Operational and concentration risk
Some losses do not come from prices moving. A computer system fails, a process breaks, or a firm finds out how much it depended on one customer or one counterparty. This lesson covers operational risk, using Delta Air Lines’ costly outage in 2024 and the way bank regulators set capital for it, and concentration risk, using the customer lists of Emerson Radio and Oil-Dri and the limit on how much a bank may lend to one borrower. A calculator shows what losing a big customer does to profit.
- Level
- Beginner
- Reading time
- About 26 minutes
- Know this first
- Liquidity risk and bank runs
By the end you will be able to:
- define operational risk and give examples of its causes
- compute the Basel business indicator component and the capital it implies
- explain concentration risk and measure it as a share of sales or of capital
- work out how losing a large customer changes operating profit
- apply the large exposures limits to a bank's Tier 1 capital
Losses that are not about prices
The earlier lessons in this module measured losses that come from markets: prices falling, interest rates rising, exchange rates moving, deposits leaving. This lesson covers two risks that come from the firm itself and from who it depends on. Operational risk is the risk of loss from failed processes, people or systems, or from outside events that disrupt them. Concentration risk is the risk that too much of the firm’s income, or too much of a bank’s lending, rests on one customer, borrower, supplier or counterparty, so that a single event does disproportionate damage. Neither can be read off a share price. Both show up in the income statement, the notes to the accounts and the capital rules for banks.
When a supplier’s fault becomes your loss
Delta Air Lines’ results for the September quarter of 2024 include a section of the release is headed “Financial Impact Of The CrowdStrike-Caused Outage.” The direct revenue impact of the incident was approximately $380 million, mainly from refunding customers for cancelled flights and from compensation in cash and SkyMiles. The non-fuel expense impact was $170 million, mainly customer expense reimbursements and crew-related costs. Fuel expense was $50 million lower than it would have been, because of 7,000 flight cancellations over a five-day period. Delta had disclosed the impact on 8 August.
| Delta, September quarter 2024 | Millions of dollars |
|---|---|
| Direct revenue impact of the outage | 380 |
| Non-fuel expense impact | 170 |
| Fuel expense below what it would have been | (50) |
| Net hit to operating income (the sum of the three) | 500 |
The last row of the table is the sum of the three reported figures, so it is a calculation made here and not a number Delta reported. It comes to $500 million. Against total operating revenue of $15,677 million for the quarter, the revenue impact alone is 2.4% and the net hit is 3.2%. Operating income was $1,397 million, compared with $1,984 million in the September quarter of 2023, a fall of $587 million, so the net hit is about 85% of that fall. The release does not say whether Delta will try to recover the costs from anyone, and this lesson does not either.
The example shows the shape of operational risk. The cause was outside the airline, in a software problem at a supplier. The cost was inside it: refunds, hotel and meal reimbursements, crews out of position. The firm could not diversify the loss away by holding another stock, because it was the one operating the flights. What it can do is reduce how likely and how damaging such events are, with backups, tested recovery plans, and contracts and insurance that share the cost, and then set aside money for what is left. The lesson on insurance covers the last of these.
How regulators size capital for operational risk
A bank cannot predict its own operational failures, but regulators require it to hold capital against them. The Basel Committee’s standardised approach starts from a business indicator (BI), a measure of the bank’s size in euros. The bigger the bank, the higher the share of its BI that counts. The result is the business indicator component (BIC), found by applying a rising scale of coefficients to the part of the BI that falls in each bucket, in the same way a marginal tax rate applies to the part of income above each threshold.
| Business indicator (BI) | Coefficient on the part of BI in the bucket |
|---|---|
| Up to €1 billion | 12% |
| From €1 billion to €30 billion | 15% |
| Above €30 billion | 18% |
The internal loss multiplier brings in the bank’s own loss record: it equals 1 when the bank’s loss component and its business indicator component are equal. Take a bank with a BI of €5 billion and a multiplier of 1. The first €1 billion counts at 12%, which is €0.12 billion, and the other €4 billion at 15%, which is €0.60 billion. The BIC is €0.72 billion, which is also the capital requirement at a multiplier of 1. Multiplying by 12.5 gives risk-weighted assets of €9.0 billion for operational risk. The page of the framework works through a BI of €35 billion in the same way and reaches €5.37 billion.
Two features are worth noticing. The requirement depends on the size of the business and not on a forecast of failures, so it is a rough proxy for exposure. And the scale rises with size, so a large bank holds proportionately more capital against operational risk than a small one.
Concentration in a firm’s customers
A company that sells to a few customers is exposed to each of them. Annual reports must say so, and the wording is blunt. Emerson Radio writes that the complete loss of, or a significant reduction in business from, or a material adverse change in the financial condition of a key customer would cause a material and adverse change in its revenues and operating results. Oil-Dri Corporation of America warns that the loss of, or a substantial decrease in purchases by, Walmart could harm its sales and profitability, and that large customers have significant purchasing leverage.
The two filings show very different degrees of the same risk.
| Customer concentration | Emerson Radio, year to 31 March 2025 | Oil-Dri, year to 31 July 2025 |
|---|---|---|
| Net revenues or net sales | $10.8 million | $485.6 million |
| Largest customer, share of sales | Amazon, about 39% | Walmart, about 19% |
| Second customer, share of sales | Walmart, about 31% | Not given |
| Largest customer a year earlier | Walmart, about 53% | Walmart, about 20% |
| Largest customer, share of receivables | Amazon, 59% | Walmart, 23% |
At Emerson Radio about 39% of net revenues came from Amazon and about 31% from Walmart in the year to 31 March 2025. On net revenues of $10,785 thousand, that is about $4.2 million and $3.3 million, calculated here from the rounded percentages. The year before, Walmart had been about 53% and Amazon about 20%. So the firm’s biggest customer changed in a single year and the shares moved by tens of points, which is what high concentration looks like. Emerson also reported a net loss of $4,731 thousand that year, but the filing does not link that loss to its customers, and the lesson does not either. At Oil-Dri, Walmart was about 19% of net sales in the year to 31 July 2025 and 20% a year earlier. On net sales of $485,572 thousand that is about $92.3 million. That is a very large customer, but it is one-fifth of the business, and the figure moved by only a point.
Concentration also shows in receivables. Amazon accounted for 59% of Emerson’s trade receivables at 31 March 2025, which means a single customer’s payment decides a large part of the firm’s cash coming in. At Oil-Dri, Walmart was 23% of net accounts receivable at 31 July 2025. The lesson on credit risk explains how a firm weighs the chance that a customer does not pay.
Concentration in a bank’s lending
The same logic applies to banks, with capital as the yardstick. A bank’s Tier 1 capital is what absorbs its losses, so the question is how much of it a single borrower could wipe out. The Basel large exposures standard, in force from 1 January 2019, counts an exposure as large when it reaches 10% or more of Tier 1 capital, and it caps the exposure to one counterparty, or to a group of connected counterparties, at 25% of Tier 1 capital. A stricter limit of 15% applies between global systemically important banks.
| Large exposures standard | Share of Tier 1 capital |
|---|---|
| An exposure counts as large from | 10% |
| Limit on exposure to one counterparty or group of connected counterparties | 25% |
| Stricter limit between two global systemically important banks | 15% |
For a bank with $40 billion of Tier 1 capital, an exposure is large from $4 billion, the limit for one counterparty is $10 billion, and the limit between two global systemically important banks is $6 billion. The limit is a cap on a single name. It does not by itself stop a bank from lending heavily to one industry or one region, which is a form of concentration the standard does not measure.
Lose the biggest customer
The calculator uses an invented firm with $100 of sales and $10.0 of operating profit. Set how much of the sales go to its largest customer, the share of costs that varies with sales, and how much of its purchases that customer cuts. When sales fall, only variable costs fall with them. Fixed costs, such as rent and salaries, stay, so the loss of sales cuts into profit by the lost sales times the contribution margin. The lesson on contribution margin and the lesson on operating leverage explain why. The firm is invented and its figures are not those of Emerson Radio or Oil-Dri.
A firm with $100 of sales and $10.0 of operating profit sells $20.0 of it to one customer, and variable costs are 60% of sales. That customer stops buying altogether, so sales fall by $20.0 and costs by only $12.0. Operating profit falls by $8.0 to $2.0, a change of −80.0%.
Five experiments. First, leave the settings alone: 20% of sales to the largest customer, variable costs at 60% of sales, and the customer leaving altogether. Sales fall by $20.0 and costs by $12.0, so profit falls by $8.0 to $2.0, a drop of 80.0%. A customer worth a fifth of sales takes four-fifths of the profit. Second, raise the customer’s share to 40%, close to Amazon at Emerson Radio. Sales fall by $40.0 and costs by $24.0, so profit falls by $16.0 and becomes a loss of $6.0, a change of 160.0%. Third, keep 40% but make the cut 50%. Sales fall by $20.0 and profit is $2.0, exactly as in the first experiment: a customer worth twice as much cutting its purchases in half does the same damage as a smaller customer leaving. Fourth, return to 20% and the full loss, and raise variable costs to 80%. Costs saved rise to $16.0, profit after is $6.0, and the drop is 40.0%. A firm whose costs move with sales is cushioned. Fifth, set the share to 10% with variable costs at 60%. Sales fall by $10.0 and profit is still $6.0.
How to read the result
The share of sales is the first number to look at, but the damage depends on three things together: how big the customer is, how much of the cost base is fixed, and how likely the customer is to leave or to squeeze the price. The lab shows the first two. The third is the bargaining position the filings describe, with large customers holding purchasing leverage. Measuring concentration also means looking at more than the largest name, because two customers at 39% and 31% are a joint exposure of 70%. For a bank the same idea is expressed against capital and not against income. In both cases the remedy is the same in principle: spread the exposure, hold a cushion that is sized to the largest single loss, or share the risk, and accept that each has a cost. The lesson on diversification explains how holding many positions reduces risk that belongs to one of them.
What this lesson leaves out
- An invented firm. Its sales, profit and cost structure are assumptions, and the percentages of Emerson Radio and Oil-Dri are used only to make the shares realistic. Neither company’s own costs or profits are modelled.
- One event. The calculator takes the loss of sales as given. It does not estimate how likely a customer is to leave, or how long a firm takes to replace the sales.
- Operational risk is wider than one outage. The Delta figures show one event in one quarter. Fraud, errors, legal action, cyber attacks and natural disasters follow other patterns, and the lesson does not measure them.
- Part of the Basel scheme only. The lesson uses the bucket coefficients and the multiplier as stated in the framework. It does not explain how the business indicator is built from a bank’s accounts, or how the loss component is computed.
- Reported percentages are rounded. The filings say “approximately” for most shares, and the dollar amounts calculated from them are approximations.
- Delta’s cost is not the whole story. The release gives the revenue and expense impact for one quarter. It does not say what the outage cost afterwards or whether any of it was recovered.
- No advice. The lesson explains risks. It does not assess any company’s customers or any bank’s lending today.
Common mistakes
Treating operational risk as unmeasurable
It is hard to forecast, but its costs are real and can be read in the accounts, as Delta’s figures show. Regulators also require capital for it.
Looking only at the largest customer
Two or three large customers together can be a larger exposure than one. Emerson Radio’s top two were about 70% of net revenues.
Assuming profit falls by the lost sales
Variable costs fall too. Profit falls by the lost sales times the contribution margin, not by the full amount.
Reading a small percentage as a small risk
A customer worth 20% of sales took four-fifths of the profit in the first experiment, because the firm’s thin margin leaves little room.
Mixing up the two limits
The 10% line only marks an exposure as large. The cap is 25% of Tier 1 capital, or 15% between two global systemically important banks.
Try it yourself
1. A bank has a business indicator of €0.8 billion and a multiplier of 1. What is the business indicator component?
Show the working
The whole amount is in the first bucket, so the component is 12% × €0.8 billion = €0.096 billion, which is €96 million.
2. A bank has a business indicator of €5 billion. What is the component, and what are the risk-weighted assets at a multiplier of 1?
Show the working
12% × €1 billion + 15% × €4 billion = €0.12 billion + €0.60 billion = €0.72 billion. Risk-weighted assets are 12.5 × €0.72 billion = €9.0 billion.
3. A bank has $40 billion of Tier 1 capital. From what exposure is a position large, and what is the most it may lend to one borrower?
Show the working
A large exposure starts at 10% × $40 billion = $4 billion. The limit is 25% × $40 billion = $10 billion. Between two global systemically important banks the limit is 15%, which is $6 billion.
4. Emerson Radio’s net revenues were $10,785 thousand and about 39% came from Amazon. About how many dollars is that?
Show the working
0.39 × $10,785 thousand = $4,206 thousand, about $4.2 million. It is approximate, because 39% is rounded.
5. Delta’s revenue impact was $380 million, its non-fuel expense impact $170 million and its fuel saving $50 million. What was the net hit to operating income, and what share of the quarter’s $15,677 million of revenue is it?
Show the working
380 + 170 − 50 = $500 million. Divided by 15,677 that is 3.2%.
Where this is used
- A bank computes the capital it must hold for operational risk from its business indicator and its loss history.
- A supervisor checks each large borrower against the limit on exposures as a share of Tier 1 capital.
- A company lists in its annual report the customers that account for a large part of its sales, and the risk if one leaves.
- A lender reviewing a small supplier asks how much of its sales and receivables rest on one retailer.
- A business continuity team tests how fast critical systems can be restored, since the cost of an outage grows with each day.
Key terms
- Operational risk
- The risk of loss from failed processes, people or systems, or from outside events.
- Concentration risk
- The risk that too much depends on one customer, borrower, supplier or counterparty.
- Business indicator
- The measure of a bank’s size, in euros, that the Basel standardised approach uses for operational risk.
- Business indicator component
- The business indicator multiplied by marginal coefficients of 12%, 15% and 18% in three buckets.
- Internal loss multiplier
- The factor that brings a bank’s own loss record into its operational risk capital. It equals 1 when the loss and business indicator components are equal.
- Large exposure
- An exposure to one counterparty or group of connected counterparties of 10% or more of Tier 1 capital.
- Tier 1 capital
- The core capital of a bank, the layer that absorbs losses first.
- Variable cost
- A cost that rises and falls with sales.
- Fixed cost
- A cost that does not change with sales in the short run.
Questions people ask
Is operational risk the same as an accident?
Not always. It covers failures of processes, people and systems, and outside events. Some are accidents, such as a software fault, and some are deliberate, such as fraud.
Why does a bigger bank hold more capital for operational risk?
The scale of coefficients rises from 12% to 15% and then 18% as the business indicator grows, since a bigger business has more that can go wrong.
Is having a big customer bad?
Not in itself. A big customer can bring volume and steady orders. The risk is in depending on it, which is why the share of sales, the margin and the contract terms matter.
Why do banks have a limit on one borrower?
So that the failure of a single borrower, or of a group of connected borrowers, cannot take away more than a set part of the bank’s core capital.
Sources and review
- Delta Air Lines, Inc., September quarter 2024 financial results (Form 8-K, Exhibit 99.1), for the financial impact of the CrowdStrike-caused outage (about $380 million of direct revenue impact, $170 million of non-fuel expense, $50 million lower fuel expense, 7,000 flight cancellations over five days) and for total operating revenue and operating income in the September quarters of 2024 and 2023. The read covered the first 100,000 characters of the exhibit.
- Basel Committee on Banking Supervision, Basel Framework, OPE25: Standardised approach (in force from 1 January 2023), for the business indicator component with its three buckets (12% up to €1 billion, 15% from €1 billion to €30 billion, 18% above €30 billion), the operational risk capital requirement as the business indicator component times the internal loss multiplier, and risk-weighted assets equal to 12.5 times that requirement. The read covered the first 100,000 characters of the page; the formulas were rebuilt from the bucket table and checked against the page’s own €35 billion example.
- Bank for International Settlements, Financial Stability Institute, Large exposures standard: executive summary, for the definition of a large exposure (10% or more of Tier 1 capital), the limit of 25% of Tier 1 capital for exposure to a single counterparty or group of connected counterparties, the stricter 15% limit between global systemically important banks and the date the standard came into force (1 January 2019).
- Emerson Radio Corp., Annual report on Form 10-K for the fiscal year ended 31 March 2025, for the shares of net revenues from Amazon (about 39%) and Walmart (about 31%) in fiscal 2025 and from Walmart (about 53%), Amazon (about 20%) and Fred Meyer (about 10%) in fiscal 2024, net revenues of $10,785 thousand and a net loss of $4,731 thousand in fiscal 2025, and the risk-factor wording on the loss of a key customer. Amazon’s 59% share of trade receivables at 31 March 2025 comes from the receivables note in the same filing (XBRL page R20). The read covered the first 100,000 characters of the 10-K, and the note page.
- Oil-Dri Corporation of America, Annual report on Form 10-K for the fiscal year ended 31 July 2025, for sales to Walmart and its affiliates of about 19% of net sales in fiscal 2025 and 20% in fiscal 2024, and the risk-factor wording on the loss of purchases by Walmart; Walmart’s 23% share of net accounts receivable at 31 July 2025 comes from the XBRL page R52 of the same filing; net sales of $485,572 thousand in fiscal 2025 come from the company’s annual results press release as republished by Finviz. The read covered the first 100,000 characters of the 10-K.
How the numbers were checked: the Delta sum and ratios, the business indicator component, the capital and risk-weighted assets, the exposure limits, the dollar amounts from the customer percentages, and the loss of sales, costs saved and profit in the calculator were recomputed in plain code. The calculator, which runs separately, was compared with that code for every combination of settings it allows. The Delta, Basel, Emerson Radio and Oil-Dri figures are quoted from the cited documents. The firm in the calculator is invented.