How to measure credit risk concentration