Map supplier onboarding, risk tiers, assessments, contracts, monitoring, and offboarding into a playful third-party risk model.
Treat the scenario as an educational and fictional case study. Separate policy intent from implementation details, assign ownership, document exceptions, and review controls regularly.
Write a one-page control map with purpose, owner, evidence, exception path, and review point. Keep the fictional example clearly separate from real regulatory advice.