Evaluate third-party vendor risk management