vendor assessment