third-party software audit