What is a vendor risk assessment questionnaire?