Effective measurement of 3rd party risk