as long as data collection and coding sys­tems are up to par. However, banks don’t commonly link industry codes across loan segments. Here’s an example: When a tobacco plant in the South went under, its lender didn’t realize that it held a large number of mortgages and car loans of the plant’s workers. Talk about latent risks!

The third risk category is common factors (factor analysis). For example, certain borrowers and loans are more sensitive to interest rates than others. Obviously, the threat of considerably higher rates has a profound effect on all three business segments. These relationships must be analyzed and mapped (a notion that will be discussed further in the context of appropriately designing early warning systems and stress testing).

The final risk category that must be taken into account is other special factors relevant to a bank’s specific busi­ness and footprint. The most obvious examples are the geographic location of the obligors, the guarantors, and the collateral (especially real estate).  Additional risk factors that need to be considered are those associated with supply chains, which can lead to a morass of problems in a C&I book. The supply chain concept is an expansion and more accurate calculation of industry risk. Figure 2 depicts a hypothetical book of C&I business for a community bank. The red connectors indicate downstream linkages.

fig 2

Housing starts are the common risk factor in this ex­ample. Without proper mapping of C&I concentration pools and an understanding of a “heat map” that identifies potentially latent risks correlated to downstream demand, disaster awaits. Clearly, a supply chain weaves an intricate web, but understanding these interconnections is essential for engineering meaningful early warning systems and conducting relevant stress tests. To capture the various types of concentrations, a com­munity bank will need to use a number of different loan system and credit MIS markers for each loan.

Early Warning Systems

Banks commonly employ early warning systems (EWS), but they are often housed in silos. Yet, an EWS, in con­junction with stress testing, can help a bank develop more effective concentration limits. There are two types of indicators: external risk indictors (ERIs) and internal performance indicators (IPIs). ERIs refer to external (macro) factors that are outside of a bank’s control. They include such variables as interest rates, eco­nomic growth, commodity prices, foreign exchange rates, and government policy.

ERIs also include structural factors such as the rapid introduction of new technologies. IPIs represent internal bank indicators such as delin­quencies, loan-to-value ratios, margins, and loan excep­tions. Managed (or mismanaged) by the banks themselves, IPIs provide a high-level overview of the institution’s performance. Similar to ERIs are the Treadway Commission’s Com­mittee of Sponsoring Organizations key risk indicators (KRIs).1 Organizations use KRI metrics to obtain an early signal of emerging risks and increasing risk exposures in various areas of the enterprise.

External Risk Indicators: C&I

tab 2Table 2 provides a simple architecture for monitoring external risk indicators with C&I early warning systems. Risk profiles for every North American Industry Clas­sification (NAICS) industry in a bank’s C&I portfolio are determined by several categories of ERIs:

  • IBISWorld/RMA Risk Rating Index2: This multi­layered index contains numerous external economic/ demographic drivers, including those stipulated in Fed stress tests, plus downstream demand (supply chain) linkages. The index is forward looking (two years), incorporating macroeconomic and other key assump­tions. The rating is industry specific since performance drivers vary from industry to industry. For example, higher oil prices may benefit some industries, harm others, and have little impact on those that can pass through costs to their customers.
  • IBISWorld/RMA Structural Risk Index: This metric is, in part, based on Porter’s Five Forces and focuses on industry attributes such as the degree of competition within an industry, barriers to entry, level of volatility, and industry life cycle. Structural factors tend to change slowly over time, but when they do change, the effects can be abrupt and hard to predict, rendering historical quantitative analysis irrelevant. (Think financial and health care reform.)
  • Stress-Test Rank Ordering: This numeric rank-orders the highest historical IBIS/RMA Risk Rating going back 10 years. The ranking can be viewed as a de facto stress test, and many lessons can be learned by ranking indus­tries during their darkest hours. An alternative to this metric could be an industry’s default or loss rate during the Great Recession as revealed by a bank’s internal data.

This list of ERIs is not exhaustive and can be augmented by other factors such as the OCC’s peer analysis data and/ or other rating system data. Moreover, industry granular­ity is crucial.

External Risk Indicators: Consumer, Small Business, and CRE

ERIs are far different for consumer/small business and for commercial real estate lending. Table 3 offers a non-exhaustive list of suggested ERIs for these segments. The relative importance of ERIs on consumer loans may vary by type of credit (home equity, mortgage, consumer loan, credit card, etc.). Also, the type of CRE property may require additional factors to be taken into account. Examples would include hotels (domestic and interna­tional travel statistics); shopping centers (financial stabil­ity of the anchor store); industrial parks (occupants by industry); office towers (employment growth in regional white-collar businesses); and theaters (number of children under the age of 18).table3

Internal Performance Indicators

Just like ERIs, internal bank data included in key per­formance indicators must capture, monitor, and analyze the following:

  • Loan underwriting and policy exceptions.
  • Loan-to-value (LTV) ratio.
  • Debt-to-income ratio.
  • Cash down-payment or cash equity.
  • Margins and fees.
  • Delinquencies.
  • Charge-offs.
  • Growth of exposure against concentration and other imposed limits.

Ideally, the performance indicators are compiled with data on each business segment (consumer, small business, CRE, and C&I) and with as much data granularity as possible. The higher the degree of granularity by segment, region, and perhaps even loan vintage, the more germane the analysis:

  • Loan policy exceptions are extremely significant. Banks develop credit policies based on past experience in the hope they will be able to avoid previous errors and make profitable, prudent loans. Deviations from those policies generally lead to increased risk that can turn into problem loans and losses.
  • LTV and debt-to-income ratios are commonly used metrics, as are cash down-payments (consumer) or cash equity (CRE and C&I). Margins and fees are traditional gauges of performance, although astute bankers will track the waiver of fees on loans, deposits, and other services as a way to ensure a degree of discipline among the branch managers and to aid in earnings forecasts.
  • Tracking delinquencies over time provides predictive power. Charge-off data is postmortem; the train is al­ready off the tracks, the parrot is dead.

Further, the last bullet inextricably links EWS with concentration risk pools. By comparing the movement of actual exposures to limits imposed by concentration and/ or other bank policies, banks would have another solid signal of whether rules were being followed. We believe EWS indicators can help in developing more precise con­centration limits and in monitoring those limits.

How Can Your Bank Apply Early Warning Systems?

The level of sophistication in applying EWS can vary widely from bank to bank, depending on the institution’s asset size and credit culture. For the quantitatively in­clined, such systems have been used to drive C&I obligor scorecards and/or pricing models.

Qualitative applications are more commonplace be­cause many banks build large matrices that integrate numerous ERIs and IPIs appropriate to their business. They can review that collage of data on a regular basis to monitor risk and uncover opportunities for business development. Industries with medium but increasing risk might be put on hold if exposure limits are being reached. Conversely, segments with high but decreasing risk might be targeted for expansion as long as the risk can be assessed and priced accordingly.

Stress Testing Is Not Just for CCAR or Dodd-Frank Banks

Stress testing is not limited only to banks with assets great­er than $10 billion. For many years, community banks have conducted stress tests for interest rate and liquidity risks. Recently, the OCC suggested that community banks use scenario analysis to evaluate risks. Similarly, in the summer of 2012, the FDIC emphasized the value of stress testing credit portfolios in community banks and provided a detailed methodology for doing so.

fig 3Figure 3 offers a basic schematic of a credit stress test­ing. The flowchart employs the same external risk indica­tors presented in Tables 2 and 3 in our earlier discussion of EWS. Remember, at its core this must involve con­centration risk analysis, including potential correlations between business segments. Other ERI factors could have been added to this example. We recommend developing stress tests and scenario analysis around the most important EWS drivers to gain an understanding of the thresholds where management needs to act, especially for levels of concentration.

A Note on Enterprise Risk Management

We recognize that a community bank’s enterprise risk management (ERM) plays a valuable role in ensuring the effectiveness of data collection, along with the measure­ment and control of concentration risk. ERM can provide a central place for comprehensive data collection, helping to establish bank-wide standards and oversight. ERM can also provide the process for aggregating concentrations across business lines and even risk types such as interest rate and operational risk. Most importantly, ERM can provide the communication channels for timely reporting of concentra­tion risk and give early warning signs to all relevant business lines, risk managers, and senior management.


In the aftermath of the financial crisis, industry practitioners, regulators, and politicians are continuing their search for answers. Although many high-quality tools and practices have been developed, and efforts have been made to amend substandard laws and regulations, many underlying problems are going unaddressed. There is too much emphasis on managing the effects of the next crisis when the focus should be on managing concentration risk to prevent the next crisis.

A good sign can be found in a relatively obscure OCC supervisory guidance on community bank stress testing3 (October 2012) that wisely links the obvious but often unrecognized interrelationship between stress testing and concentration pools. The guidance states, “If the stress test reveals critical vulnerabilities, management and the board should take steps to mitigate those risks through such means as modifying loan growth, revising the risk tolerance strategy, adjusting the portfolio mix and un­derwriting criteria, altering concentration limits or other policies and procedures, and strengthening capital.” We couldn’t agree more.

The keys to success are as follows:

  • Improve the collection of concentration data to ensure the bank doesn’t underestimate its exposures.
  • Use stress testing and scenario analysis tools to build early warning indicators that will set off alarms long before the crisis hits.
  • Apply these tools to find other business opportuni­ties and reduce the bank’s dependence on existing concentrations.
  • Develop ERM processes that ensure comprehensive data-collection efforts supported by timely early warn­ing signs.

The pieces to the puzzle are in front of us. It’s time to build a new and more effective business development and risk management engine.

Rick Buczynski, Ph.D., is senior vice president and chief economist at IBISWorld Inc. He can be reached at Robert Kennedy recently retired from the Federal Reserve Bank of Atlanta after a 28-year career in various management and technical positions in bank supervision. He can be reached at arrowheadstar@gmail. com. The authors thank Dev Strischek of SunTrust Banks for comments on an earlier draft of this article.