Which of the following should be done FIRST when concerns have been identified regarding the financial viability of a potential software supplier?

Implementing an escrow agreement is a mitigation strategy for supplier failure, but it should only be done after assessing the specific risks and their likelihood through a risk assessment.

A risk assessment will systematically identify, analyze, and evaluate all potential risks associated with the supplier's financial viability, including the potential impact on project timelines, service continuity, and data security. This foundational step provides the necessary information to determine the appropriate mitigation strategies.

Including a right-to-audit clause is a contractual control that can help with oversight, but it does not address the fundamental concern of financial viability itself; a risk assessment informs what to audit and why.

Licensing intellectual property might be a very advanced and costly mitigation, applicable only if the risk assessment determines it is absolutely necessary and feasible, and it is not the initial step to understand the problem.