CFOSuppliersRisk

Supplier Concentration Audit: Detecting Dependencies Before They Become Costly

30% of spend with a single supplier is an invisible risk — until that supplier raises prices or disappears. Claude detects it in 30 seconds.

The Spendesk MCP Team·9 July 2026·5 min read
Supplier Concentration Audit: Detecting Dependencies Before They Become Costly

The Problem

Supplier concentration is one of the least-monitored financial risks in scale-up finance teams. Everyone knows Salesforce is a big line item — but does anyone know exactly what percentage of total spend it represents? Or whether there are other suppliers that, combined, account for more than 30% of all purchases?

This kind of intelligence doesn't surface in a dashboard. You have to export 12 months of spend, group by supplier, calculate relative shares, and decide on an alert threshold. That's a 3–4 hour task for a finance team — and in practice, it never happens until after an incident: a supplier that suddenly raises prices, gets acquired, or starts experiencing service disruptions.

The risk isn't purely financial. A supplier that represents 25% of your IT spend and suffers an extended outage can bring operations to a halt. Supplier dependency is also operational exposure — and most CFOs don't measure it until it's too late.

What the Spendesk MCP Changes with Claude

With the MCP, Claude analyses the full structure of your supplier spend across any period in seconds. It calculates concentration indices, flags critical dependencies, and proposes concrete actions — no export required.

Claude Code — MCP Spendesk
Vous
Analyse our supplier concentration over the last 12 months. What are our dependency risks?
⚙spendesk_analyze_spend⚙get_suppliers
C

Supplier Concentration Analysis — July 2025 to June 2026

Total spend analysed: 2,847,300 €

Top 10 suppliers by spend share:

RankSupplier12-month spendShare of totalType (my own labelling)
1Salesforce312,400 €10.9%CRM SaaS
2AWS287,600 €10.1%Infrastructure
3Deloitte198,200 €6.9%Consulting
4Workday156,800 €5.5%HR SaaS
5Stripe143,100 €5.0%Payments
6Google Workspace98,400 €3.4%Productivity
7Datadog87,200 €3.1%Observability
8HubSpot76,300 €2.7%Marketing SaaS
9Legalstart62,100 €2.2%Legal
10Personio58,400 €2.1%HR SaaS

HHI (Herfindahl-Hirschman Index): 412

→HHI < 1,000 = low concentration ✅ — your supplier portfolio is relatively diversified.

Dependency alerts:

⚠️Salesforce + AWS combined = 21.0% of total. A disruption to either would have immediate operational impact.
⚠️Top 3 suppliers = 27.9% of total. If Deloitte raises fees by 15%, that's +29,700 € annual impact.
⚠️HR SaaS category: Workday + Personio = 7.6% of total for a single business function — a potential overlap worth investigating.

Would you like a breakdown by cost center or a price impact simulation for Salesforce?

Going Further: 2 Additional Use Cases

Identifying SaaS suppliers without annual contracts

Some SaaS suppliers are billed monthly without commitment — which makes them flexible but also vulnerable to immediate price increases. Spendesk holds no contract data, but Claude can identify suppliers representing more than 5% of total spend and show, from their invoicing pattern, which ones are billed month by month.

Claude Code — MCP Spendesk
Vous
Which SaaS suppliers represent more than 5% of our total spend and don't have an annual contract?
⚙spendesk_analyze_spend⚙get_suppliers
C

Spendesk holds no contract data, so I looked at each supplier's invoicing pattern over 12 months (month-by-month spend) as a proxy, to be confirmed against your actual contracts.

SaaS suppliers > 5% of total — contract status:

SupplierAnnual spendShare of totalBilling typeRisk
Salesforce312,400 €10.9%One annual invoice (Oct 2025)✅ Secured
AWS287,600 €10.1%Monthly pay-as-you-go⚠️ No commitment
Workday156,800 €5.5%One annual invoice (Jan 2026)✅ Secured
→AWS (287,600 €) is your only major supplier billed month by month. If its contract carries no annual commitment, a price increase could apply without notice: check the contract.
⚠️Recommendation: explore AWS Savings Plans (1-year commitment) — estimated savings: 15–20% on EC2 instances, approximately 40–55k€ per year.

Would you like the month-by-month trend of AWS spend over the last 6 months? (Usage by instance type is not in Spendesk.)

Detecting suppliers with a single point of contact

A supplier relationship managed by only one person internally is a continuity risk. If that employee leaves, the contractual relationship, account access, and institutional knowledge leave with them.

Claude Code — MCP Spendesk
Vous
Identify suppliers where we only have a single point of contact — relationship dependency risk.
⚙spendesk_analyze_spend
C

The supplier record holds no contact information, so I looked at who is behind the spend: for each supplier, the employees attached to its invoices and payments over the last 12 months.

Suppliers with a single contact (relational dependency risk):

SupplierSingle contact12-month spendRisk level
DeloitteSophie Marchand198,200 €🔴 High
LegalstartThomas Brun62,100 €🟡 Medium
PersonioCamille Girard58,400 €🟡 Medium
DatadogMarc Lefebvre87,200 €🔴 High
⚠️Deloitte (198,200 €/year): all the spend is attached to Sophie Marchand. If she leaves, the account is at risk.
⚠️Datadog (87,200 €/year): all the spend is attached to Marc Lefebvre. Portal access and negotiated pricing terms are likely undocumented.
→Recommendation: for each high-risk supplier, designate a secondary contact in Spendesk and document current contractual terms.

Would you like me to list the payables for these suppliers that have no invoice or receipt attached in Spendesk?

Key Takeaways

  • Supplier concentration is both a financial and operational risk — often invisible until an incident occurs
  • The HHI index, calculated automatically, gives an objective measure of your portfolio's concentration level
  • SaaS suppliers above 5% of spend with no annual contract represent immediate pricing exposure
  • A single internal contact per supplier is a continuity risk that's easy to document and fix
  • Claude turns a 3–4 hour analysis into a 30-second answer, repeatable every quarter

Related skills

Interested in AI Agent services or Custom Integrations?