revenue-concentration-audit

Pull all sales invoices for the period, aggregate revenue by customer, compute each customer's share of total revenue, and rank them descending. Flag any customer above 20% of total revenue as a concentration risk and save the table for the audit record.

The standard threshold is 20% of total revenue from a single customer, a common corporate governance and investor-reporting convention. Do not raise this threshold without board approval, as it understates disclosed risk.

Yes. If multiple customer entities share a single ultimate parent, their revenues must be aggregated before the concentration check. Treating subsidiaries separately understates the true concentration risk.

Short reporting periods with lumpy payments can spike one customer above the threshold. Use a trailing 12-month revenue total alongside the month-to-date figure to assess structural rather than temporary concentration.

Do not use it for margin analysis by client, which belongs to unit economics analysis, or for AR collections, which belongs to credit control workflows. It only measures revenue share concentration, not profitability or collectability.