hello Mark,
does it have to be a third party ?
can we conduct our own risk assessment , my understanding was that as long as all the criteria were addressed it was ok .
thanks
Bala