Managing when vendor and supplier risk becomes your own