A risk assessment document should be built by:

A.
vendor staff then reviewed by the customer.

B.
customer staff then reviewed by the vendor.

C.
the vendor and customer jointly.

D.
a non-involved third party.