Reviewing third-party audit reports of the vendors provides an in-depth analysis of their security controls and compliance with industry standards. It is a crucial aspect of due diligence that helps in understanding the vendor's capabilities and in making an informed decision. The incorrect options, while possibly part of other processes, do not directly relate to the assessment of the risk and controls of the vendor as part of due diligence. For example, agreeing on the prices does not assess risk or security capabilities, and reviewing the company's own internal policies will not provide information on the vendor's practices.