What does vendor risk management involve on a practical level? What tools are recommended for this?