How to shore up your third-party risk management program