identify and mitigate third-party vendor risks in projects