Third-party compliance due diligence