A risk assessment document should be built by:

A.
customer staff then reviewed by the vendor.

B.
vendor staff then reviewed by the customer.

C.
a non-involved third party.

D.
the vendor and customer jointly.