The situation
A supplier incident exposed a familiar split. Procurement understood contracts, security understood technical risk and operational teams understood how the service was actually used. No single group held the complete picture.
What changed
The engagement used the incident to rehearse the questions each role needed to ask. The work focused on hand-offs, escalation and evidence, rather than a generic awareness module.
Why it matters for ACP
Supplier risk becomes governable when decisions have named owners and a visible record. Paid ACP includes behaviour-change support so teams can reinforce those decisions in context. There is no standalone training offer.
