three points about third-party due diligence