When a regulator or rating agency asks management to demonstrate control of counterparty credit concentration, the answer must be evidence, not assertion. Boards that cannot produce the evidence trail are governing a risk they cannot prove is governed.
When the board asks whether management has control of enterprise-level concentration, the answer cannot be a narrative. It must be evidence that specific controls are operating and producing specific outcomes.