third-party asset risk