Own your risks: Third-party risk management