Unaggregated Concentration Risk Against a Board-Appetite Threshold

The breach already exists. The reporting clock starts when the analysis surfaced, not when the committee next convenes; waiting six weeks would itself be a reportable governance failure and would be indefensible if the provider had an outage in the interim.

Immediate actions:

• Notify the risk committee chair and the CRO in writing now, with a preliminary one-page assessment: exposure, the four regulatory-deadline components named, plausible scenarios (outage, price increase at renewal, contract non-renewal, provider failure), and what is not yet known.
• Confirm definitions before finalising numbers - 62% of all components versus 62% of critical components may not be the same figure, but with all four regulatory components included the breach holds under either reading. Present both.
• Book a formal paper for the next committee with options, not just a status note.

One role boundary matters: the portfolio manager does not reset appetite or accept the breach. The board set the threshold; the portfolio manager quantifies exposure, presents options with costs, and asks the committee to decide between remediation, a time-bound exception, and a formal appetite change. Framing a breach as "managed at portfolio level" without that decision is exactly the failure the appetite statement was written to prevent.

Test each classic response against what it actually removes.

• Transfer - insurance and contractual SLAs address outage impact but leave lock-in and renewal pricing untouched. It does not reduce the concentration the appetite statement measures. Useful as a supplement, not a response.
• Avoid - exiting the provider entirely within 14 months is not credible for 36 components, and attempting it would create delivery risk larger than the concentration. Reject on feasibility, and say so explicitly rather than letting it dominate debate.
• Reduce - the realistic core: a funded exit and portability plan, re-platforming the four regulatory-deadline components to a second provider or portable services, contractual exit assistance and data-portability clauses at renewal, and provider failure scenario testing. The contingency can buy parallel-run capability, an extension option, and exit planning - roughly quantified as months of runway, not a full migration.
• Accept - legitimate only as a board decision with rationale, a review date, and monitoring triggers. It cannot be accepted below board level because it contradicts the stated appetite.

Also act on the letters of intent now. Two new commitments increase concentration and were signed without a portfolio-level check. Recommend they be held pending the committee decision and that the investment gate add a mandatory concentration test - otherwise remediation is outrun by new exposure.

Keep component registers as the system of record and aggregate upward; a parallel portfolio register creates reconciliation work and two versions of the same risk.

Method:

• Define a small taxonomy of portfolio risk themes - for example external dependency, regulatory timing, scarce skills, cyber, supplier, benefits delivery - and require component risks to map to it. Eight to twelve themes is workable; forty is a register in disguise.
• Score each theme by exposure and by correlation: how many components share the same trigger. The cloud concentration matters because one event hits 36 components at once; that correlation is invisible in any single component register.
• Capture cross-component risks that no component owns - shared deadlines in the same quarter, single points of failure, contention for the same scarce skill.
• Set thresholds directly against the appetite statement, and report trend and emerging risk rather than a full list.

Governance: monthly portfolio risk review by the portfolio office with enterprise risk, quarterly to the risk committee. Component managers keep owning their entries; the portfolio office owns the aggregation and the appetite mapping. This is what enables the next concentration question to be answered in days rather than discovered by chance.