I have a friend who works at a place where all their IT is outsourced, who's accounts payable stretches every invoice out to 120 days, and who's outsourcing com

I have a friend who works at a place where all their IT is outsourced, who's accounts payable stretches every invoice out to 120 days, and who's outsourcing company downs tools on all 90+ day delinquent accounts. Every 3 months for at least the last 18 months, they've ended up with no updates/patching for a month. Friend informs compliance and risk manager, compliance and risk management scream at accounts payable to get the outsourcer paid in full to get this month's security update done, and the circle of life repeats.