Reading Customer Concentration Risk in Revenue Disclosures

What happens to a semiconductor company's income statement the day its single largest customer decides to redesign a competitor's chip into next year's product? Nothing shows up right away. The quarter closes fine. The 10-K still reads clean. But the exposure was sitting in plain sight the entire time, in a risk factor most readers skim past on the way to the numbers they actually came for.

Customer concentration is one of the more mechanical disclosures in a 10-K, and one of the least mechanically read. GAAP requires it under ASC 280-10-50-42: any customer contributing 10% or more of consolidated revenue has to be disclosed, by amount, even if the filing declines to print the customer's name. That threshold exists because a company earning half its revenue from one counterparty carries a different risk profile than one spread across thousands of accounts — same reported revenue line, structurally different earnings quality behind it.

The disclosure itself is dry. What it implies is not. A supplier that depends on one buyer for the bulk of its sales has effectively handed that buyer a say in its earnings before a single line of the income statement gets printed — over pricing, over renewal timing, over whether next year's design cycle even includes this supplier's part at all.

I'll walk through where this disclosure actually lives in a 10-K, what three years of Cirrus Logic's numbers show once you line them up, and — because the two get conflated constantly — how to separate concentration a company discloses outright from concentration an investor has to infer from context the filing never states directly.

Where Concentration Risk Lives in a 10-K

The Risk Factors Language

Item 1A of the 10-K is where most investors first meet this issue, phrased defensively: "we depend on a limited number of customers," "the loss of any one of our significant customers could materially harm our business." That language is boilerplate by design — legal counsel wants every material risk named somewhere, whether or not it's live this year. Boilerplate risk language is not where the real information sits. It's a pointer telling you where to look next, not the substance itself.

The Major Customers Footnote

The actual numbers live elsewhere — typically in the notes to the financial statements, under a heading like "Concentration of Credit Risk" or "Significant Customers," and sometimes repeated again in the MD&A's discussion of net sales. This is where the 10-K reveals its hand: a multi-year table, where the risk-factor paragraph up front offered only prose.

ASC 280-10-50-42, Segment Reporting — Major Customers: "If revenues from transactions with a single external customer amount to 10 percent or more of an entity's revenues, the entity shall disclose that fact, the total amount of revenues from each such customer, and the identity of the segment or segments reporting the revenues."

Note what the rule does not require: naming the customer. Plenty of filings satisfy the letter of ASC 280 with "Customer A" while every analyst covering the stock knows exactly who that is from the company's own investor-day slides or a supply-chain trade publication. The rule cares about the dollar concentration, not the reader's curiosity — and companies that would rather not print a competitor's or a partner's name in black and white lean on that distinction constantly.

Cirrus Logic and the Apple Numbers

Cirrus Logic is as clean a worked example as this disclosure produces, mostly because the company has stopped pretending otherwise. Its fiscal year 2025 Form 10-K (fiscal year ended March 29, 2025) discloses that Apple Inc. accounted for approximately 89% of net sales in fiscal 2025, versus 87% in fiscal 2024 and 83% in fiscal 2023. The same filing discloses that Cirrus Logic's ten largest end customers, combined, represented roughly 96% of net sales in fiscal 2025 — meaning the remaining several hundred customers on the books split a rounding error.

Three Years, One Direction

Read those three years side by side and the trend line matters more than any single year's number. 83% to 87% to 89% is not noise around a stable relationship — it's a company getting steadily more, not less, dependent on one buyer's design decisions. A single flat 89% would be a risk factor. A rising 83-87-89% is a risk factor with momentum, and momentum is the part a one-year snapshot hides.

This isn't a hypothetical concern for Cirrus Logic specifically — the company has already lived through a version of it. In 2017, Samsung shifted the audio codec socket in its Galaxy S8 line to a Qualcomm part, unwinding a diversification push Cirrus Logic had spent years building outside its Apple base. No warning line in an earnings release. Just a design win going to a competitor for the next product generation. That's the redesign risk the risk-factor boilerplate gestures at in the abstract, made concrete in a single, dated event.

None of this means Cirrus Logic is a bad business — Apple's device volumes are enormous, and being the incumbent audio and haptics supplier inside that volume is, on its own terms, a genuinely strong commercial position. But strong and fragile aren't opposites. A supplier can be excellent at what it does and still have its entire earnings base subject to a single customer's next design-win decision, a risk no amount of execution quality inside Cirrus Logic's own walls can fully offset. And the ten-largest-customer figure — 96% — tells you the company's attempts to diversify beyond Apple haven't meaningfully changed the shape of the revenue base, whatever the investor-day slides say about new markets.

Disclosed Concentration vs. Concentration You Have to Infer

Not every concentration risk announces itself as cleanly as Cirrus Logic's does. A defense contractor's 10-K might disclose "the U.S. Government" as a single customer under ASC 280 — technically compliant, structurally different from Cirrus Logic's Apple exposure because a government customer doesn't redesign you out for a competitor's part next product cycle the way a consumer-electronics customer can. Multi-year appropriated contracts and a sovereign counterparty are a different animal from a phone maker's annual bill-of-materials decision, even though both clear the same 10% line.

A regional retailer's supplier might show no named 10%-plus customer at all, yet still derive an outsized share of revenue from one big-box account once you cross-reference the segment note against a competitor's disclosure of the same buyer relationship, or against the retailer's own vendor-concentration commentary. The 10% threshold catches what's material enough to name. It does not catch concentration sitting at 8% or 9%, or spread across two or three buyers who individually clear the bar only because a company chose not to aggregate related entities under common control.

So the honest version of this exercise has two steps, not one — the same discipline worth applying anytime you scan for accounting red flags: read what's disclosed, then ask what wouldn't be disclosed under this rule even if it existed. A company with no named customer above 10% can still be concentrated by channel, by geography, or by a handful of buyers sitting just under the reporting line. Absence of disclosure is not evidence of diversification — it's evidence that nothing individually cleared a specific accounting threshold, which is a narrower claim than it sounds.

Why the Percentage Alone Isn't the Whole Risk

The number itself is a starting point, not a verdict. What actually matters is what kind of relationship sits behind it: contracted volume versus pure purchase-order flexibility, a multi-year design-win cycle versus a spot-buy commodity relationship, and — critically — which side holds the pricing power once the number gets large enough that neither party can walk away cheaply. A supplier locked into a customer at 89% of sales has, in one sense, lost most of its ability to push back on price. The customer knows it too, and every renewal conversation happens with that asymmetry sitting on the table.

What to check once a 10-K discloses concentration above 10%: the multi-year trend (rising, flat, or falling), whether the relationship is contracted or purchase-order-based, whether pricing terms are disclosed anywhere in the MD&A, and whether the customer relationship is tied to a specific product generation that could be redesigned out at the next refresh cycle.

I'm less confident than I'd like to be about how to time this risk — the disclosure tells you the exposure exists and roughly how large it is, not when or whether it converts into an actual reset in demand. That's the limit of this document. A 10-K is backward-looking by construction, so a rising concentration percentage tells you the balance of power has shifted, not the date the other side decides to use it.

Key Takeaways

• Customer concentration above 10% of revenue must be disclosed under ASC 280-10-50-42, though the customer's name is optional — read the notes to the financial statements, not just the Item 1A risk language.
• Cirrus Logic's Apple exposure rose from 83% to 87% to 89% of net sales across fiscal 2023 through fiscal 2025, with its ten largest end customers at roughly 96% — a trend line, not a single data point, is the real signal, and Samsung's 2017 shift to Qualcomm shows the redesign risk isn't abstract.
• Concentration you have to infer (channel, geography, sub-10% buyers) is just as real as concentration that's named, and the absence of a disclosed customer doesn't mean the absence of the risk.
• The percentage measures exposure, not fragility — contract structure and pricing leverage determine how much that exposure actually costs a company if the relationship changes.