During a risk assessment, a key external technology supplier refuses to provide control design and effectiveness information, citing confidentiality concerns. What should the risk practitioner do NEXT? Review the supplier's contractual obligations. Escalate the non-cooperation to management. Request risk acceptance from the business process owner. Exclude applicable controls from the assessment