Business Governance Appendix For lower-risk deficiencies, our buying agents or direct vendors are expected to provide evidence to us that remedial action has been carried out within six months of the issuance of the CAP.