Really? Asking a third-party dev to vouch for testing counts as risk assessment?

Feels like classic Big-4 CYA checkbox theater.