Performing an audit on vendors' security controls and practices is the most effective way to ensure the security of services and solutions delivered by third-party vendors. Audits are thorough assessments that evaluate the vendors' security posture, identify any vulnerabilities, and ensure they comply with the required security standards and best practices. This approach directly examines the vendors' capabilities and practices, providing a higher level of assurance compared to incorporating risk management into contracts or periodic reviews alone.