Generally speaking, all of the candidates out of the 45 individuals who met the Internet applicant definition would be considered applicants and must be included for your impact ratio analysis. As a result, the firm should have asked them for information regarding race, gender, disability and veteran status. In addition, you are required to maintain records on all of the individuals considered, even if they do not the Internet applicant definition. As a result, you need to know the reason the candidates did not move forward so relevant disposition codes can be applied to each individual. Whether this information is collected and maintained by the firm or you isn't a sticking point; rather, it simply needs to be completed. But also recall that ultimately, the contractor is responsible for ensuring its obligations are being fulfilled (not the third-party firm), so if the firm is handling this on your behalf, circle-back with them to ensure it's being completed per the regulations.
You can use this OFCCP audit checklist to ensure you're doing what is required to maintain OFCCP's regulations including VEVRAA, Section 503, and EO 11246. Or request a demo to streamline your compliance and recruiting efforts.