Notes on axes of variation in third-party risk assessment

There are many different activities that could be described as "third-party risk assessment". Here are some distinctions that I’ve found helpful thinking about the space over the last few weeks.(Thanks Ajeya Cotra and Paul Christiano for discussions that inspired most of this.)Throughout this, I refer to the actors as:Developers.Stakeholders. These are the people who want to be informed about risks. Possible stakeholders include: governments, the public, the developer's board, the developer's em...