third-party-vendor-risk-1 fixed