Vendor & Supply Chain Security Assurance
Trust vendors on evidence, not on the contract's promises.
The executive challenge
The problem this program solves
The institution has policies for vendor — and no rehearsed response. When it happens, the first two hours will be improvised by whoever answers the phone. Risk that is documented rather than governed is discovered in a crisis — at the highest possible price. This is where vendor stops being a compliance artefact and becomes an executive discipline your board will recognise as one.
Context
Why this matters now
Capability
What you will be able to do
- Price vendor risk into strategy, capital and operating decisions.
- Report vendor to the board in a way that informs decisions rather than reassures them.
- Draft a vendor appetite statement that actually constrains decisions.
- Lead vendor incident command when the organisation is under pressure.
The IPAT Course Standard
The five-day journey
Each day is a deliberate progression in managerial capability — from strategic context, to analytical frameworks, to applied practice, to executive judgement under pressure, to a capstone that produces something your organisation keeps.
IPAT Signature Case™
Friday, 21:40
A a national health insurer is hit by a ransomware event with vendor systems only partially segmented. The attackers threaten to release customer data; the board wants service restored, the regulator wants answers, and the media already has a source.
Your decision: In the first two hours: payment posture, restoration sequence, disclosure — and who commands the vendor response.
IPAT Data Lab™
A a national power utility knows it loses money to operational events but cannot see where.
Dataset: Synthetic incident and operational loss dataset for a national power utility, including near misses and unrecorded events.
Your task: Quantify the exposure, find the concentration, and design a mitigation portfolio with a defensible business case.
A vendor exposure dashboard and mitigation investment case.
Data → Analysis → Decision, not Data → Code → Certificate
Day 5 · The Capstone
What will you change when you return to work?
Produce an enterprise risk and resilience blueprint for your institution: appetite, architecture, incident readiness and the investment sequence.
Methodology
Frameworks you will master
- • IPAT Decision Intelligence Framework™
- • IPAT Transformation Architecture™
- • Enterprise risk management (COSO ERM lineage)
- • Three lines of defence
- • Business continuity standards (ISO 22301-aligned)
Cohorts
Upcoming cohorts
New dates are being scheduled
Register with your preferred start date and our admissions team will match you to the next available cohort — or contact us to arrange an in-house delivery for your organisation.
Register your interestExplore further
Related programmes
Learners of Vendor & Supply Chain Security Assurance frequently pair it with these offerings from the same divisions.
Digital Transformation Strategy
End-to-end digital reinvention.
View programme Digital TransformationData Governance, Cybersecurity and AI Governance
Secure and govern your data estate.
View programme Digital TransformationCybersecurity Awareness & Digital Risk
Build cybersecurity awareness and manage digital risk across the enterprise.
View programme
