Third-party risk analyst must resolve whether a vendor finding is theoretical | SmartSolo AI