Acceptable Individually, Concentrated Collectively
The 2007–2009 financial crisis produced a specific, well-documented governance lesson: risk that is acceptable when assessed exposure by exposure can become dangerously concentrated when the same underlying exposure recurs, unrecognized, across multiple business lines.
Post-crisis supervisory analysis identified a recurring structural failure across affected institutions: individual business lines frequently maintained exposure levels that were, on their own terms, within acceptable risk limits. What many institutions could not do reliably was aggregate those exposures across business lines to identify when the same underlying risk — the same counterparty, the same asset class, the same correlated exposure — was accumulating simultaneously in multiple places that no single risk owner was positioned to see together.
The documented pattern. Some exposures remained within local limits even while aggregate concentration was not adequately visible at enterprise level. The aggregation failure occurred above any single local exposure view: no consolidated view existed that could reliably recognize when several individually acceptable exposures were, in fact, concentrated bets on the same underlying condition.
Why individual acceptability is not a reliable proxy for collective acceptability. This case demonstrates a general principle beyond its specific financial context: a risk-limit framework built around individual exposures, however well-enforced at that level, provides no assurance about concentration risk across exposures unless an explicit aggregation mechanism exists above the individual level. Each business line passing its own risk review is consistent with — and does not rule out — dangerous concentration existing at the enterprise level.
Governance consequence. Boards relying on business-line-level risk reporting, each individually confirming acceptable exposure, can reasonably believe enterprise risk is under control, while a concentration invisible at the business-line level accumulates because no report in the standard reporting structure was built to surface it.
What changed as a result. Subsequent regulatory reform explicitly required stronger enterprise-wide risk-data aggregation capability — the ability to identify concentration and correlation across business lines, not merely within them — as a direct governance response to this documented failure mode.
Why this generalizes beyond financial risk. The specific case involves financial counterparty exposure, but the structural lesson — that individually acceptable positions can combine into unacceptable concentration invisible at the individual level — applies to any organization managing risk, exposure, or dependency (vendor, customer, technology, geographic) across multiple semi-independent units.
Evidence boundary. The specific findings regarding pre-crisis risk aggregation failures and subsequent regulatory reform are well documented in Basel Committee and financial-supervisory analysis. The generalization to non-financial concentration risk across any multi-unit organization is Obraval’s interpretation, extending a documented sector-specific finding into a broader systemic-conditions principle.
The executive question. Is there a mechanism, above the level of any single business unit, that would recognize if several individually acceptable exposures were actually concentrated bets on the same underlying condition?