Most companies know little about the risks of subcontractors, outsourcing