Third-party risk profile