This typically includes a first high-level risk assessment on the basis of predefined criteria, an internal feedback loop and a rigid questionnaire, which has to be completed and signed by the concerned business partner’s management.