As a final step before closing the Third-party Risk Assessment, what task(s) would the Risk Assessor typically do?