“Dealing with fourth parties is so difficult that we’d better choose the risks that we want to monitor. We want them to be few, but relevant -- those that are going to make the difference when you’re dealing with fourth parties.”