Why a Profitable Business Can Still Be Fragile
Jun 7, 2026 · 7 min read
He told me he’d known the client was getting too big for a while. He just hadn’t done anything about it because the cash was good and the relationship felt stable.
This is concentration risk. It’s the most underrated threat to small business value, and most owners I work with have at least one form of it without knowing it. By the end of this post, you’ll know the three concentration risks that quietly sink otherwise-profitable businesses, how to measure each one, and what to do when you find it.
Risk #1: Customer concentration
Customer concentration is when too much of your revenue comes from too few customers. The textbook threshold is 10%. If any single customer accounts for more than 10% of revenue, you have exposure. Once a customer crosses 20%, you have a serious problem.
The math is brutal. If your largest customer is 30% of revenue and they leave on standard 30-day notice, you lose roughly 30% of revenue overnight. Your fixed costs (rent, salaried staff, software, your own draw) don’t drop. A healthy 15% net margin business can flip to a meaningful net loss in a single month.
It also shows up when you try to sell or refinance. SBA lenders and acquirers both haircut businesses with customer concentration, sometimes 20 to 40% off valuation, sometimes passing entirely. The $2M business with 50 customers is worth more than the $3M business where one customer is 40% of revenue.
What to do:
- Run a customer concentration report monthly. Top customer as a percentage of revenue. Top 5 as a percentage of revenue. Track the trend, not just the snapshot.
- Set a hard ceiling. Common ones: no customer over 20%, top 5 under 50%. When a customer approaches the line, decide consciously: diversify away or actively cap the relationship.
- Negotiate the contract that protects you. Longer notice periods (90 to 180 days), project-based scope rather than open-ended retainers, and no exclusivity clauses that lock you out of competitors.
Risk #2: Key-person risk
Key-person risk is what happens when one person holds operational knowledge or capabilities your business can’t replace inside 30 days. Founders. Head of sales. Lead developer. The person who actually understands how the inventory system works.
The honest test: if that person won the lottery tomorrow and called in their resignation Monday morning, what breaks?
For most owner-operators, the answer is “everything.” That’s a key-person risk concentrated in you. But there’s almost always a second one buried in the org chart: the senior PM who runs every major client, the bookkeeper who has been there 11 years and is the only one who knows where the bodies are buried in QuickBooks, the head of delivery who has nine years of vendor relationships in her head.
I worked with a $4M services business last year where the head of delivery gave six weeks notice. Not because she was unhappy. She got married and moved states. The owner had six weeks to document a decade of operational knowledge. They got through it. Barely.
What to do:
- Run the lottery test on every senior role. If the answer is “we would be in serious trouble,” you have a key-person risk on the books.
- Document the work, not just the role. SOPs, vendor lists, decision trees, login inventories. Most owners think they have documentation. Most owners don’t.
- Cross-train on critical workflows. The backup person has to have actually done the work, not just read the doc.
- Build redundancy where documentation isn’t enough. Two senior engineers, not one. A second relationship-holder on the top accounts.
- Run stay interviews, not just exit interviews. If your key person is unhappy, you want to know now, not 30 days before they leave.
Risk #3: Relationship concentration
This is the one most owners miss. It’s a specific flavor of key-person risk: when individual employees own the customer relationships, and those employees can walk out the door with the customers.
It shows up most in service businesses, agencies, professional services, and any B2B business where the buyer trusts a person, not a brand. The account manager who has been on the same three accounts for four years. The senior consultant whose clients call her cell phone. The salesperson who built the book.
Here is how the failure plays out. You train a strong person for 2 to 3 years. They develop deep client trust, deep knowledge of the customer’s business, and a track record of results. They are underpaid relative to what they could earn elsewhere, or underpaid relative to the value they generate. They leave, to a competitor or to start their own thing or to a customer who poaches them. They take 20 to 50% of the book with them, because the customer relationship lives in their head, not in your firm.
The legal protections are weaker than most owners think. Non-competes are unenforceable in many states. Non-solicits are stronger but only buy you 12 to 24 months. By the time the clock runs out, the customer has already churned or already moved.
What to do:
- Audit your client relationships. Who owns each one: one person, two, or the brand? If the answer is “one person” on your top accounts, fix that first.
- Build a “second seat” on every major account. A second person in client meetings, copied on emails, known to the buyer.
- Standardize the work product so the firm’s quality, not the individual’s, is what the client buys.
- Get the compensation math right. If your top performer is generating $1M in revenue and earning $90K, they will eventually do the math. Don’t let them do it on a competitor’s timeline.
- Use non-solicit agreements (more enforceable than non-competes) and stop hiring senior client-facing people who won’t sign one.
What most owners get wrong about concentration risk
Three patterns I see over and over.
They notice it but don’t measure it. “I know we’re too dependent on Acme Corp” is not a metric. Without a number on a dashboard, the problem doesn’t get worked on.
They confuse loyalty with safety. A 10-year customer relationship feels safe right up until the day it isn’t. A 9-year employee feels indispensable, then gets a better offer. Tenure is not protection.
They wait for a trigger. Most owners only address concentration risk after a near-miss: a major customer threatens to leave, a key employee gets recruited away, an SBA lender flags it on a refi. By then it is expensive to fix.
The reason concentration risk is dangerous isn’t that any single failure is likely. It is that any single failure is fatal. Low probability, high impact. The right time to address it is when the business is healthy and you have time.
The bottom line
Concentration risk is what makes a profitable business fragile. Three forms to watch: customers, key people, and the relationships your employees own. None of them show up on a standard P&L. All of them show up in the kind of real CFO dashboard I build with clients.
If you want a second set of eyes on where your business has concentration risk, I offer a free 30-minute diagnostic call. No pitch, just a look at what I would flag.
Let’s Talk
We help business owners like you spot hidden risks, build smarter systems, and grow with confidence.
Book a free 30-minute call
Email us at info@turnpointstrategies.com
Learn more at www.turnpointstrategies.com
Turnpoint Strategies
Clear numbers. Smarter decisions. More profit.
